Privacy notice
This notice explains how we handle personal data in the NDM Academy at academy.ndmx.net (the "Academy"): the video lessons, quizzes and practice companies for people who use NDM, and for companies that asked to try it.
1. Who we are
NDMX is sold, set up and supported by Iris Media (Egypt) and Grasshopper Media (United Arab Emirates, selling worldwide). The partner that serves your company is the controller of your personal data in the Academy: Iris Media for companies in Egypt, and Grasshopper Media for all others. For privacy or legal matters, write to support@ndmx.net.
2. What we collect
- If you come from NDM: when you open the Academy from NDM, or sign in through your company's NDM page, NDM sends us your name, username, language, roles, whether you are an administrator, and your email address if your NDM account has one; and your company's name, address and the NDM modules it uses. The Academy never sees your NDM password.
- If you request access: your company's name and country, your name, work email, language, and a password, which we keep only as a one-way hash. If your company's administrator invites you, we receive the email address, name and language they enter.
- Your learning: the lessons you open, how far you watched, your quiz answers and scores, and your Academy settings (the sections you show, language, video quality, captions, and any extra roles you choose for practice).
- Practice companies: when you press Practise, we make or update your account in your company's practice company with your NDM username, name, language and roles. What you enter there is practice data.
- Sign-in and security: a record of each signed-in browser (your company, you, when it started and was last used), and counts of failed sign-ins and spent links by network address, to stop guessing.
- Emails: the messages we send you (confirming your address, resetting your password, invitations, and our decision on a request), delivered by our email provider.
- Technical data: our hosting provider and our video storage process data such as your IP address, browser type and the pages and videos requested, to deliver and protect the Academy. Our own server log records each page requested, when, and its outcome.
3. Cookies
The Academy sets only the cookies it needs to work:
- a session cookie that keeps you signed in. It ends when you sign out, after two hours without use, and after twelve hours at most;
- a language cookie that remembers English or Arabic, for one year;
- a practice cookie that, for two minutes after you press Practise, ties the way into the practice company to the browser that pressed it.
The Academy uses no advertising, analytics or tracking tools, and loads no scripts from other websites.
4. How we use your data
| Purpose | Legal basis |
|---|---|
| Signing you in and giving you the lessons, quizzes and practice company | Our agreement with your company, or your request for access |
| Showing your progress to your company's administrators | Your company's legitimate interest in training its people |
| Reviewing requests for access and writing to you about them | Your request |
| Operating and securing the Academy | Our legitimate interests |
| Meeting legal obligations | Legal obligation |
These are the grounds recognised by the EU GDPR and the UK GDPR, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and Egypt's Personal Data Protection Law (Law No. 151 of 2020); where other laws apply to you, we handle your data as they require. We do not sell your data or use it for automated decision-making, and we send no marketing from the Academy.
5. Who sees your data
- Your company's administrators see their team's progress: each person's name, username and roles, progress in each section, average quiz score and when they were last active, and can download it as a file. In a company that requested access, its administrator also sees the colleagues they invited.
- The partners' staff, as needed to support you, review requests and keep the Academy secure.
- Our service providers, under contract: our hosting provider, our email provider and our video storage.
- Authorities or advisers, where the law requires it or to protect our legal rights.
6. Where your data is kept
The Academy is hosted in the EU and the UK. Our service providers may process some data outside your country, including in the United States. Where required, we use recognised safeguards such as the European Commission's Standard Contractual Clauses or the UK's International Data Transfer Addendum, or the transfer conditions of UAE and Egyptian law.
7. How long we keep it
- A sign-in lasts at most twelve hours, and its record is deleted once it has run out.
- Links in our emails stop working after a set time: 48 hours to confirm an address, 60 minutes to reset a password, 7 days for an invitation.
- The practice company of a company that requested access is removed after 30 days without use.
- Your account and learning records are kept while your company uses the Academy. Once your company is taken off the Academy, they are deleted, with its sessions, 30 days after anyone from your company last used it.
- A refused request for access is deleted, with its company's and people's details, 30 days after the refusal.
- A company that requested access is deleted, with its people and their learning records, 24 months after anyone from it last signed in, or 24 months after its request if nobody ever did.
- Once a message to you is sent, we keep only its address, subject and outcome; that record is deleted one year after sending.
- Counts of failed sign-ins, and the network addresses they hold, are deleted 30 days after the last failure.
- You can ask us to delete your data sooner (section 8).
- Technical logs are kept only for the short periods set by our hosting provider.
8. Your rights
Depending on where you live, you may have the right to access, correct or delete your data, to object to or restrict its use, to data portability, and to withdraw your consent at any time. To exercise these rights, write to support@ndmx.net; we reply within one month. You may also complain to your data protection authority.
9. Security
We use reasonable technical and organisational measures to protect your data, including encrypted connections, passwords kept only as one-way hashes, short-lived links to the videos, each company's records kept apart, and limited access.
10. Children
The Academy is for people at work and is not directed at anyone under 18.
11. Data in NDM
This notice covers the Academy only. Data your company keeps in NDM, including its practice company, is handled under your company's agreement with us, and for that data your company is the controller. The practice company of a company that requested access holds sample data only and is covered by this notice.
12. Changes
We may update this notice by publishing a new version on this page. This notice is also published in Arabic; if the two versions differ, the English text governs.