Last updated: April 2026
1. Introduction
1.1 Purpose of this Privacy Notice
This Privacy Notice aims to provide Users with a clear, transparent, and comprehensive explanation of how Happydemy LTD collects, uses, stores, protects, and shares personal data in the course of delivering its digital services. The notice is drafted in compliance with Regulation (EU) 2016/679 (GDPR), applicable Irish national legislation, and the ePrivacy Directive.
1.2 Scope of Application
This notice applies to all personal data processing activities carried out by Happydemy LTD when the User:
accesses or browses the Happydemy Platform and its services
uses official Happydemy mobile applications (including the Android application)
interacts with the digital, social, or educational services of the Happydemy® ecosystem
performs transactions or purchases digital products through the Platform
undergoes identity verification through the Platform
participates in social features (posts, comments, groups, follows)
Contact the Company for support, complaints, onboarding, or official communications
The notice applies to both registered Users and unauthenticated visitors, to the extent that personal data is processed.
1.3 Acceptance and Consent
By using any service offered by Happydemy LTD, the User declares to have read, understood, and fully accepted this Privacy Notice. Where processing is based on consent, such consent will be explicitly requested and may be withdrawn at any time, as provided within this notice.
If the User does not intend to accept this notice, they are advised not to use the Platform's services.
1.4 Data Controller and Applicable Jurisdiction
The data controller is:
Happydemy LTD
71 Baggot Street Lower
Dublin D02 P593, Ireland
Company Number: 763825
All processing activities are carried out under Irish jurisdiction and in compliance with the GDPR, the Irish Data Protection Act 2018, and Directive 2002/58/EC (ePrivacy), as amended and implemented by local authorities. The competent supervisory authority is the Data Protection Commission (DPC) based in Ireland.
Happydemy LTD maintains a Record of Processing Activities pursuant to Article 30 GDPR.
Data Protection Officer (DPO): The Company has assessed, in accordance with Article 37 GDPR and Section 36 of the Irish Data Protection Act 2018, that the appointment of a Data Protection Officer is not currently mandatory given the nature and scale of its processing activities. Notwithstanding, the Company has designated an internal privacy point of contact responsible for overseeing compliance. Should the conditions for mandatory appointment arise (particularly large-scale processing of special categories of data or systematic monitoring), a formal DPO appointment will be made and communicated to Users and to the DPC. Users may address any data protection queries via the channels listed in Section 15.
2. Summary of Key Points
This section provides a clear, immediate overview of the fundamental aspects of personal data protection on Happydemy®. For detailed information, please refer to the following sections of this notice.
2.1 Data Processed
We collect and process only the personal data strictly necessary for:
registering and managing the user account
using the digital services offered, including social features
communication and technical support
processing transactions and purchases
identity verification and compliance
security, monitoring, and fraud prevention
2.2 Purpose of Processing
We use personal data to provide, improve, protect, and personalise Happydemy® services, comply with legal obligations, safeguard the ecosystem's security, and ensure a user experience that meets expectations.
2.3 User Rights
Under GDPR, the User has the right to:
access their data
request rectification or erasure
object to or restrict processing
request portability
Withdraw consent at any time
Lodge a complaint with the supervisory authority
2.4 Data Sharing
We share personal data only with:
authorised contractual partners for service provision (see Section 7.5 for the sub-processor register)
certified third-party providers, only where necessary
competent authorities where required by law
We do not sell or monetise the User's personal data.
2.5 Protection and Security
We implement advanced technical and organisational measures to protect data against unauthorised access, loss, alteration, or improper disclosure. We use encryption, backups, audits, and continuous monitoring systems.
2.6 Retention
Data is retained only for as long as strictly necessary for the stated purposes and, thereafter, deleted or anonymised in accordance with applicable EU and Irish regulations.
2.7 GDPR Rights
Happydemy® fully complies with Regulation (EU) 2016/679. All privacy-related requests are handled within the timeframes set by law, through dedicated channels accessible via the Help Centre.
