Privacy policy
The short version: we hold what the platform needs to work, we do not sell it, and we do not train models on it.
Effective: August 2026
Working draft
These terms describe how the service actually operates and are provided in good faith. They have not yet been reviewed by legal counsel and are not a substitute for the signed agreement that governs a paid plan. For an enterprise contract, a Data Processing Agreement or anything you need a lawyer to sign, contact info@tkdsmena.com.
1. Who controls what
This matters more than it sounds. For your own account with us — your billing details, your support tickets — TKDS MENA is the data controller.
For the students inside an academy running on TKDS LMS, the academy is the controller and we are the processor. We hold and process that student data on the academy’s instructions, and the academy’s own privacy notice governs it.
If you are a student trying to find out what an academy holds about you, ask the academy first. If they cannot help, write to us and we will.
2. What we collect
Account data — name, email, role, and the password stored only as a bcrypt hash that nobody, including us, can reverse.
Learning data — enrolments, lesson progress, quiz and assignment results, certificates, attendance on live classes.
Commerce data — orders, invoices, wallet balance and payout records. Never card numbers: those go directly to the payment gateway and never touch our servers.
Communication data — chat messages, Q&A posts, support tickets and the notifications we sent you.
Technical data — the device and session records needed to enforce device limits, plus server logs for security and debugging.
3. Why we hold it
To operate the service you asked for: deliver lessons, grade work, take payments, issue certificates and keep accounts secure. That is the lawful basis for almost everything on the list above — it is necessary to perform the contract.
Where we do something that is not strictly necessary, it is opt-in and controlled by the academy administrator, not by us.
5. A note on CAPTCHA
Academies choose between Google reCAPTCHA and our self-hosted TKDS CAPTCHA. If they choose ours, no visitor data leaves our infrastructure for that purpose. If they choose Google, Google’s own privacy terms apply to that interaction.
We built the alternative precisely so that this is a choice rather than an assumption.
6. How long we keep it
Account and learning data is kept while the account is active. When an academy closes its platform, its data is retained for a short wind-down period so it can be exported, then deleted.
Transaction records are kept as long as tax and accounting law requires, which is longer than we would otherwise keep them.
Old notifications and expired password-reset tokens are pruned automatically rather than accumulating indefinitely.
7. Your rights
You can request access to your data, correction of it, deletion of it, or a copy in a portable format. Academy administrators can already export students, orders, grades and analytics to CSV at any time without asking us.
To exercise a right, write to info@tkdsmena.com. If your request concerns data held by an academy rather than by us, we will route it to them and tell you we have.
8. Security
Passwords are bcrypt-hashed. Access is token-based and permissions are enforced on the server. Uploads are re-encoded, and configuration secrets are read in a way that cannot silently fail open.
Our security page carries the full detail, including what we have not built yet.
9. Contact
Privacy questions, requests and complaints: info@tkdsmena.com. Security reports: security@tkdsmena.com.
Enterprise customers can request a Data Processing Agreement.
Other documents