Last updated: 30/9/2026
1. About this Privacy Policy
1.1 This Privacy Policy explains how HUMAN BREEZE L.P. (“we”, “us” or “our”) collects and processes personal data in connection with the ibGenius website and online platform (“Platform”, “ibGenius”), the products and services offered through it and our related communications.
1.2 This Policy applies when you visit or use the Platform, create or use an account, purchase or access our products or services, participate in courses or workshops, contact us, subscribe to communications from us or otherwise interact with ibGenius.
1.3 We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), Greek Law 4624/2019, Law 3471/2006 on electronic communications and other applicable data protection legislation.
1.4 This Policy applies to processing for which we determine the purposes and means and therefore act as data controller. Where, in the context of a school or institutional arrangement, we process personal data solely on behalf and under the instructions of a school or other organisation, our role in relation to that processing may instead be that of a data processor and the relevant organisation remains responsible for informing the individuals concerned.
2. Who is responsible for your personal data?
The controller is:
HUMAN BREEZE L.P.a limited partnership established under Greek lawG.E.MI. No. 184779003000VAT No. 802893840Registered office: 25 Esperou Street, Kifisia, GreeceEmail: [email protected]
3. Categories of individuals whose personal data we process
Depending on the relevant processing activity, we may process personal data relating to:
visitors to the Platform;
users of our products and services, including registered account holders, students, teachers, tutors and participants in courses, workshops, tutoring, career guidance or other educational services;
customers and purchasers, including parents or legal guardians purchasing products or services on behalf of a student or other user;
representatives and authorised users of schools and other educational organisations, including persons responsible for purchasing, administering or managing institutional access; and
persons who communicate with us or request information from us, including prospective users or customers, newsletter subscribers and persons submitting enquiries or support requests.
4. Personal data we may collect
Depending on how you use the Platform and the products or services you use, we may process the following categories of personal data:
4.1 Identity and contact information
This may include:
first name and surname;
email address;
country;
school or organisation;
whether you are a student, teacher, tutor or other type of user;
information concerning your role within a school or organisation; and
other contact details you choose to provide.
4.2 Account information
Where you create or are allocated an account, we may process:
account and user identifiers;
login and authentication information;
account status;
products, courses or resources linked to your account;
access permissions; and
information relating to the administration and security of your account.
4.3 Purchase, billing and transaction information
Where you make a purchase, we may process:
products or services purchased;
order and transaction details;
purchase date and payment status;
billing information and, where required, tax or invoicing details;
refunds, credits or cancellations; and
transaction identifiers received from our payment provider.
Payment card details are submitted directly to our payment service provider and are not stored by us.
4.4 Educational and service-use information
Where you use our educational products or services, we may process information such as:
courses in which you are enrolled;
course access and activity;
lessons or resources accessed;
course progress and completion information;
quiz or exercise responses, results and scores;
downloads and use of digital resources;
workshop registrations and attendance;
audio, video, chat messages or other participation data where a workshop or other online session is recorded or such functions are used;
subjects, educational level or programme information, including whether a student is in IB1 or IB2;
subjects or workshops in which you have expressed an interest; and
information you provide in connection with tutoring, career guidance or other educational support services.
Where access is provided through a school or institutional package, authorised school personnel may be able to view information concerning the participation and progress of users covered by that package, where this forms part of the relevant service.
4.5 Communications with us
If you contact us, we may process:
your name and contact details;
the subject and content of your enquiry;
correspondence with you;
customer-support information; and
any information you choose to include in a contact form, email or other communication.
4.6 Newsletter and marketing information
If you subscribe to the ibGenius community or other communications, we may process:
your name;
email address;
user category, such as student, teacher, school or tutor;
school or organisation;
country;
marketing preferences;
subscription and unsubscribe information; and
records relating to the consent or other lawful basis relied upon for the communication.
4.7 Technical and usage information
When you use the Platform, certain technical information may be collected automatically, including:
IP address;
browser and device information;
operating system;
date and time of access;
pages or areas of the Platform accessed;
log and security information;
technical identifiers; and
information collected through cookies and similar technologies.
Further information is provided in our Cookie Policy.
4.8 Where certain personal data are required in order to create or administer an account, complete a purchase, provide a product or service, issue an invoice or comply with a legal obligation, you must provide the relevant information in order for us to carry out the corresponding activity. If you do not provide the required information, we may be unable to create or administer your account, complete your purchase, provide the requested product or service or otherwise fulfil the relevant request. Information requested for optional purposes, such as subscribing to marketing communications or expressing interest in future workshops, is voluntary.
