Privacy Statement

Last update: v11, October 1st, 2026

Introduction

Purchasing Academy is committed to safeguarding your privacy and protecting your data. Below you will find the relevant article from our Terms & Conditions (“T&C”) addressing this matter. We encourage you to review the full T&C for complete context and alignment.

10. Privacy statement

 

10.1 Who is responsible for your personal data?

Purchasing Academy Amsterdam B.V. (“PAA”) is responsible for the processing of personal data described in this Privacy Statement.

PAA processes personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (“GDPR”).

10.2 What personal data do we process?

Depending on how you use the PAA Services, PAA may process information such as:

• your first and last name;
• email address and other contact details;
• account and login information;
• Membership, Product, or Corporate Account information;
• learning activities and progress;
• badges, certificates, exams, and other achievements;
• community activity and group membership;
• user content, including posts, comments, messages, files, documents, links, and other information you share through the PAA Services;
• platform usage;
• IP address, device information, cookies, and other technical information;
• communications with PAA; and
• other information you provide when using the PAA Services.

PAA does not receive or store your complete payment card or bank details when you purchase through FastSpring. Payment information is processed by FastSpring and its payment providers.

10.3 FastSpring

If you purchase a Membership, Product, or Corporate Account through FastSpring, FastSpring processes the personal and payment information required for your purchase under its own terms and privacy statement.

PAA receives from FastSpring the information needed to create and manage your PAA account and provide the PAA Services. This may include your name, email address, Membership or Product information, and a unique customer identifier.

Information relating directly to your FastSpring purchase or payment may need to be changed through FastSpring.

10.4 Corporate Accounts

For Corporate Accounts, PAA may receive personal data from the Corporate Customer to create and manage Authorized User accounts. This may include first name, last name, business email address, and other information reasonably required to administer the Corporate Account.

The Corporate Customer is responsible for having a lawful basis to provide this information to PAA and for informing its Authorized Users where required by applicable data protection law.

10.5 How do we use your personal data?

PAA may process personal data to:

• create and manage accounts;
• provide the PAA Services;
• administer Memberships, Products, and Corporate Accounts;
• provide courses, exams, badges, certificates, and other learning activities;
• operate the PAA community;
• communicate with users;
• provide information about relevant PAA Services;
• provide Corporate Account reporting;
• analyze, maintain, secure, and improve the PAA Services;
• prevent fraud, misuse, and unauthorized access;
• process and administer purchases together with FastSpring; and
• comply with legal obligations.

10.6 Legal basis for processing

Depending on the purpose, PAA processes personal data because:

• it is necessary to provide the PAA Services or perform an agreement;
• PAA has a legitimate interest in operating, securing, developing, and improving its Services;
• PAA has a legitimate interest in communicating about relevant PAA Services;
• you have given consent, where consent is required; or
• PAA is required to process the information by law.

Where processing is based on consent, you may withdraw your consent at any time. This does not affect processing that took place before you withdrew your consent.

10.7 Corporate reporting

Where reporting is included in a Corporate Account, PAA may provide the Corporate Customer, and where applicable its authorized PAA reseller or account manager, with information about its Authorized Users.

This may include participation, learning progress, completed learning activities, platform usage, badges, certificates, and other professional-development information.

This information may be used for Corporate Account administration, account management, reporting, and supporting the professional development of Authorized Users.

Corporate Customers and authorized resellers or account managers must use this information only for these purposes and in accordance with applicable data protection law.

PAA does not provide Corporate Customers, resellers, or account managers with access to private messages or the content of an Authorized User’s participation in the general PAA community as part of standard Corporate Account reporting. Activity within a private Corporate Group may be visible to other members or administrators of that group.

10.8 Cookies and technical information

When you first visit the PAA website, you can choose which non-essential cookies you accept. You can change your preferences through the cookie settings on our website.

PAA may process information such as IP addresses, device information, cookies, login information, and platform usage data to operate, secure, analyze, and improve the PAA Services.

