Privacy Policy - S2 Academy

Version: 1.0
Last Updated: 24 November 2025
Effective Date: 24 November 2025

1. Introduction

Welcome to S2 Academy ("we", "our", "us"). We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains:

By using S2 Academy, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Data Controller

S2 Academy is the data controller responsible for your personal data.

Contact Information:

Email: contact@s2academy.net
For data protection queries: contact@s2academy.net (subject: "Data Protection Request")

3. What Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Account Information

3.2 Authentication Data

Note: We do not store passwords. Authentication is handled by trusted third-party OAuth providers (Google, GitHub).

3.3 Session and Usage Data

Lawful basis: Processing of session logs and activity is necessary for performance of the contract (to provide the Service) and for our legitimate interests in security and preventing abuse (Article 6(1)(b) and (f) UK GDPR).

3.4 Communication Data

3.5 Payment Data (When Paid Plans Launch)

Important: We do NOT store full credit card numbers. Payment processing is handled by third-party providers (Stripe, PayPal) who are PCI-DSS compliant.

3.6 Cookies and Tracking Data

See our Cookie Policy for detailed information.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following legal grounds:

4.1 Contract Performance (Article 6(1)(b))

Processing necessary to provide the Service you've requested:

4.2 Consent (Article 6(1)(a))

Where you have given explicit consent:

4.3 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate business interests:

4.4 Legal Obligation (Article 6(1)(c))

Processing required by law:

5. How We Use Your Personal Data

5.1 Service Delivery

5.2 Communication

5.3 Payment Processing (Future)

5.4 Security and Fraud Prevention

5.5 Service Improvement

5.6 Legal Compliance

6. Data Sharing and Disclosure

We do not sell your personal data to third parties. We share your data only in the following circumstances:

6.1 Third-Party Service Providers

We share data with trusted service providers who process data on our behalf:

Amazon Web Services (AWS)

OAuth Providers (Google, GitHub)

Email Service Provider (to be specified)

Payment Processors (Stripe, PayPal - when applicable)

All third-party providers are contractually obligated to:

6.2 Legal Requirements

We may disclose your data when required by law:

6.3 Business Transfers

If S2 Academy is involved in a merger, acquisition, or sale of assets, your personal data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

7. International Data Transfers

7.1 Data Location

S2 Academy operates from the United Kingdom, but parts of our infrastructure are hosted in the United States (AWS us-west-2 region).

7.2 Safeguards for International Transfers

When we transfer personal data outside the UK/EEA (for example to AWS in the United States), we implement appropriate safeguards such as UK-approved Standard Contractual Clauses (SCCs), data processing agreements, and technical measures (encryption in transit using TLS 1.2/1.3, secure credential management). Transfers to jurisdictions that do not offer an "adequacy decision" may be subject to these safeguards. You may request more details about the safeguards by contacting contact@s2academy.net.

Important: Data transferred to the United States may be subject to different government access laws than those in the UK/EEA. We implement additional technical and organizational measures to protect your data, including encryption and access controls.

7.3 Your Rights

You have the right to obtain information about the safeguards in place for international transfers. Contact us at contact@s2academy.net for details.

8. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy.

8.1 Retention Periods

Account Data:

Session Logs:

Communication Records:

Payment Data:

Cookies:

8.2 Deletion After Retention Period

When retention periods expire, we:

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

9.1 Technical Measures

9.2 Organizational Measures

9.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) in accordance with applicable law and notify affected individuals where required. We will provide information about the nature of the breach, likely consequences, and measures taken in response.

No security is perfect. While we take reasonable measures to protect your data, we cannot guarantee absolute security.

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

10.1 Right of Access (Article 15)

10.2 Right to Rectification (Article 16)

10.3 Right to Erasure / "Right to be Forgotten" (Article 17)

10.4 Right to Restriction of Processing (Article 18)

10.5 Right to Data Portability (Article 20)

10.6 Right to Object (Article 21)

10.7 Rights Related to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal effects.

10.8 How to Exercise Your Rights

To exercise any of these rights:

How we respond: We will respond to requests to exercise your rights without undue delay and in any event within 30 days of receipt. Where requests are complex or numerous, we may extend this period by a further two months; we will inform you of any extension and the reason for it within one month of receipt. We may request information to verify your identity before fulfilling a request.

11. Cookies

S2 Academy uses only essential cookies necessary to provide our Service. We do not use analytics, marketing, or tracking cookies.

11.1 What Cookies We Use

Essential Cookies

Session Cookie (session)

This cookie cannot be disabled as it is essential for logging in and accessing lab devices. The cookie itself only contains an encrypted session identifier; all actual session data (email address, authentication status, OAuth provider information) is stored securely on our servers.

OAuth Provider Cookies (Third-Party)

When you log in using Google or GitHub, these providers may set their own cookies during the authentication process:

Google OAuth Cookies:

GitHub OAuth Cookies:

Note: These cookies are set by the OAuth providers during the authentication redirect flow and are required to complete the login process. We do not control or access these cookies directly. They are managed by the respective OAuth providers.

11.2 Cookies We Do NOT Use

S2 Academy does not use:

11.3 How to Control Cookies

Browser Settings:

You can configure your browser to refuse cookies, but this will prevent you from logging in to S2 Academy. Instructions for managing cookies:

Important: Disabling essential cookies will prevent you from using S2 Academy. You are responsible for logging out when using shared devices to end your session.

11.4 No Consent Required

Under UK GDPR and PECR (Privacy and Electronic Communications Regulations), we are not required to obtain consent for essential cookies that are strictly necessary for the service you have requested. All cookies used by S2 Academy fall into this category.

No cookie consent banner is required or displayed as all cookies are strictly necessary for service operation.

11.5 Analytics and Usage Tracking

We collect usage analytics through server-side logging (not cookies), including:

This data is stored in our secure database and is necessary for service delivery, security monitoring, and service improvement. No client-side tracking cookies are used for this purpose.

11.6 Future Changes

If we introduce non-essential cookies (such as analytics or marketing cookies) in the future, we will:

12. Children's Privacy

S2 Academy is intended for users aged 13 and above.

12.1 Users Under 13

12.2 Users Aged 13-17

13. Marketing Communications

13.1 Opt-In

13.2 Opt-Out

13.3 Service Communications

We may send essential service communications regardless of marketing preferences. Examples include security alerts, policy changes, and account notifications.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

14.1 Notification of Changes

14.2 Your Continued Use

15. Your Right to Complain

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the supervisory authority.

15.1 UK Information Commissioner's Office (ICO)

Contact:

Website: https://ico.org.uk
Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15.2 Contact Us First

We encourage you to contact us first (contact@s2academy.net) so we can try to resolve your concern directly.

16. Contact Information

For any questions, concerns, or requests about this Privacy Policy or our data practices:

Email: contact@s2academy.net
Subject: "Privacy Inquiry" or "Data Protection Request"
Response Time: We aim to respond within 5 business days

17. Definitions

END OF PRIVACY POLICY