3. Data We Collect
We collect different categories of personal data to ensure the security, quality, and full functionality of Happydemy® Services. Such data is provided directly by the User, collected automatically, or generated during the use of the Platform.
3.1 Data Provided Directly by the User
During registration, use, or customisation of the Services, the User may voluntarily provide:
First and last name
Username or alias
Email address
Phone number
Date of birth
Country of residence
Preferred language
Profile picture or avatar
Personal descriptions and text content entered in the profile
Password
Communication preferences
3.2 Identity Verification (KYC)
To ensure the security and integrity of the Platform, identity verification is mandatory within 30 days of registration, as set out in the General Terms.
The User uploads an official identity document via the verification form available on the Platform. Data is processed exclusively by our authorised staff, and no copy is retained: documents are deleted immediately after approval or rejection of the verification.
To enhance security and prevent fraud, submitted documents may be analysed by internal automated systems to detect potentially fraudulent, altered, or counterfeit documents. These systems operate entirely within the Happydemy infrastructure and are not connected to any third-party service. Where the automated system flags a submission, it is escalated for manual review by authorised staff.
Such data is processed as described in the IDU – User Digital Identification Policy↗, a separate but integrated contractual document.
3.3 Payment and Transaction Data
Payment and purchase data are processed in a limited manner:
Amount, date, currency, payment method
Product purchased
Transaction code and reference
Transaction confirmation and status
Receipts, invoices, and purchase history
Payout invoices issued by Creators
Full payment card details are processed only by PCI-DSS certified external providers and are never stored by Happydemy®. Accounting data is managed through certified accounting service providers.
3.4 Technical and Usage Data
When you access the Services, we may automatically collect:
IP address
Browser type and version
Operating system and version
Screen resolution and language
Device type, model, and manufacturer
Network information (provider, connection type)
Access timestamp, session duration
URLs visited and pages viewed
Any crashes or technical errors
These data are used for analysis, security, performance monitoring, and service optimisation.
3.5 Location Data
If you authorise location access, we may collect geolocation data via:
IP address (approximate)
GPS or network data (precise)
Real-time or session-based device location
Access can be revoked or managed through your device settings.
3.6 Application and Device Data
If you use our mobile apps (currently available on Android, with additional Platforms planned) or specific features, we may collect:
Operating system version
Granted permissions (microphone, camera, storage, notifications)
Push notification status and user preferences
Push notification tokens
3.7 Data Generated from Interactions
We may collect data related to activities performed within the Services, including:
Comments, reactions, direct messages (if applicable)
Invitations sent to other users
Content viewed, saved, or followed
Frequency of feature usage
This information is used to improve user experience, support the reward system, and prevent abuse.
3.8 Data from Reports, Complaints, and Contacts
If you contact us via ticket or other channels, we collect:
Content of your communication
Any attachments
Identification data (name, email, account ID)
Interaction history
3.9 Social Interaction Data
When using social features on the Platform, we collect:
Posts and published content (text, images, videos)
Comments and reactions on content
Follow/unfollow actions and social connections
Group membership and participation
Profile visibility settings and preferences
Engagement metrics (views, interactions)
Content shared or saved by the User
4. How We Use Personal Data
We process the User's personal data exclusively for specific, explicit, and legitimate purposes, in accordance with the principles set out in Regulation (EU) 2016/679 (GDPR) and applicable Irish legislation.
4.1 Account Management
Data is used to:
create, activate, and configure the User's personal account
enable authenticated access to the Services via Single Sign-On (SSO)
manage credentials, preferences, and personal settings
4.2 Service Delivery
Personal data is processed to:
provide the features offered within the Happydemy® ecosystem, including content, social interactions, publishing tools, groups, profiles, premium access, and thematic sections
enable the use of paid Services, subscriptions, and digital product purchases
perform activities requested by the User, such as invitations, connections, notifications, or content creation
4.3 Service Communications
We use data to send:
technical and operational communications related to the account
updates on contractual changes or relevant features
security notifications or mandatory information
SMS and email notifications via third-party delivery services
These communications cannot be unsubscribed from.
