GDPR

1. Our approach

Praktum is a U.S. company based in New Haven, Connecticut, serving primarily U.S. vocational schools. We apply GDPR-aligned practices across our services so that individuals in the European Economic Area, United Kingdom, and Switzerland receive the protections they are entitled to.

2. Controller and processor

Praktum is the controller for personal data collected through our website (demo requests, contact forms, newsletter). For data processed inside the platform on behalf of schools, the school is the controller and Praktum is the processor. We offer a Data Processing Addendum (DPA) incorporating the EU Standard Contractual Clauses to customers on request.

3. Legal bases for processing

• Contract: to provide the services our customers subscribe to.
• Legitimate interests: to respond to business inquiries, secure our services, and improve our products.
• Consent: for newsletters and non-essential cookies, which you may withdraw at any time.
• Legal obligation: to meet tax, accounting, and regulatory requirements.

4. Your rights

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing, including direct marketing.
• Data portability in a structured, machine-readable format.
• Lodge a complaint with your local supervisory authority.

We respond to verified requests within one month. If your data is held by a school using Praktum, we will forward your request to that school and assist it in responding.

5. International transfers

Data is primarily stored and processed in the United States. Where personal data is transferred from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses and supplementary safeguards such as encryption.

6. Sub-processors

We use a limited number of vetted sub-processors for hosting, email delivery, and support tooling. Customers can request a current list and will be notified of material changes.

7. Security and breach notification

We maintain technical and organizational measures including encryption, access controls, and logging. In the event of a personal data breach affecting customer data, we notify affected customers without undue delay so they can meet their own notification obligations.

8. Exercising your rights

Email team@praktum.com with the subject "Data Request." We may ask for information to verify your identity before acting on a request.