Cookies that are necessary for the website or Services to function may be used without consent where permitted by law.

10.9 Who do we share personal data with?

PAA may share personal data where necessary with service providers that support the PAA Services, such as providers of:

• hosting and IT infrastructure;
• learning and website technology;
• video and content delivery;
• email and communications;
• analytics and security;
• customer support; and
• payment and transaction services.

PAA may also share relevant personal data with authorized PAA resellers, distributors, and account management partners where they are involved in selling, administering, supporting, or managing a Membership or Corporate Account.

This may include account information, contact details, platform usage, participation, learning progress, completed learning activities, badges, certificates, and other information reasonably required for Corporate Account administration, reporting, and account management.

PAA may also share personal data with Corporate Customers, professional advisers, authorities, or other parties where required or permitted by law.

PAA does not sell personal data to third parties for their own marketing purposes.

10.10 Data storage and international transfers

PAA stores the personal data in its own user database on servers located in Europe.

PAA uses third-party services that may process data outside the European Economic Area (“EEA”). For example, PAA uses Vimeo to host and deliver video content.

Where PAA is responsible for an international transfer of personal data, appropriate safeguards are used as required by applicable data protection law.

Payments and related transaction data processed through FastSpring are handled by FastSpring under its own terms and privacy statement. FastSpring is responsible for the international processing and transfer of personal data within its payment and transaction services.

10.11 Storage and retention

PAA keeps personal data only for as long as reasonably necessary for the purposes for which it was collected or as required or permitted by law.

When a Membership, Product access, Authorized User account, or Corporate Account ends, PAA may delete or restrict access to the related personal data.

Certain information may be retained where necessary or permitted by law, including information relating to payments, certificates, achievements, security, fraud prevention, disputes, and legal or administrative obligations.

User Content and community-related data may remain available after an account or Membership ends where reasonably necessary to preserve the continuity of discussions or where retention is otherwise permitted or required by law. PAA may delete, anonymize, or retain such content as appropriate.

10.12 Security and confidentiality

PAA treats personal data as confidential and only shares it where necessary to provide the PAA Services, where permitted or required by law, or as otherwise described in this Privacy Statement.

If PAA provides private messaging, PAA may process and store private messages where necessary to provide the messaging service, maintain security, prevent misuse, provide support, or comply with legal obligations.

PAA takes reasonable technical and organizational measures appropriate to the nature of the PAA Services and the personal data processed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, authentication measures, secure hosting, backups, software updates, and other appropriate security measures.

Where a security incident involving personal data provided by a Corporate Customer is likely to materially affect that Corporate Customer or its Authorized Users, PAA will inform the Corporate Customer without undue delay after becoming aware of the incident and will provide reasonably available information about the incident and the measures taken.

Where PAA processes personal data on behalf of a Corporate Customer in circumstances where applicable data protection law requires a data processing agreement, PAA and the Corporate Customer may enter into a separate data processing agreement.

10.13 Your privacy rights

Depending on applicable law and the circumstances, you may have the right to:

• access your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of your personal data;
• restrict the processing of your personal data;
• object to certain processing;
• withdraw consent where processing is based on consent; and
• receive or transfer certain personal data where the right to data portability applies.

These rights may be subject to legal exceptions and retention requirements.

To exercise your rights, contact PAA at support@purchasing.academy.

10.14 Complaints

If you have a complaint about how PAA processes your personal data, please contact PAA first so that we can investigate your concern.

You also have the right to submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or, where applicable, another competent data protection authority.

10.15. Changes to this Privacy Statement

PAA may update this Privacy Statement when its Services, technology, or legal obligations change.

The most recent version will be made available through the PAA website.

10.16. Contact

Purchasing Academy Amsterdam B.V.
Amsterdam, the Netherlands
Email: support@purchasing.academy

For questions about this Privacy Statement, your personal data, or your privacy rights, please contact us using the email address above.