4.4 Personalising the Experience
To improve the quality of the experience, we may use data to:
adapt content, suggestions, and interfaces based on the User's behaviour or preferences
display priority items, badges, rankings, or personalised achievements
support recognition and reward mechanisms provided by the system
This processing is based on the Company's legitimate interest, in accordance with the User's fundamental rights and freedoms.
4.5 Moderation and Abuse Prevention
We process identifying data, published content, access logs, and reports to:
monitor appropriate behaviour on the Platform
take action in case of illegal content, abuse, spam, or violations of the Guidelines
apply progressive sanctions provided for in the General Terms (warning, suspension, ban)
Moderation operations are carried out in compliance with the principles of necessity and proportionality.
4.6 Statistical Purposes and Internal Analysis
We carry out aggregated and anonymous data processing to:
monitor Service usage
optimise the infrastructure and features offered
understand user needs
support corporate strategic decisions
These activities do not involve individual profiling or automated decisions with legal effects.
4.7 Technical Support
Personal data is processed to provide technical support and responses to requests via:
tickets opened through the Help Centre
real-time chat (for subscribed users)
email communications or internal notifications
Technical logs and any attachments are retained only for the time necessary to manage the request.
4.8 Fraud Prevention and Security
We process technical and behavioural information to:
detect and prevent unauthorised access or fraudulent activity
ensure system integrity and data security
protect users, infrastructure, and the digital environment from internal or external threats
The measures adopted include automated checks, access logs, operational restrictions, and alert systems. Automated systems may temporarily block suspicious transactions or activities pending manual review by authorised staff.
5. Legal Bases for Processing
All personal data processing carried out by Happydemy LTD is based on at least one of the lawful conditions set out in Article 6 of Regulation (EU) 2016/679 (GDPR). In particular, User data is processed exclusively in the following cases:
5.1 Consent
Processing is based on the User's explicit consent in cases where:
subscription to newsletters or promotional communications is requested
optional or additional features are activated
services requiring the processing of non-essential data are requested
Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.
5.2 Performance of a Contract
Processing is necessary for the performance of a contract to which the User is a party, or for the implementation of pre-contractual measures taken at the User's request, including:
registration and account management
identity verification (KYC)
use of Happydemy® ecosystem Services, including social features
purchase of digital products and services
activation of subscriptions and premium features
technical support and assistance
5.3 Legal Obligations
Processing is necessary to comply with legal obligations to which Happydemy LTD is subject, including:
retention of data for tax, accounting, and legal purposes
compliance with anti-money laundering, identification, and security regulations
handling of requests from competent authorities
5.4 Legitimate Interest
Processing is based on the Company's legitimate interest, provided that the User's fundamental rights and freedoms do not override it. This includes, for example:
continuous improvement of Services
prevention of abuse, fraud, and misuse of the Platform
maintaining audit trails for internal accountability
legal defence
anonymous or aggregated statistical processing
sending relevant non-promotional communications (e.g., feedback, survey invitations)
6. Cookies and Similar Technologies
Happydemy® uses cookies and similar technologies to ensure the proper functioning of the Platform, improve the User experience, collect statistical data, and provide personalised content.
6.1 Types of Cookies Used
Cookies used within our applications and websites may include:
Technical cookies (necessary): essential for site operation, navigation, and access to main features (e.g., login, user session, security)
Functional cookies: allow remembering preferences, language, settings, or experience customisations
Performance cookies: collect anonymous information on site usage to improve performance
We do not use profiling or targeting cookies, whether internal or third-party.
6.2 Purpose of Use
The main purposes for which we use cookies and similar technologies include:
authentication and maintaining an active session
security and prevention of suspicious activity
traffic measurement and anonymous statistical analysis
personalisation of the user interface
improvement of Services through aggregated behavioural analysis
enabling optional features (e.g., video, chat, push notifications)
We do not perform advertising tracking or use any third-party tracking.
6.3 Managing Preferences
Upon first access, the User can manage preferences via the cookie banner, selecting which cookie categories to accept or refuse. Preferences can be changed at any time:
via the Cookie Management Centre available on the site
through the browser settings (with the ability to block or delete all stored cookies)
by disabling specific features within the mobile application
Disabling technical cookies may impair the proper functioning of the site or apps.
6.4 Link to Cookie Policy
For complete and updated information on the use of cookies, third-party providers involved, and retention periods, please refer to our Cookie Policy↗.
7. Who We Share Your Data With
We share Users' personal data only when strictly necessary and in line with the purposes outlined in this Privacy Notice. Any third party involved is contractually bound to ensure adequate levels of protection, security, and confidentiality.
7.1 Sub-processors and Data Processors
We work with qualified external providers acting as data processors for the provision of technical, infrastructure, and operational services, such as:
database and server management
notification and email delivery tools
payment processing and accounting
customer support
system analysis and monitoring
All sub-processors are carefully selected and bound by specific agreements in compliance with Art. 28 GDPR. A complete list of sub-processors is provided in Section 7.5.
7.2 Technical and Infrastructure Providers
Data may be processed by third-party technology providers that offer reliable and certified infrastructure, including:
cloud and hosting services (located within the European Economic Area)
payment processing Platforms
Where applicable, such providers act as independent data controllers, with their own privacy notices and legal bases.
7.3 Transfers in the Event of Corporate Transactions
In the context of extraordinary transactions such as mergers, acquisitions, business transfers, or financing operations, Users' data may be transferred to authorised third parties, in compliance with applicable legal safeguards.
The User will be informed if their data is to be processed by a new controller.
7.4 Access by Other Users (Social Interactions)
When the User participates in social features (e.g., posting content, leaving comments, sending messages, joining groups, or creating public profiles), certain information may be visible to other Platform users, depending on the chosen visibility settings.
In particular:
public content is accessible to other members of the Happydemy® ecosystem
private messages or direct interactions are visible only to the selected recipients
the User is responsible for information voluntarily shared in public contexts
We recommend exercising caution when posting personal data in spaces visible to other users.
7.5 Sub-Processor Register
In accordance with Article 13(1)(f) and Article 28 GDPR, we provide the following categories of sub-processors engaged by Happydemy LTD:
Payment and Financial Services:
Sub-Processor
Service Provided
Data Categories
Location
Transfer Mechanism
Revolut Ltd
Primary payment processing, Creator payouts
Payment details, transaction amounts, and bank account details
EU (UK/Lithuania)
DPA incorporated in Revolut Business T&C; UK Adequacy Decision
Stripe, Inc.
Fallback payment processing
Payment details, transaction amounts, customer identifiers
USA
DPA built into Stripe Services Agreement (Section 10); Standard Contractual Clauses (SCC)
Sage Group plc
Accounting and invoicing
Invoice data, transaction summaries, and company financial data
UK
Sage GDPR DPA; UK Adequacy Decision
Communication and Notification Services:
Sub-Processor
Service Provided
Data Categories
Location
Transfer Mechanism
Twilio Inc.
SMS and email notifications
Phone numbers, email addresses, message content
USA
Twilio DPA; Standard Contractual Clauses (SCC)
Vonage (Ericsson)
Backup SMS delivery
Phone numbers, message content
USA
Vonage DPA; Standard Contractual Clauses (SCC)
Infrastructure and Hosting:
Sub-Processor
Service Provided
Data Categories
Location
Transfer Mechanism
European cloud hosting provider
Cloud hosting, Managed database services
All service data (encrypted at rest and in transit)
EU
DPA in place; processing within EEA
This register is updated periodically. The User may request the current version or information about any specific sub-processor by contacting us via the channels listed in Section 15.
8. Where We Process and Transfer Data
We process your data primarily in Ireland, where Happydemy LTD's operational and legal headquarters are located. In all cases, we take measures to ensure that personal data is processed securely and in compliance with applicable laws.
8.1 Servers and Infrastructure (EU and/or EEA)
Our main servers and technology infrastructure are located within the European Economic Area (EEA). This ensures that your data is protected by European data protection laws, particularly the GDPR.
Suppliers provide all hosting and storage services with compliance certifications (e.g., ISO 27001, SOC 2) and high-level security measures.
8.2 International Transfers
In some cases, your data may be transferred outside the EEA, specifically when using sub-processors based in third countries for payment processing, SMS/email delivery, or accounting services.
In all such circumstances, we ensure that:
the country offers an adequate level of protection according to the European Commission, or
appropriate safeguards are in place, such as the Standard Contractual Clauses (SCC) approved by the European Commission or other instruments compliant with Art. 46 GDPR.
For details on specific sub-processors and their locations, please refer to Section 7.5.
8.3 Standard Contractual Clauses (SCC)
When we transfer personal data to countries not covered by an adequacy decision, we use updated SCCs to ensure the security and lawfulness of processing. These clauses require the foreign recipient to provide the same level of protection as under the GDPR.
The User may request a copy by contacting us via the Help Centre.
9. How We Protect Your Data
We implement appropriate technical and organisational measures to protect your data from unauthorised access, disclosure, accidental loss, or alteration.
9.1 Technical and Organisational Measures
Our systems are designed according to the principles of privacy by design and by default, aiming to minimise risks and ensure the security of the information processed.
Measures include:
data separation
network segmentation
access controls based on the principle of least privilege
9.2 Encryption
Sensitive data is transmitted using secure encryption protocols (e.g., TLS 1.3) and, where applicable, stored on servers in encrypted form.
Access credentials are protected with secure hashing techniques (e.g., bcrypt or equivalent).
9.3 Communication Security
We continuously monitor communication channels to detect anomalies, intrusions, or unauthorised access attempts. We use firewalls, IDS/IPS systems, and anti-malware controls.
All access to or modification of sensitive data is recorded and logged for security purposes.
9.4 Access and Audits
Access to personal data is restricted to authorised personnel and individuals contractually bound to confidentiality. We have processes in place for:
periodic audits
authorisation reviews
vulnerability assessments
In the unlikely event of a data breach, we will activate the notification procedures required under Articles 33 and 34 of the GDPR.
10. How Long We Retain Data
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal, tax, and security obligations.
10.1 Retention Criteria
Retention periods vary depending on the nature of the data and the purpose of processing:
Data linked to an active account: retained until voluntary closure or automatic deactivation after prolonged inactivity
Payment and billing data: retained for a minimum of 6 years in compliance with Irish tax obligations
Access and security logs: retained for up to 12 months for auditing and fraud prevention purposes
Administrative audit records: retained for up to 10 years for compliance and governance purposes
Data collected based on consent: deleted upon withdrawal of consent, unless legal obligations require otherwise
10.2 Deactivated Accounts, Bans, and Backups
In the case of voluntary account closure, data will be deleted or anonymised within 30 days, unless retention is required by law.
In the event of suspension or permanent ban due to violations of the General Terms, certain personal identifying data (including name, ID, IP address, email, and reason for ban) will be retained indefinitely solely to maintain updated blacklist systems, prevent fraudulent re-entry onto the Platform, and protect the integrity of the ecosystem.
Data retained for blacklist purposes will be subject to periodic review at least every 3 years to assess the continued necessity of retention.
Backups containing personal data are isolated and stored for up to 6 months before being automatically deleted. During this period, access is restricted and protected.
10.3 Anonymisation or Deletion
When data is no longer needed, we will either:
permanently delete it, or
irreversibly anonymise it so it can no longer be linked to an identifiable individual
The method applied depends on the residual purpose of processing (e.g., regulatory obligations or aggregated statistics).
