eComCademy is a registered nonprofit educational organization providing online educational resources, courses, community activities and knowledge-sharing opportunities related to eCommerce and the digital economy.
Last updated: 28 August 2026
This policy explains what personal data eComCademy collects when you use ecomcademy-dev-2.itsrew.online, why we collect it, what we do with it, and the rights you have over it. We have written it in plain language rather than legal shorthand, because a policy nobody can read protects nobody.
1. Who we are and who is responsible for your data
The data controller is:
- eComCademy (biedrība, a registered non-profit association)
- Registration number: 40008324226
- Registered address: Lāčplēša iela 6-8, Sigulda, Siguldas novads, LV-2150, Latvia
- Established: 12 April 2023
- Email: info@ecomcademy-dev-2.itsrew.online
eComCademy is a non-profit association whose purpose is to provide free, practical digital commerce education. We do not sell products or advertising on this website, and we do not sell, rent, or trade personal data to anyone.
We have not appointed a Data Protection Officer, because the scale of our processing does not require one under Article 37 of the GDPR. Questions about data protection go to the email address above.
2. What personal data we collect
2.1 When you register for a free member account
To create an account we ask for:
- a username
- an email address
The registration form also asks four optional questions about your background, so we can understand who our learners are and which topics to cover:
- how long you have been in business
- how long you have worked in eCommerce
- an annual store revenue range
- a free text answer about your goals or challenges
These four answers are optional. You can leave any of them blank and your account will still be created. They are stored against your account and are visible only to our site administrators. We use them to plan course topics, not to qualify you as a sales prospect, and we do not pass them to anyone.
Your password is never stored in readable form. WordPress stores only a cryptographic hash of it, which cannot be reversed back into your password.
2.2 When you use the contact form
The contact form collects your first name, last name, email address, an optional subject line, and your message. This is sent to our info@ecomcademy-dev-2.itsrew.online mailbox as an email. The message itself is not saved into the website database.
For diagnostic purposes, the server also writes a short line to its error log recording that a submission happened, with the sender’s email address and the subject line, so that we can tell whether a message failed to be delivered. That log entry is covered by the log retention period in section 4.
2.3 Automatically, when anyone visits the site
Like almost every website, our servers and our security provider record technical information about each request:
- IP address
- browser type and version (the user agent string)
- the page requested and the date and time
- the page you arrived from, if any
This happens automatically and is used to keep the site running, diagnose faults, and block attacks and abuse.
2.4 What we do not collect
We want to be specific about this, because many privacy policies are vague on it:
- We do not run advertising on this site and we do not serve personalised ads.
- We do not build advertising profiles or share data with ad networks or data brokers.
- We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
- We do not knowingly collect data from children. This site is intended for adults working or studying in digital commerce.
3. Why we process your data, and our legal basis
Under Article 6 of the GDPR we must have a lawful basis for each purpose. Ours are:
- Creating and operating your member account, including giving you access to courses and resources. Legal basis: Article 6(1)(b), taking steps at your request and providing the service you asked for.
- The four optional background questions on the registration form, used to plan educational content. Legal basis: Article 6(1)(a), your consent, given by choosing to answer. You can withdraw it at any time and we will delete those answers.
- Replying to messages you send us through the contact form or by email. Legal basis: Article 6(1)(b) where it concerns your membership, otherwise Article 6(1)(f), our legitimate interest in answering people who contact us.
- Keeping the site secure and available, including server logs, backups, and blocking attacks. Legal basis: Article 6(1)(f), our legitimate interest in protecting the site and the people who use it.
- Recording your cookie choice. Legal basis: Article 6(1)(c), our legal obligation to demonstrate that consent was given or refused.
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and we have limited the processing to what is necessary for the purpose. You can object to it, as described in section 9.
4. How long we keep it
| Data | Retention period |
|---|---|
| Member account and profile answers | For as long as your account is open. If an account has been inactive for 24 months we will review it and may delete it. We delete an account at any time on request. |
| Contact form messages | Up to 24 months in our mailbox, so that we can follow up on a conversation, then deleted. |
| Server and security logs | Typically 30 days, unless a specific log is retained longer as evidence of an attack or abuse. |
| Backups | Backups roll over on a fixed cycle. Data you have asked us to erase will disappear from backups as that cycle completes, and is not restored into live use in the meantime. |
| Cookie consent record | 12 months, after which you are asked again. |
5. Who else processes your data
We use a small number of service providers, called processors, who handle data on our instructions. We do not sell data to anyone, and none of these providers may use your data for their own purposes.
- Our hosting provider, which runs the server the website and its database sit on.
- Cloudflare, Inc., which provides our DNS, content delivery, and security filtering. All traffic to the site passes through Cloudflare, so it processes IP addresses and request details in order to block attacks.
- BlogVault / WP Remote and MalCare, which provide site backups, maintenance, and security monitoring. Backups include the member database.
