Personal Data Processing Policy
- We only process the data we need for you to learn: your email, your handle, your progress and your points, plus technical data (IP address, browser) for security and the anti-cheating system. We do not ask for sensitive data and we do not accept anyone under 18.
- We do not sell your data, we do not use third-party advertising or analytics, and we only use our own cookies: the essential technical ones and one that remembers which link from our campaigns you arrived through. We measure use of the Platform with our own tools to improve it.
- To operate, we use providers outside Colombia (servers in Germany and the European Union, files and DNS in the U.S., email in the U.S. and Brazil, and Google if you sign in with it), under contracts that require them to protect your data.
- Your handle, avatar, level and points are visible to other users on the leaderboard and your profile.
- If you earn a certificate, anyone with its link or code can verify it and see the name you chose for your certificates.
- You can know, update, correct and delete your data, and revoke your authorization, by writing to soporte@school4lulz.online. We respond to inquiries within 10 business days and to claims within 15 business days.
_This is an English translation provided for convenience. If there is any difference between this translation and the Spanish version, the Spanish version prevails._
1. Legal framework and scope
1.1. This Policy is issued in compliance with Ley Estatutaria 1581 de 2012 (Colombian Statutory Law 1581 of 2012), Decreto 1377 de 2013 (Decree 1377 of 2013, compiled in Chapter 25 of Title 2 of Part 2 of Book 2 of Decreto Único Reglamentario 1074 de 2015, the Single Regulatory Decree 1074 of 2015) and any other rules that amend or supplement them.
1.2. It applies to all personal data we process through the website school4lulz.online (the "Platform"), of users (students), of the internal team (staff) and of anyone who contacts us, regardless of the country from which you use the Platform. If you live outside Colombia, please also read section 17.
1.3. Ley 1266 de 2008 (Law 1266 of 2008). We do not process financial, credit or commercial information intended to assess credit risk, so that law does not apply to the Platform.
2. Data controller
| Item | Value |
|---|---|
| Name or company name | ASCENDEV S.A.S. |
| NIT (Colombian tax ID) | 902.063.194-2 |
| Address | Carrera 12 # 24-40, Apto 204, Torre 2B, Yumbo, Valle del Cauca, Colombia |
| Email to exercise your rights | soporte@school4lulz.online |
| Phone | +57 316 355 7856 |
| Website | school4lulz.online |
3. Basic definitions
So that you can understand this Policy without being a lawyer:
- Personal data: any information that identifies you or could identify you (your email, your IP address, your handle).
- Data subject: you, the person the data belongs to.
- Processing: anything we do with your data: collecting, storing, using, sending or deleting it.
- Controller: whoever decides why and how the data is processed (us).
- Processor: a provider that processes the data on our behalf and following our instructions (for example, the server where the database is hosted).
- Transmission: sending data to a processor, inside or outside Colombia, so that it processes the data on our behalf.
- Transfer: sending data to another controller, which will use it for its own purposes. We do not transfer your data.
- Authorization: your prior, express and informed consent for us to process your data.
- Sensitive data: data that affects your privacy or could lead to discrimination (health, racial origin, sexual orientation, religious or political beliefs, biometric data, etc.).
4. Principles we apply
We process your data in accordance with the principles of article 4 of Law 1581 of 2012: legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality. In practice, this means we only collect what is necessary, use it for what we tell you, protect it and do not share it with anyone who should not have it.
5. What data we process, how we obtain it and why
5.1. Data you give us
| Data | How we obtain it | Why |
|---|---|---|
| Sign-up form or Google | To identify you, verify your account, let you sign in and send you service emails | |
| Password | Sign-up form | To let you sign in. We never store it in plain text: only a hash created with the argon2id algorithm, which cannot be reversed to recover it |
| Handle (username) | You choose it the first time you sign in | To identify you to others on the leaderboard and your profile |
| Time zone | You confirm it the first time you sign in | To calculate your weekly streak and show you dates in your local time |
| Your main interest (optional) | You choose it the first time you sign in | To recommend content to you |
| Name for your certificates (optional) | You enter it the first time you earn a certificate | To show it on your certificates and on their verification page (see section 6) |
| Weekly goal (optional) | You choose it on the Platform | To show you your progress for the week |
| Theme preference (light or dark) | You choose it in the interface | To display the Platform the way you prefer |
| Messages to support | When you write to us at soporte@school4lulz.online | To handle your request |
5.2. Data we receive from Google (only if you sign in with Google)
If you choose to use "Continue with Google", Google shares with us your verified email, a unique identifier for your Google account and, depending on your settings, your name and your profile photo. We use the email and the identifier to create or link your account, and the photo as your avatar: we keep a copy in our storage so that your browser and other people's browsers do not have to request it from Google. We do not access your Google password, contacts, emails or files. We do not store your Google name.