5. How we obtain personal data
We may obtain personal data:
- directly from you, for example when you create an account, make a purchase, enroll in a course, register for a workshop, complete a form, subscribe to communications or contact us;
- from a parent or legal guardian, where that person purchases or arranges access on behalf of a student;
- from a school or other organisation, where it purchases or administers access for teachers or students and provides us with information necessary to create or manage their access;
- automatically through the Platform, including through technical logs, account activity and cookies or similar technologies; and
- from service providers involved in a transaction or service, such as confirmation or transaction information received from our payment provider.
6. Why we process your personal data and our legal bases
We process personal data only where we have a lawful basis to do so.
6.1 Creating and managing accounts
We process account, identity and contact information in order to create, maintain and administer user accounts, authenticate users and provide access to purchased products and services.
Where you are the person purchasing or contracting directly with us, the processing is necessary for the performance of our contract with you or in order to take steps at your request before entering into a contract.
Where access has been purchased for you by a parent, school or other organisation, we process the personal data necessary to create, provide and administer your access. Where the processing is necessary for the performance of a contract between you and us, we rely on the performance of that contract. In other cases where we act as controller, we may rely on our legitimate interests in providing and administering the purchased service. Where we act solely on behalf of the purchasing organisation, we process the relevant personal data as its processor.
6.2 Processing purchases and providing products and services
We process personal data in order to:
process and administer orders;
provide courses, workshops, digital resources and other services;
manage access rights and licences;
communicate information necessary for the provision of a service;
administer cancellations, refunds and credits; and
provide customer support relating to a purchase.
The legal basis is the performance of a contract or taking steps before entering into a contract.
6.3 Learning activity and course progress
We process information concerning course enrolment, activity, progress, quizzes and use of educational resources in order to provide and administer the educational service, maintain the functionality of user accounts and, where relevant, enable authorised schools to monitor the progress of users covered by an institutional package.
The processing is based on the performance of our contract with the relevant user where that user contracts directly with us, our legitimate interests in providing and administering institutional access where another person or organisation has purchased the service, or the relevant school arrangement where we act as processor.
6.4 Payments, accounting and legal obligations
We process order, billing and transaction information in order to receive and record payments, issue invoices or other required documents, maintain accounting records and comply with tax, accounting and other legal obligations.
The processing is based on the performance of our contract and compliance with our legal obligations.
6.5 Workshops, tutoring and other educational services
We process registration details, attendance information, subject interests and other information necessary to organise and provide workshops, tutoring, career guidance or similar services.
Where you book or purchase the service, processing is based on the performance of the relevant contract or steps taken at your request before entering into it.
Where you merely register your interest in being informed about a future workshop or similar service, we process the relevant contact and preference information on the basis of your consent.
Where a workshop or other online session is recorded, or where audio, video, chat or similar participation features are used, we may process the relevant participation data for the purposes communicated to participants in advance. The applicable legal basis will depend on the nature and purpose of the relevant processing and may include the performance of the relevant service, our legitimate interests or consent, where required.
6.6 Responding to enquiries and providing support
We process information contained in enquiries, support requests and other communications in order to respond to you, resolve issues and manage our relationship with users and customers.
Depending on the nature of the communication, the processing is based on steps connected with entering into or performing a contract or our legitimate interest in responding to enquiries and providing effective customer support.
6.7 Platform analysis and improvement
We may process technical, usage, service-related and feedback information in order to understand how the Platform and our products and services are used, identify technical or usability issues, assess their performance and effectiveness and improve their functionality, content and user experience.
Where this processing does not depend on technologies requiring your consent, we rely on our legitimate interests in evaluating, developing and improving the Platform and our products and services. Where personal data are collected for these purposes through analytics cookies or similar technologies requiring consent, the relevant processing is carried out on the basis of your consent.
6.8 Newsletters and direct marketing
Where you subscribe to the ibGenius community, newsletter or similar communications, we may use the information you provide to send educational resources, information about courses and workshops, exam-related material, articles, news and information about ibGenius products and services.
Where required, such communications are sent on the basis of your consent.
Where permitted by applicable electronic communications legislation, we may also use contact details obtained in the context of a previous purchase or transaction to inform existing customers about similar ibGenius products or services. You will be given the opportunity to object to such use when the relevant contact details are collected and in each marketing communication.
You may withdraw your consent or object to direct marketing at any time by using the unsubscribe option included in the relevant communication or by contacting us.
6.9 Platform security and prevention of misuse
We may process account, technical and usage information in order to:
protect the security and integrity of the Platform;
prevent or investigate fraud, unauthorised access and misuse;
enforce access and licence restrictions;
identify technical or security incidents; and
protect our rights and those of our users.