- Google Ireland Limited, for web fonts. Our pages load typefaces from Google Fonts, which means your browser makes a request to Google and Google receives your IP address as part of that request. No cookie is set by this and no account is needed.
- Our email provider, which delivers and stores messages sent to and from
info@ecomcademy-dev-2.itsrew.online.
Some of these providers are based outside the European Economic Area or belong to groups headquartered in the United States. Where data is transferred outside the EEA, that transfer is covered by the European Commission’s Standard Contractual Clauses, by an adequacy decision such as the EU-US Data Privacy Framework, or by another safeguard permitted under Chapter V of the GDPR.
We may also disclose data where we are legally required to, for example in response to a lawful request from a public authority.
6. Analytics, advertising and website tools
We may use third-party tools and services to understand how visitors use our website, improve our educational resources, measure the effectiveness of our Google Ad Grants campaigns, and protect our website and forms from spam and abuse.
These may include Google Analytics 4, Google Tag Manager, Google Ads conversion tracking, Microsoft Clarity, Meta Pixel, Google reCAPTCHA, YouTube, and email marketing services.
Where required, these tools may use cookies or similar technologies and may process information such as website interactions, pages visited, device or browser information, and referral or campaign information. Non-essential analytics and marketing technologies will only be used in accordance with applicable consent requirements.
We use this information for website improvement, educational resource development, campaign measurement, and security purposes. We do not sell or rent personal data to third parties.
7. Cookies
This site uses a limited number of cookies and similar technologies. Some are necessary for the website to function, while others may be used for analytics and to measure the effectiveness of our Google Ad Grants campaigns.
Before you make a cookie choice, no non-essential cookies are set while you are simply browsing the site while logged out.
- Consent cookie. When you respond to the cookie banner, we store your choice in a cookie so that we do not ask you again on every page. It lasts for 12 months and contains only your cookie preference, not an identifier.
- Analytics and advertising measurement cookies. With your consent, we may use tools such as Google Analytics and Google Ads conversion tracking to understand how visitors use our website and to measure actions resulting from our Google Ad Grants campaigns.
- Login and session cookies. If you create an account and log in, WordPress sets cookies that keep you logged in and remember your screen preferences. These are strictly necessary for the logged-in area to function and are removed when you log out.
You can delete cookies at any time through your browser settings. You can also manage your cookie preferences through the cookie settings available on our website. Blocking strictly necessary cookies may prevent you from staying logged in or using certain account features.
8. How we protect your data
- The whole site is served over HTTPS, so traffic between your browser and us is encrypted.
- Passwords are stored only as salted hashes.
- Administrative access to member data is limited to the small number of people who run the association’s website, and only where they need it.
- The site sits behind a web application firewall and is backed up regularly.
No website can promise perfect security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data State Inspectorate within 72 hours as required by Article 33, and we will tell you directly where Article 34 requires it.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy of it.
- Rectification, meaning correction of data that is wrong or incomplete.
- Erasure, often called the right to be forgotten.
- Restriction of processing, meaning we keep the data but stop using it, while a dispute is resolved.
- Data portability, meaning a copy of the data you gave us in a structured, commonly used, machine readable format.
- Object to processing that we base on legitimate interests.
- Withdraw consent at any time, where we rely on consent. Withdrawing it does not affect processing that already took place.
- Complain to a supervisory authority, as set out in section 11.
10. How to get a copy of your data, or have it deleted
Email info@ecomcademy-dev-2.itsrew.online and tell us what you want. Please say clearly whether you are asking for a copy, a correction, or deletion, and write from the email address on your account so that we can confirm it is you. If we cannot identify you from that, we may ask for one further piece of information, and nothing more than we need.
We answer within one month. If a request is unusually complex we may extend that by up to two further months, and we will tell you within the first month if that happens. There is no charge, unless a request is manifestly unfounded or excessive.
If you ask us to delete your account, we remove your account record, your email address, and your profile answers from the live site. Copies inside existing backups are removed as those backups age out on their normal cycle.
11. Complaints
If you think we have handled your data badly, please tell us first at info@ecomcademy-dev-2.itsrew.online, because most problems are quicker to fix directly.
You also have the right to complain to the Latvian supervisory authority at any time:
- Datu valsts inspekcija (Data State Inspectorate)
- Elijas iela 17, Riga, LV-1050, Latvia
- Phone: +371 67223131
- Email: pasts@dvi.gov.lv
- Web: www.dvi.gov.lv
If you live or work in another EU or EEA country, you may complain to your own national supervisory authority instead.
12. Changes to this policy
If we change how we handle personal data, we will update this page and change the date at the top. Where a change materially affects your rights, we will tell registered members by email rather than relying on you to notice.
13. Contact
eComCademy (biedrība)
Lāčplēša iela 6-8, Sigulda, Siguldas novads, LV-2150, Latvia
Registration number: 40008324226
Email: info@ecomcademy-dev-2.itsrew.online