5.3. Data generated when you use the Platform
| Data | Why |
|---|---|
| Learning progress: enrolled paths, lessons read, current step, completed exercises | To save your progress and show you where to continue |
| Quiz attempts: answers, correct answers, hints used, time per question, date and time | To grade, calculate points, let you review your answers and detect cheating |
| Points, XP, level, rank, first bloods, achievements, streak, active days, weekly league, seasons, solved challenges and position in the rankings | Gamification, leagues and leaderboard |
| Certificates: code, holder's name, module or path, skills, statistics, rank and date of issue | To issue your certificates and allow anyone to check that they are authentic |
| Lab practice: sessions (start, end, reason for closing), minutes used, checked tasks and submitted flags. We do not store what you type in the terminal or what it returns to you | To give you a practice machine, apply the daily usage limit and detect flags shared between accounts |
| Platform notices you saw: when, how many times and whether you closed or opened them | To avoid showing them to you more than intended and to measure whether they are useful |
| Use of the Platform: active time on each screen (only while the tab is visible and you are using it; in lessons, per step), the days you visit and whether you do so from a phone or a computer | To know which content is used, where people get stuck and when they study, so we can improve the lessons and the Platform |
| Your feedback, only if you choose to give it: whether a lesson was helpful to you (👍/👎), the reasons and any comment you write; reports about quiz questions; and your answer to the "Would you recommend us?" survey (a score from 0 to 10 and an optional comment) | To fix errors and improve the content. Only the team sees it; it is never published |
| Notifications within the Platform | To notify you of achievements, level-ups, new content, complimentary access and point adjustments |
| Plan (free or complimentary Premium) and its validity period | To give you access to the content you are entitled to |
| Account status (active, suspended, closed), reason and suspension end date | To enforce the Terms and Conditions |
| Records of acceptance of legal documents (see 5.5) | To prove your authorization and your acceptance |
5.4. Technical and security data
| Data | Why |
|---|---|
| Sign-up IP address | To detect multiple accounts created from the same IP address (anti-cheating) and prevent abuse |
| Sessions: IP address, browser and device (user-agent), creation date and last use | To keep you securely signed in and detect suspicious access |
| Anti-cheating alerts: accounts and attempts involved, rule triggered, pattern data (including the IP address when the rule is IP-based) | To protect the fairness of the ranking; a team member reviews them |
| Technical records (logs): date, route, result, IP address, request identifier (request id) and user identifier | Security, usage limits (rate limiting), error diagnosis and support. Emails appear masked (e.g. j***@dominio.com) and passwords, tokens and answers are never logged |
| Origin of your sign-up: if you arrived through a link from one of our campaigns, its tags (source, medium, campaign, content and term), the page through which you entered and the date | To know which campaigns bring us users. We do not use third-party pixels, tags or trackers: we only read the tags in the link you opened |
| Internal usage events (for example, "lesson read", "quiz completed"), linked only to your user identifier | To measure and improve the Platform. We do not use third-party analytics tools |
| Technical quality: the errors the Platform showed you (their code, not what you wrote) and how long a page took to load | To find and fix bugs and slow pages |
| Searches in the Platform's search box and how many results they returned, without linking them to your account | To know what content people are looking for and not finding |
| Staff audit: what action each team member took, on which account or content and when | Internal control and transparency; it forms your account history |
5.5. Evidence of your authorization and acceptance
When you accept the Terms and Conditions, this Policy or the Data Processing Authorization, we keep as evidence (art. 9 of Law 1581 of 2012, art. 8 of Decree 1377 of 2013 and Ley 527 de 1999, Law 527 of 1999): date and time (UTC), IP address, user-agent, exact version of the document, digital fingerprint (SHA-256 hash) of the accepted text and acceptance method (sign-up with email, sign-up with Google or later acceptance of a new version). You may ask us for a copy.
