Privacy Policy

1. Data Controller

The data controller for the processing of personal data on this platform is HOSTED Consulting (academy.hosted.hr). When training is provided through an employer (e.g. hotel or hospitality partner), HOSTED Consulting acts as a joint controller or data processor on behalf of the partner organization.

2. Personal Data Processed

We process only the personal data necessary to provide training services, verify knowledge, and issue certificates of completion:

• Basic identification data: full name, email address, role, job title and assigned department.
• Educational progress data: completed lessons, slide viewing positions, quiz attempts, scores, and dates of completion.
• Certification records: issued certificate serial numbers, issue dates, and verification timestamps.
• Technical session logs: login timestamps and technical security cookies strictly required for authentication.

3. Purpose and Legal Basis

Personal data is processed strictly for the following purposes:

• Delivering mandatory compliance, sustainability and hospitality training.
• Verifying professional knowledge through structured quizzes and issuing verifiable certificates.
• Enabling employers and managers to monitor compliance status for statutory audit requirements.

Legal basis: Legitimate interest of the employer and training provider (GDPR Art. 6(1)(f)) and performance of training contract / statutory compliance obligations (Art. 6(1)(b)/(c)).

4. Retention Period

Personal data related to user accounts is stored for the duration of the learner's active employment or engagement with the partner organization. Certificate records and proof of statutory training completion are retained permanently or for the statutory retention period required by labor and hospitality safety regulations to ensure certificate verifiability.

5. Data Subject Rights

Under the General Data Protection Regulation, you have the right to request access to your personal data, rectification of inaccurate data, erasure (where applicable), restriction of processing, and the right to lodge a complaint with the relevant supervisory authority (in Croatia: AZOP – Agencija za zaštitu osobnih podataka).

6. Contact

For all inquiries regarding personal data processing or exercising your rights, please contact: