Privacy Policy

Scientia Proxima Knowledge Center

The Privacy Policy was last updated on November 3, 2026.

The purpose of this Privacy Notice is to provide website visitors, registered users, purchasers of online courses, and learners holding monthly or annual membership subscriptions with detailed information, in a clear and transparent manner, about all material circumstances concerning the collection, recording, organisation, storage, transmission and other processing of their personal data, in accordance with Articles 12, 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: the “GDPR”). In conducting its activities, the Controller is committed to protecting the privacy of natural persons and to complying fully with applicable data protection legislation, in particular the GDPR and Act CXII of 2011 on the Right to Informational Self-Determination and on Freedom of Information (hereinafter: “Infotv.”).

1. Identity and contact details of the Controller

Company name: Scientia Proxima Kft.
Registered office: 1116 Budapest, Rátz László utca 82-86., 2nd floor, door 20.
Company registration number: 01-09-458848
Tax number: 33095280-2-43
Email address: compliance@sproxiglobal.com
Telephone number: 06204575268
Represented by: Dr. Virt Márton, CEO
Official website address: www.sproxiglobal.com

Data protection officer: The Controller is not required to designate a data protection officer under Article 37 of the GDPR, as it is neither a public authority nor another body performing public tasks, its core activities do not involve processing operations requiring regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of personal data or data relating to criminal convictions.

2. Categories of personal data processed, purposes and legal bases of processing, and retention periods

2.1. Registration and management of learner accounts in the LifterLMS system

Registration is required to view courses, access interactive lessons and use learning materials on the educational platform operated by the Controller. During registration, the individual concerned must provide their surname and given name, a valid email address, a chosen username and a password for signing in. Passwords are recorded exclusively as a verification value (hash) generated using a one-way cryptographic process; the Controller’s system does not store passwords in plain text, and neither the Controller nor its administrators can access plain-text passwords.

The purposes of processing are to create the learner account, provide secure access to the platform’s functions and purchased content, identify users, manage login sessions and maintain customer communications.

The legal basis for processing is Article 6(1)(b) of the GDPR, namely the performance of a contract to which the data subject is a party, or the taking of steps at the data subject’s request prior to entering into a contract.

Personal data are processed for as long as the user account remains in existence. If the user requests deletion of their account, or if no login activity occurs in the account for two consecutive years, the Controller will erase or irreversibly anonymise the identifying data associated with the account.

2.2. Management of course purchases, subscriptions and membership fees

Users may access the learning materials offered on the website by purchasing individual courses or taking out fixed-term or periodically renewing monthly or annual membership subscriptions.

During the ordering process, the Controller processes the data subject’s billing name, billing address (country, postcode, city or town, street and building number), the type of subscription plan selected, the exact date and time of purchase, the unique transaction identifier assigned by the financial service provider (transaction token), the amount paid and the payment success status.

The Controller expressly states that it does not collect, process or store payment card details (card number, expiry date or CVC/CVV security code) in any form. Payment card transactions are carried out entirely through the secure, encrypted interface of a certified external payment gateway.

The purposes of processing are to conclude the online sales contract, keep records of payments, track payment transactions and activate the service.

The legal basis for processing is Article 6(1)(b) of the GDPR (performance of a contract).

The retention period covers the duration of the subscription relationship and, following termination of the contract, the general five-year limitation period for civil claims under Section 6:22 of Act V of 2013 on the Civil Code (“Ptk.”).

2.3. Invoicing and compliance with financial and accounting obligations

Following payment for courses and memberships, the Controller is legally required to issue an accounting document.

The categories of data processed for this purpose are the customer’s billing name, billing address, tax number or personal tax identification number (where relevant), the description of the service, the amount paid, the tax rate applied, the date of the accounting document and the payment method.

The purposes of processing are to issue accounting documents, comply with reporting obligations to the tax authority and fulfil bookkeeping obligations.

The legal basis for processing is Article 6(1)(c) of the GDPR, namely compliance with a legal obligation to which the Controller is subject, having regard to Section 169(1)–(2) of Act C of 2000 on Accounting and the provisions of Act CXXVII of 2007 on Value Added Tax.

Under the applicable statutory obligation, the Controller must retain the invoice data processed and the accounting documents for at least eight years following the end of the year in which the invoice was issued.

2.4. Monitoring learning progress and managing quizzes and digital certificates

Through its built-in functions, the LifterLMS framework records and tracks the lessons viewed by the learner, video playback status, completion rates for individual course modules, answers to assessment quizzes, test results and successful completion of courses.

Following successful completion of an examination or course, the system automatically issues a digital certificate in the learner’s name and assigns it a unique serial number and verification identifier.

The purposes of processing are to facilitate structured progress through the course, assess the learner’s level of knowledge, issue a certificate evidencing the qualification obtained and enable the authenticity of the certification issued to be verified subsequently by third parties.

The legal basis for processing is the performance of a contract under Article 6(1)(b) of the GDPR.

The Controller stores learning-related metadata and certificate authentication data for as long as the user account remains in existence. If the account is deleted, the Controller separates and irreversibly anonymises the learner’s direct identifiers in order to preserve the integrity and verifiability of the certificates.

The data subject acknowledges that, when a request for erasure under Article 17 of the GDPR is implemented, the direct identifiers of the learner profile are permanently and irreversibly anonymised. Consequently, it is no longer technically possible to restore certificates previously issued to the account in the learner’s name or to download them again. The authenticity of previously issued certificates remains verifiable solely by reference to the cryptographic serial number/hash.

2.5. Customer support enquiries, complaint handling and contact requests

If a website visitor or learner submits a question to the Controller through the contact form on the website or directly by email, the Controller records the data subject’s name, email address, the date and time of the enquiry and the textual information contained in the message.

The purposes of processing are to investigate the enquiry, resolve the professional or technical issue raised and communicate a response to the data subject.

The legal basis for processing is Article 6(1)(b) of the GDPR, namely the taking of steps at the data subject’s request prior to entering into a contract, or clarification of obligations arising from an existing contract.

If no ongoing legal relationship is established between the parties, the Controller erases the correspondence from its systems one year after the substantive resolution of the matter or the last communication.

2.6. Newsletter subscriptions and direct marketing

The website offers the option to subscribe to the Controller’s electronic newsletters, through which subscribers may receive information about new course releases, professional articles, discounts and promotional offers.

The categories of data processed when subscribing are the subscriber’s surname and given name, email address, the exact subscription timestamp, the IP address used when subscribing, and measurement data relating to email opens and link clicks.

The purpose of processing is to send electronic communications containing direct marketing and other marketing content.

The legal basis for processing is the data subject’s express and freely given consent under Article 6(1)(a) of the GDPR and Section 6(1) of Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities.

Processing continues until consent is withdrawn (unsubscription). The data subject may withdraw their consent at any time, without giving reasons, without restriction and free of charge, by clicking the unsubscribe link in the footer of the newsletters sent to them or by sending a statement to the Controller’s official email address.

Following withdrawal, the data subject’s email address is erased from the direct marketing database without delay.

2.7. Server logging, website security and network stability

When the website is visited, the web server’s security software automatically creates technical log files. These logs record the visitor’s network IP address, the exact date and time of the visit, the address of the webpage requested, the referring webpage URL, the browser type and version, the operating system identifier and the server response codes.

The purposes of processing are to maintain the platform’s continuous operation and network stability, protect the integrity of information technology systems, and detect, prevent and investigate malicious intrusion attempts, such as SQL injection, brute-force password attacks and denial-of-service attacks.

The legal basis for processing is legitimate interests under Article 6(1)(f) of the GDPR. The existence and proportionality of those interests are substantiated by the Érdekmérlegelési Teszt_Weboldal (Website Legitimate Interests Assessment) carried out and documented by the Controller.

The server retains security log files for a maximum of 30 days, after which the logs are overwritten and permanently erased through a log rotation process.

3. Use of cookies and external tracking codes

The website uses cookies to improve the user experience and ensure its technical operation. Cookies are small text files placed on the user’s terminal equipment through the browser.

The use of session-supporting cookies that are technically essential for the basic functions of the website and LifterLMS is based on the Controller’s legitimate interests under Article 6(1)(f) of the GDPR.

By contrast, the Controller activates cookies used for statistical and website traffic measurement purposes (Google Analytics), and technologies used for marketing, retargeting and conversion measurement purposes (Meta Pixel, TikTok Pixel and YouTube tracking codes), only if and to the extent that the website visitor has given prior, express, freely given and category-specific consent through the Complianz consent management banner displayed on the website.

The data subject may review or change their cookie settings, or withdraw their consent for a particular purpose with a single click, at any time through the interface permanently available in the website footer.

4. Processors engaged by the Controller

In providing its services and operating its technical infrastructure, the Controller engages external service providers that process personal data on behalf of the Controller and in accordance with its documented instructions, and therefore qualify as processors under Article 28 of the GDPR.

The Controller engages only processors providing sufficient guarantees that their processing complies with the requirements of the GDPR and that they implement technical and organisational measures ensuring the protection of data subjects’ rights.

Web hosting, server infrastructure and database provider:
Hostinger International Ltd. (registered office: 61 Lordou Vironos Street, 6023 Larnaca, Cyprus; location of processing: European Union).

Corporate office systems, email services and cloud storage:
Microsoft Ireland Operations Ltd. (registered office: One Microsoft Place, South County Business Park, Carmanhall and Leopardstown, Dublin 18, D18 P521, Ireland; location of processing: European Union).

Course video streaming and CDN network:
BunnyWay d.o.o. (registered office: Cesta komandanta Staneta 4a, 1215 Medvode, Slovenia; location of processing: European Union).

Accounting, payroll and tax return service provider:
WinTax Consult Kft. (registered office: 1095 Budapest, Ipar utca 2/A.; location of processing: Hungary).

Online payment gateway provider:
Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Analytics and digital advertising measurement partners:
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland); TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland).

5. International transfers to third countries outside the European Economic Area (EEA)

Through the global infrastructure providers it engages, particularly Microsoft and its marketing partners, the Controller may, in certain cases, transfer personal data, primarily technical metadata, online identifiers and communications files, to the United States of America or other third countries.

For transfers to the United States of America, the primary legal basis and safeguard is the adequacy decision on the EU–US Data Privacy Framework adopted by the European Commission on 10 July 2023 under Article 45 of the GDPR, in respect of US organisations included on the official DPF certification list, particularly Microsoft Corporation.

For recipients in third countries that are not covered by a specific adequacy decision, the Controller and its processors ensure, through the use of standard data protection clauses under Article 46(2)(c) of the GDPR and, where necessary, supplementary technical safeguards and encryption measures, that data subjects’ personal data benefit from the level of protection guaranteed within the European Union when processed in the third country.

6. Data subjects’ rights and detailed rules for their exercise

Under Chapter III of the GDPR, individuals have the following rights in relation to the processing of their personal data, which they may exercise by submitting a written request to the Controller.

6.1. Right to transparent information and access (Article 15 of the GDPR)

The data subject has the right to obtain confirmation from the Controller as to whether their personal data are being processed.

Where such processing takes place, the data subject has the right to access the personal data concerning them. Upon request, the Controller also provides detailed information about:

  • the specific purposes of processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries;
  • the envisaged period for which the personal data will be stored, or the criteria used to determine that period;
  • the data subject’s right to request rectification or erasure of personal data concerning them, or restriction of their processing, and to object to the processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the data were not collected directly from the data subject, any available information about their source;
  • the existence of automated decision-making and profiling, the logic involved and the envisaged consequences.

The Controller provides the data subject with one copy of the personal data undergoing processing free of charge. For any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs.

6.2. Right to rectification (Article 16 of the GDPR)

The data subject has the right to obtain from the Controller, upon request and without undue delay, the rectification of inaccurate personal data concerning them or personal data that have changed.

Taking into account the purposes of processing, the data subject also has the right to request that incomplete personal data be completed, including by providing a supplementary statement.

6.3. Right to erasure (Article 17 of the GDPR)

The data subject has the right to obtain from the Controller, upon request and without undue delay, the erasure of personal data concerning them. The Controller must carry out the erasure where one of the following grounds applies:

  • the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • the data subject withdraws the consent on which consent-based processing is based, and there is no other legal basis for processing;
  • the data subject objects to processing based on legitimate interests under Article 21(1) of the GDPR and there are no overriding legitimate grounds for processing, or the data subject objects to processing for direct marketing purposes;
  • the personal data have been unlawfully processed;
  • the personal data must be erased to comply with a legal obligation under Union or Member State law to which the Controller is subject.

The Controller may refuse a request for erasure where processing is necessary for freedom of expression, compliance with a legal obligation, such as the eight-year retention of accounting documents, or the establishment, exercise or defence of legal claims.

6.4. Right to restriction of processing (Article 18 of the GDPR)

The data subject may request restriction of processing (blocking of the data) where:

  • the data subject contests the accuracy of the personal data, in which case processing is restricted for a period enabling the accuracy of the data to be verified;
  • processing is unlawful, but the data subject opposes erasure of the data and requests restriction of their use instead;
  • the Controller no longer needs the personal data for processing purposes, but the data subject requires them for the establishment, exercise or defence of legal claims;
  • the data subject has objected to processing, in which case processing is restricted pending verification of whether the Controller’s legitimate grounds override those of the data subject.

Where processing has been restricted, the stored data may, with the exception of storage, be processed only with the data subject’s consent, for the exercise of legal claims, for the protection of a third party’s rights, or for reasons of important public interest of the Union or a Member State.

6.5. Right to data portability (Article 20 of the GDPR)

The data subject has the right to receive the personal data concerning them that they have provided to the Controller in a structured, commonly used and machine-readable format, such as CSV or JSON.

The data subject also has the right to transmit those data to another controller without hindrance from the Controller, provided that processing is based on consent [Article 6(1)(a)] or a contract [Article 6(1)(b)] and is carried out by automated means.

6.6. Right to object (Article 21 of the GDPR)

The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on legitimate interests [Article 6(1)(f) of the GDPR].

In such a case, the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for processing that override the data subject’s interests, rights and freedoms, or that relate to the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, including newsletters and direct marketing communications, the data subject has the right to object at any time to the processing of their personal data for those purposes. Following such an objection, the personal data may no longer be processed for those purposes.

6.7. Procedure and time limits for handling requests (Article 12 of the GDPR)

The Controller informs the data subject of the action taken in response to a request to exercise their rights without undue delay and, in any event, within one month of receipt of the request.

Where necessary, taking into account the complexity of the request and the number of requests received, that period may be extended by a further two months. The Controller informs the data subject of any extension, together with the reasons for the delay, within one month of receiving the request.

Where the data subject submits a request electronically, the information must, where possible, be provided electronically, unless the data subject requests otherwise.

The procedure is free of charge, except where the request is manifestly unfounded or excessive.

7. Enforcement of rights and available remedies

If the data subject considers that the processing of their personal data infringes the GDPR or national data protection legislation, the following remedies are available.

Contacting the Controller directly

If you have any comments or concerns, we recommend that you first contact the Controller at compliance@sproxiglobal.com to enable the complaint to be resolved promptly and amicably.

Lodging a complaint with the supervisory authority (Article 77 of the GDPR)

The data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement.

The competent supervisory authority in Hungary is:

National Authority for Data Protection and Freedom of Information (NAIH)

Registered office: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, P.O. Box 9.
Telephone number: +36 (1) 391-1400
Official email address: ugyfelszolgalat@naih.hu
Official website: https://www.naih.hu

Right to a judicial remedy (Article 79 of the GDPR)

The data subject has the right to a judicial remedy against the Controller or a processor if they consider that their rights under the GDPR have been infringed as a result of the improper processing of their personal data.

Proceedings may be brought before the court for the place of the Controller’s registered office (Budapest-Capital Regional Court), or, at the data subject’s choice, before the Regional Court for the data subject’s place of residence or place of stay.