5.6. Summary of purposes
We process your data to:
- Create, verify and manage your account, and let you sign in.
- Provide you with the educational service: content, exercises, quizzes, progress and downloadable material.
- Calculate and display points, levels, achievements, streaks, leagues and the public leaderboard within the Platform.
- Issue your certificates and allow anyone with their link or code to check that they are authentic.
- Give you access to the practice lab and apply its usage limit.
- Detect and prevent cheating, fraud, abuse and attacks, and enforce the Terms and Conditions (reversal of points, suspension or closure of accounts).
- Send you service emails: email verification, password recovery, "you already have an account" notices, confirmation and notice of an email change, confirmation of account deletion, suspension and reactivation, and notices of changes to the legal documents. We do not send advertising.
- Send you notifications within the Platform and show you notices about the Platform itself (news, surveys). We do not show third-party advertising.
- Manage complimentary Premium access.
- Handle your inquiries, complaints and support requests.
- Maintain the security of the Platform, diagnose errors and improve the service with internal usage statistics and the feedback you give us, including measuring which campaigns bring us users.
- Keep evidence of your authorizations and acceptances.
- Comply with legal obligations and respond to requests from competent authorities.
If in the future we want to use your data for a different purpose (for example, sending you newsletters or processing payments), we will ask you for a new authorization.
6. Public data within the Platform
Your handle, avatar, level, rank, points, achievements and position (and the PRO badge if you have complimentary Premium) are shown to other users on the leaderboard and on your profile. Your email, IP address and other data are never shown to other users. We recommend that you do not use your real name as your handle if you prefer not to be identified.
Certificates. Each certificate has a public verification page (not indexed by search engines): anyone with its link or code can see the name you set for your certificates, the module or path, the date, the code and whether it is still valid. If you share a certificate (for example, on LinkedIn), that data becomes visible to whoever sees it. You can change the name for certificates issued in the future or ask us to revoke one. Unverified, suspended, closed or moderation-hidden accounts do not appear in the ranking.
7. Sensitive data
We do not ask you for sensitive data and we do not need it to provide the service. If we ever asked you for sensitive data, you would not be required to answer (art. 6 of Law 1581 of 2012 and art. 6 of Decree 1377 of 2013), and we would tell you beforehand what it is and why we are asking for it. Please do not include sensitive data in your written answers, your handle or your messages to support.
8. Minors
The Platform is only for people aged 18 and over. We do not knowingly collect data from minors. If we detect or are informed that an account belongs to a minor, we will close it and delete its data, except for anything we are legally required to keep. If you are a parent or legal guardian and believe a minor has signed up, write to us at soporte@school4lulz.online.
9. Your rights as a data subject
Under article 8 of Law 1581 of 2012, you have the right to:
- Know, update and correct your data, including data that is partial, inaccurate, incomplete or misleading.
- Request proof of the authorization you gave us.
- Be informed, upon request, about how we use your data.
- File complaints with the Superintendencia de Industria y Comercio (SIC, Colombia's data protection authority) for violations of the law, after having completed the inquiry or claim process with us.
- Revoke your authorization and/or request the deletion of your data when the legal principles, rights and guarantees are not respected. Revocation and deletion do not apply when you have a legal or contractual duty to remain in the database.
- Access free of charge the personal data of yours that we process, at least once every calendar month and every time this Policy changes substantially.
These rights may be exercised by: you (proving your identity), your successors in title, your representative or attorney-in-fact, or anyone you have designated in favor of another person.
Do it yourself. In "Your account" you can view and correct your data, download a copy of everything we keep about you (a JSON file) and delete your account immediately. For anything else, or if you prefer, write to us (section 11).
What happens if you delete your data or your account. We will delete or anonymize your data so that it no longer identifies you. Some records may be kept in anonymized form or for as long as necessary for legitimate purposes (for example, proof of your authorization, the audit history and the encrypted fingerprint of the email of accounts closed for breach), as explained in section 13.
10. Department responsible for handling inquiries and claims
The department in charge of handling requests, inquiries and claims is User Support and Data Protection of ASCENDEV S.A.S., at the email soporte@school4lulz.online or at the address Carrera 12 # 24-40, Apto 204, Torre 2B, Yumbo, Valle del Cauca, Colombia.