We rely on our legitimate interests in operating a secure service, protecting our business and content and preventing fraudulent or unlawful use. Where the relevant processing is necessary to comply with legal requirements concerning the security of personal data or our systems, we process the data on the basis of our legal obligations.
6.10 Establishment, exercise or defence of legal claims
Where necessary, we may retain and use relevant personal data in connection with complaints, disputes, investigations or legal proceedings.
This processing is based on our legitimate interests in establishing, exercising and defending legal claims and, where relevant, compliance with legal obligations.
6.11 Compliance with legal and regulatory requirements
We may process or disclose personal data where necessary to comply with obligations imposed by law, court orders or competent public authorities.
The legal basis is compliance with our legal obligations.
7. Our legitimate interests
7.1 Where we rely on legitimate interests as a legal basis, those interests may include:
operating and administering the Platform;
providing access to products or services purchased for a user by another person or organisation;
supporting users and responding to enquiries;
ensuring the security and proper operation of our systems;
preventing fraud, misuse and infringement of our intellectual property rights;
managing our business and contractual relationships;
maintaining evidence of transactions and communications;
establishing, exercising or defending legal claims; and
where permitted by law, informing existing customers about similar products or services.
7.2 We rely on legitimate interests only where we consider that the relevant processing is necessary and that those interests are not overridden by the rights and interests of the individuals concerned.
8. Schools and institutional users
8.1 Schools and other educational organisations may purchase access for teachers or students. Depending on the arrangement, we may receive personal data concerning those users directly from the school or organisation.
8.2 Such information may include names, email addresses, user roles, course allocations and other information necessary to create accounts, allocate access or administer the relevant service.
8.3 Where the relevant service includes progress monitoring, authorised school personnel may have access to information concerning their students' enrolment, activity, course progress, quiz results or completion status.
8.4 A school or organisation providing personal data to us is responsible for ensuring that it has an appropriate legal basis for doing so and for providing any information to individuals that it is required to provide in its capacity as controller.
8.5 Our respective roles and those of the relevant school or organisation depend on the processing activity concerned. We act as controller where we determine the purposes and essential means of processing, including processing necessary for our own account administration, security, contractual management and legal compliance. Where we process personal data solely on behalf and under the documented instructions of a school or organisation, we will act as processor. This may include, for example, the creation or administration of accounts for users designated by the school, the allocation of courses or access rights to those users, and the recording or reporting of their course activity, progress, quiz results, attendance or completion status for the school’s purposes. In such cases, the relevant processing will be governed by the applicable data processing arrangements.
9. Payments
9.1 Payments made through the Platform are processed through our third-party payment service provider, currently Stripe Technology Europe, Limited.
9.2 Payment card details, including the card number, CVV and expiry date, are submitted directly to the payment provider and are not stored by us.
9.3 We receive only the information necessary to confirm and administer the transaction, such as payment status, payment method information, transaction identifiers and other information provided to us by the payment provider.
9.4 The payment provider may also process personal data for its own purposes in accordance with its own privacy information.
10. Children and young users
10.1 The Platform may be used by persons under the age of 18.
10.2 Personal data of users under the age of 18 are processed on the lawful basis appropriate to the relevant processing activity. Depending on the circumstances, this may include the performance of a contract, our legitimate interests, compliance with a legal obligation or consent. Where processing is based on consent, the age requirements set out below apply.
10.3 Where we rely on consent for the processing of personal data in connection with an online service offered directly to a user under the age of 18, users who have reached the age of 15 may provide that consent themselves. Where the user is under 15, the consent must be provided by their legal representative.
10.4 This is particularly relevant to optional processing based on consent, such as certain marketing communications or other optional features directed to young users.
11. Special categories of personal data
11.1 Our Platform and standard services are not designed to require the collection of special categories of personal data, such as health information, information concerning racial or ethnic origin, religious beliefs, political opinions, biometric data or information concerning a person's sex life or sexual orientation.
11.2 You should not provide such information through free-text forms or ordinary communications unless it is genuinely necessary for the particular matter for which you are contacting us.
11.3 If the processing of special-category data becomes necessary in connection with a particular service or request, we will process them only where an applicable condition under Article 9 GDPR and an appropriate legal basis under Article 6 GDPR apply, and we will provide any additional information required.
12. Cookies and similar technologies
12.1 The Platform uses cookies and similar technologies for purposes such as ensuring technical functionality, maintaining sessions and security and, subject to your choices, analytics or other optional purposes.
12.2 Cookies and similar technologies that require consent will not be used for the relevant purposes unless the required consent has been obtained.
12.3 For detailed information about the technologies used, their purposes, duration, providers and how you can manage your choices, please see our Cookie Policy and cookie settings.
13. Who may receive your personal data?
13.1 We may disclose or make personal data available, where necessary, to the following categories of recipients:
- our authorised personnel and collaborators, including persons involved in administration, customer support and the delivery of educational services;
- teachers, tutors, workshop facilitators and other professionals involved in providing the service you have requested, to the extent necessary for that purpose;
- schools and educational organisations, where access is provided through an institutional arrangement and the relevant personnel are authorised to administer users or monitor progress;
- payment service providers, including Stripe where used for the relevant transaction;
- website hosting, IT infrastructure, learning-management system (LMS), cloud, email, communications and technical support providers;
- video-conferencing and online communication providers used to deliver live workshops or other online services;
- newsletter, email-delivery or customer-communication providers, where such services are used;
- analytics, cookie or similar technology providers, where the relevant technologies have been lawfully activated;
- professional advisers, including accountants, lawyers and other advisers where access is necessary for the provision of their services; and
- courts, public authorities, regulatory bodies or law-enforcement authorities, where disclosure is required by law or is necessary for the establishment, exercise or defence of legal claims.
13.2 Service providers processing personal data on our behalf are required to process them in accordance with our instructions, applicable data protection requirements and appropriate contractual safeguards.
14. International transfers of personal data
14.1 Some of the service providers used in connection with the Platform may operate or process personal data outside the European Economic Area (“EEA”).
14.2 Where personal data are transferred to a country outside the EEA, we ensure that the transfer is made in accordance with the requirements of the GDPR.
14.3 Depending on the recipient and destination, this may include:
transfer to a country or organisation covered by an adequacy decision of the European Commission;
use of Standard Contractual Clauses approved by the European Commission together with any supplementary safeguards required in the circumstances; or
another transfer mechanism permitted under applicable data protection law.
14.4 You may contact us if you would like further information about the safeguards used in relation to a particular transfer.
15. How long we keep personal data
15.1 We retain personal data only for as long as necessary for the purposes for which they were collected and for any additional period justified by legal, contractual or legitimate business requirements.
15.2 In determining the appropriate retention period, we take into account the nature of the information, the purpose of the processing, the duration of our relationship with the user or customer, applicable legal retention requirements and the periods during which legal claims may be established, exercised or defended.
15.3 In particular:
- Account and learning information is generally retained for the period during which the account or relevant access remains active and thereafter only for as long as necessary for account administration, support, record-keeping, dispute resolution or other lawful purposes.
- Order, billing and transaction records that form part of our accounting or tax records are retained for at least five (5) years from the end of the relevant tax year, and for any longer period required under applicable tax or accounting legislation, including where necessary in connection with a tax audit or pending proceedings.
- Course, workshop and service-related information is retained for the period necessary to provide and administer the relevant service and thereafter where reasonably necessary for support, contractual records or legal claims.
- Enquiries and customer-support communications are retained for as long as necessary to deal with the matter and thereafter where retention is reasonably necessary for the management of our relationship or possible claims.
- Newsletter and marketing data are retained while you remain subscribed or until you object to the relevant marketing. We may retain limited information concerning an unsubscribe or objection for the purpose of ensuring that your preference continues to be respected.
- Records of consent and privacy preferences may be retained for as long as reasonably necessary to demonstrate compliance with our legal obligations.
- Technical and security logs are retained only for the period necessary for operation, security, troubleshooting and investigation of incidents, unless longer retention is necessary in connection with a specific incident or legal claim.
15.4 Where personal data are no longer required, they are deleted, anonymised or otherwise removed from active use in accordance with our retention practices.
16. Storage of personal data
16.1 Personal data may be stored, depending on the relevant processing activity, in electronic or physical form, including:
on the systems and devices used by us for the operation and administration of our business;
on the servers and hosting infrastructure supporting the Platform;
in cloud-based systems and services used for storage, collaboration, communications or business administration;
within the learning management and other systems used for the delivery and administration of courses and educational services;
within email, customer communication and support systems;
within systems used by authorised service providers acting on our behalf; and
in backup systems and, where applicable, physical files or records maintained for administrative, contractual, accounting or legal purposes.
16.2 Access to the above storage media and systems is restricted in accordance with the security measures described in this Policy.
17. Security of personal data
17.1 We implement appropriate technical and organisational measures designed to protect personal data, whether held electronically or in physical form, against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access and other forms of unlawful processing. We review and, where appropriate, update the security measures used in connection with the Platform and our processing activities.