11. Procedure for exercising your rights
11.1. How to submit your request
Send an email to soporte@school4lulz.online from the email associated with your account (or prove your identity in another way) stating:
- your name or handle and your account email;
- whether it is an inquiry or a claim, and what you are requesting;
- in the case of a claim, the facts giving rise to it and any documents you wish to provide;
- an email or postal address where we can reply to you.
If you are acting on behalf of another person, attach the document proving your authority to represent them. The process is free of charge.
11.2. Inquiries (art. 14 Law 1581 of 2012)
If you want to know what data of yours we hold or how we use it, we will respond within a maximum of ten (10) business days from receipt of your request. If we cannot respond within that period, we will explain why and give you a new date, which will not exceed five (5) business days after the first deadline expires.
11.3. Claims (art. 15 Law 1581 of 2012)
If you believe your data should be corrected, updated or deleted, or that we are breaching the law, you may file a claim:
- If the claim is incomplete, we will ask you to complete it within five (5) business days of its receipt. If two (2) months pass without you sending the information, we will consider that you have withdrawn the claim.
- If we receive a claim that is not ours to resolve, we will forward it to the appropriate party within a maximum of two (2) business days and inform you.
- Once the claim is complete, within a maximum of two (2) business days we will flag your data with the label "claim in progress" and the reason, until it is resolved.
- We will resolve it within a maximum of fifteen (15) business days from the day after its receipt. If we cannot do so within that period, we will explain why and give you a new date, which will not exceed eight (8) business days after the first deadline expires.
11.4. Complaint to the SIC
Only after completing the inquiry or claim process with us may you file a complaint with the Superintendencia de Industria y Comercio (art. 16 Law 1581 of 2012), www.sic.gov.co.
12. Processors and international data transmissions
12.1. To operate the Platform we use the following providers, who act as data processors: they process your data only on our behalf, according to our instructions and subject to contractual confidentiality and security obligations. This involves international transmissions of data:
| Provider | Country where the data is processed | What it does | What data |
|---|---|---|---|
| Contabo GmbH | Germany and European Union | Servers hosting the application, the database (PostgreSQL), the cache (Redis) and the practice lab machines | All the data described in section 5 |
| Cloudflare, Inc. | United States (global network) | Storage and delivery (CDN) of the images, videos and PDFs of the content and of profile photos; DNS service; the connection to the lab terminal goes through its network | IP address and technical data of your browser when downloading those files, resolving the domain or connecting to the lab; profile photos |
| Resend (Plus Five Five, Inc.) | United States; incoming email is processed in Brazil (São Paulo) | Sending service emails and receiving the emails you send to support | Your email, the content of the emails and the technical data of the sending |
12.2. Google (sign-in). If you choose to sign in with Google, Google LLC (United States) acts as an independent third party that authenticates you and sends us the data in section 5.2. Google's processing is governed by its own privacy policy. We do not send your activity on the Platform to Google.
12.3. Discord. Discord is an external service that we only link to. We do not share your data with Discord. If you join the community, Discord processes your data according to its own policy.
12.4. Transmissions to processors are covered by article 26 of Law 1581 of 2012 and articles 24 and 25 of Decree 1377 of 2013, through transmission contracts (or data processing agreements) that require the processors to apply this Policy, maintain confidentiality and protect your data with appropriate security measures. In addition, by accepting the Authorization you expressly authorize us to carry out these transmissions.
12.5. We do not sell, rent or assign your data, we do not use it for advertising and we do not share it with third parties for their own purposes. We will only hand it over to an authority when there is a valid legal order or request.
13. How long we keep your data
We keep your data only for as long as necessary for the purposes of this Policy (art. 11 of Decree 1377 of 2013):
| Data | Period |
|---|---|
| Account data, progress, attempts, points and achievements | While the account is active. After it is deleted, they are deleted or anonymized within a maximum of 30 days |
| Sessions (IP address and user-agent) | Until they expire (24 hours, or 30 days with "Remember me") or you sign out; they are then automatically deleted within approximately one day |
| Verification and recovery links | 24 hours and 1 hour respectively; they are deleted the day after they expire or are used |
| Notifications | 90 days |
| Certificates | While the account exists. If you ask us to delete your account, we revoke its certificates and your name is no longer shown on their verification page |
| Lab sessions, tasks and flags | While the account is active |
| Platform notices seen | While the account is active |
| Active time and visit days | While the account is active. If you delete it, they remain only as statistics not linked to anyone |
| Your feedback (ratings, reports and survey) | While the account is active. If you delete it, it is deleted |
| Internal usage events and searches | 13 months |
| Sign-up origin | While the account is active. The cookie that remembers it before you sign up lasts 30 days |
| Sign-up IP address | While the account is active, for the anti-cheating system |
| Anti-cheating alerts and staff audit records | 2 years from their creation, to respond to claims and disputes |
| Technical records (logs) | 90 days |
| Encrypted fingerprint (hash) of the email of accounts closed for breach | For as long as it is needed to prevent a new sign-up |
| Evidence of acceptance of legal documents | While the account exists and, afterwards, for the limitation period of the applicable legal actions |
| Support emails | 1 year from the closing of the request |
14. Information security
We apply reasonable technical, human and administrative measures to protect your data against loss, unauthorized access, misuse or alteration, including:
- encrypted connections (HTTPS) and strict security headers;
- passwords stored only as an argon2id hash; session tokens and links stored only as hashes;
- protected session cookies (HttpOnly, Secure, SameSite);
- limits on sign-in attempts and requests;
- databases with no access from the internet, servers with restricted access and security updates;
- role-based team permissions (each person accesses only what they need) and an audit log of every action;
- regular backups;
- masking of personal data in technical records.
No system is 100% secure. If a security incident affecting your data occurs, we will report it to the Superintendencia de Industria y Comercio and, where applicable, to you, in accordance with the law.
15. Cookies
We use only technical cookies that are strictly necessary for the Platform to work. We do not use advertising, analytics or third-party cookies.
| Cookie | Why | Duration |
|---|---|---|
__Host-session | To keep you securely signed in | 24 hours, or 30 days if you check "Remember me" |
theme | To remember whether you prefer the light or dark theme | 1 year |
attribution | To remember which link from our campaigns you arrived through, so it can be linked to your account if you sign up. It is our own cookie, it only stores the link's tags and it does not follow you on other sites | 30 days (only if you arrived through a campaign link) |
oauth_state, oauth_verifier, oauth_next, oauth_terms | To protect sign-in with Google, return you to the page you were on and remember that you accepted the documents when signing up | 10 minutes (only if you use Google) |
We do not use third-party cookies or technologies to follow you on other sites. Because these cookies are our own and necessary to provide the service, they do not require separate consent. You can block or delete them from your browser, but then you will not be able to sign in.
16. Effective date and changes to this Policy
16.1. This Policy is effective from the date indicated at the beginning. The databases will remain in force while the Platform operates and during the retention periods in section 13.
16.2. If we change this Policy substantially (for example, regarding the identity of the controller, the purposes, the data we collect or the providers), we will notify you before applying the changes, within the Platform and, where appropriate, by email. When the change affects what you authorized, we will ask you for a new authorization the next time you sign in.
16.3. Previous versions will be available if you request them at soporte@school4lulz.online.
17. If you live outside Colombia
17.1. We apply this Policy to all users, wherever they live, and respond to their requests through the procedure in section 11. If the law of your country grants you more rights, we respect them; write to us at soporte@school4lulz.online stating your country.
17.2. Your data is processed in Colombia (where the controller is located) and in the countries of the providers in section 12 (Germany and other European Union countries, the United States and Brazil).
17.3. United States.
- Children under 13. The Platform is not directed at minors (it is only for people aged 18 and over) and we do not knowingly collect data from children under 13. If we learn that we have done so, we will delete it (section 8).
- We do not sell or share your data. We do not sell personal data or share it for cross-context behavioral advertising across sites or apps (what some state laws, such as California's, call *sale* and *sharing*), and we do not provide it to third parties for their own marketing.
- "Do Not Track" and Global Privacy Control signals. Because we do not follow you on other sites or use third-party trackers, the Platform works the same with or without those signals.
- Your rights. You can find out what data of yours we hold, download a copy, correct it or delete it from "Your account", or request this by writing to soporte@school4lulz.online. We will not treat you differently for exercising them.
- Changes. We will notify you of changes to this Policy as explained in section 16; the effective date appears at the beginning.