17.2 Access to personal data is restricted to authorised personnel and collaborators who require access for the performance of their duties or the provision of the relevant services. Persons authorised to process personal data are required to respect the confidentiality and security of the information to which they have access, and we provide appropriate training and guidance on data protection, confidentiality and information security.
17.3 Depending on the relevant processing activity and system, our security measures and procedures include, among others:
access controls and password-protected access to systems and accounts;
data minimisation and limitation of access according to the relevant role or function;
pseudonymisation or anonymisation of personal data where appropriate;
measures designed to prevent, detect and manage security incidents and personal data breaches;
procedures for handling requests concerning the exercise of data protection rights;
backup and recovery measures for relevant systems and information;
security measures for electronic communications and the transmission of information; and
appropriate measures for the physical protection of documents and IT equipment containing or providing access to personal data.
17.4 The Platform uses TLS (Transport Layer Security) encryption for communications between users' browsers and our web servers. TLS is designed to protect information transmitted through the Platform against unauthorised access or alteration during transmission.
17.5 Users are responsible for keeping their account credentials confidential and must not disclose their password to third parties. We recommend using a strong and unique password and notifying us without undue delay if you become aware of any unauthorised access to or use of your account.
17.6 Payments are processed through our third-party payment service provider, Stripe Technology Europe, Limited. Payment card details are entered directly into the payment provider's secure environment and are not stored by us. The payment provider applies its own technical and organisational security measures and payment authentication mechanisms in accordance with the requirements applicable to its services.
17.7 No method of electronic transmission or storage can be guaranteed to be completely secure. We therefore take measures proportionate to the nature of the personal data processed and the risks associated with the relevant processing activity, while continuously reviewing the security of our systems and procedures.
18. Your data protection rights
18.1 Subject to the conditions provided by the GDPR, you have the following rights in relation to your personal data:
- Right to be informed: to receive clear information about the collection and use of your personal data, including the purposes and legal bases of the processing, the categories of data concerned, the recipients of the data, the applicable retention periods and your rights.
- Right of access: to obtain confirmation as to whether we process personal data concerning you and, where we do, access to those data and the information required by law.
- Right to rectification: to request the correction of inaccurate personal data and the completion of incomplete personal data.
- Right to erasure / right to be forgotten: to request the deletion of your personal data in the circumstances provided by law.
- Right to restriction of processing: to request that the processing of your personal data be restricted in the circumstances provided by law.
- Right to data portability: where processing is based on consent or contract and is carried out by automated means, to receive personal data you have provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to have those data transmitted directly to another controller.
- Right to object: to object, on grounds relating to your particular situation, to processing based on our legitimate interests.
- Right to object to direct marketing: to object at any time to the processing of your personal data for direct marketing purposes.
- Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
- Right to lodge a complaint: to lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority if you consider that the processing of your personal data infringes applicable data protection legislation.
18.2 These rights are subject to the conditions, limitations and exceptions provided by applicable data protection legislation.
19. Automated decision-making and profiling
19.1 We do not currently use personal data to make decisions based solely on automated processing, including profiling, that produce legal effects concerning users or similarly significantly affect them within the meaning of Article 22 GDPR.
19.2 Automated functions that may form part of an educational service, such as the automatic scoring of certain quizzes or exercises, do not constitute decisions of this kind.
20. Third-party services and websites
20.1 The Platform may contain links to third-party websites or online services and may incorporate third-party features, tools, plug-ins or integrations, including services used for payments, video conferencing, communications or other functionality.
20.2 These third-party services and websites operate independently from us. Where you interact directly with a third-party service, the relevant provider may collect and process personal data in accordance with its own privacy policy and may act as an independent controller for some processing activities.
20.3 The privacy practices of third parties, including the categories of personal data they collect, the purposes for which they process them and the legal bases on which they rely, are governed by their own privacy information. We encourage you to review the relevant privacy policy before using or providing personal data through a third-party service or website.
20.4 We are not responsible for the privacy practices or independent processing activities of third-party websites or services that are not under our control.
21. Changes to this Privacy Policy
21.1 We may update this Privacy Policy from time to time, including to reflect changes to the Platform, our products and services, our processing activities or applicable legal requirements.
21.2 The updated Policy will be published on the Platform with a revised “Last updated” date.
21.3 Where a change materially affects the way in which we process personal data or otherwise requires specific notice or consent, we will take the additional steps required by applicable data protection law before the relevant change takes effect.
22. Contact
For any question concerning this Privacy Policy or the processing of your personal data, or if you wish to exercise a data protection right, you may contact us using the Platform’s contact form or by sending an email to [email protected].