10.4 Identity Verification Data
Identity verification data is retained as follows:
Identity document images: deleted immediately upon completion of the verification decision (approved or rejected) — no copies are retained by Happydemy
Verification outcome (approved/rejected status): retained for the duration of the account
Verification audit trail (timestamp, method used, outcome): retained for 7 years for compliance purposes
11. Your Rights
As a data subject, the User has the right to exercise certain rights over their personal data. Happydemy LTD ensures access to these rights in accordance with Regulation (EU) 2016/679 (GDPR) and the Irish Data Protection Act 2018.
11.1 Right of Access
You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to receive a copy of the data processed, along with information on the purposes, categories of data, and recipients.
11.2 Right to Rectification and Erasure
You have the right to request:
the correction of inaccurate or incomplete data
the erasure of personal data when it is no longer necessary for the purposes for which it was collected, or if you withdraw consent (in cases where consent is the legal basis for processing)
Please note that some data may be retained for legal obligations or security purposes.
11.3 Right to Restriction and Objection
You have the right to request the restriction of the processing of your personal data in the following cases:
if you contest the accuracy of the data
if the processing is unlawful, but you oppose erasure
if we need the data to establish, exercise, or defend legal claims
You also have the right to object to processing based on legitimate interest, unless the Company has compelling legitimate grounds that override your interests, rights, and freedoms.
11.4 Right to Data Portability
The User has the right to receive the personal data they have directly provided to Happydemy LTD in a structured, commonly used, and machine-readable format, only in the following cases:
the processing is based on explicit consent or the performance of a contract
the processing is carried out by automated means
Happydemy LTD will assess each data portability request in good faith, even where there are technical or operational limitations to direct transmission.
11.5 Right to Lodge a Complaint
If you believe that the processing of your personal data violates applicable law, you have the right to lodge a complaint with the competent supervisory authority. In Ireland:
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28, Ireland
https://www.dataprotection.ie
12. Profiling and Automated Decision-Making
12.1 Automated Processes
Happydemy LTD may use automated systems in the following areas:
Content personalisation: Automated systems that suggest content, profiles, or connections based on the User's activity and preferences, in order to improve the user experience
Fraud detection and prevention: Automated monitoring of transaction patterns and identity verification submissions to detect and block potentially fraudulent activity. Blocked transactions and flagged submissions are escalated for manual review by authorised staff
No automated decision produces legally binding effects on the User or significant impacts under Article 22 GDPR without the possibility of human review.
12.2 Human Intervention and Rights
The User has the right to:
request human intervention in automated decision-making processes
express their point of view
contest the automated decision
request an explanation of the logic involved in automated processing
Such requests can be made through the official channels indicated in Section 13.
13. How to Exercise Your Rights
13.1 Available Channels
To exercise your rights regarding personal data, you may submit a request through one of the following official channels:
A dedicated form on our official website in the Contact Us section
Through the channels available within the Happydemy Platform
13.2 Identification
To ensure data security, we may request additional information to verify your identity before processing your request.
13.3 Response Times
We will respond to requests within 30 (thirty) days of receipt. In cases of particular complexity, the response period may be extended by a further 60 (sixty) days, in accordance with Article 12(3) GDPR. In such cases, we will inform the User of the extension and the reasons for the delay within the initial 30-day period.
14. Minors and Child Protection
14.1 Minimum Age for Access
Use of Happydemy®'s services is restricted to adult users (18 years or older). Registration by minors is not permitted.
14.2 Unauthorised Registrations
If the Company becomes aware of the registration of a minor, it will:
immediately delete the data associated with the unauthorised account
deactivate the account
contact, where possible, a parent or legal guardian for information and verification
The deletion of data is carried out under Article 8 of the GDPR due to the minor's lack of valid consent.
We encourage anyone who becomes aware of unauthorised use to promptly report it via the Help Centre.
15. Breach Notifications
15.1 Obligations in Case of Breaches
In the event of a personal data breach that may pose risks to the rights and freedoms of natural persons, Happydemy LTD undertakes to:
notify the event to the Irish Data Protection Commission within 72 hours
document all details, and take corrective measures
15.2 Communication to Users
Where required by law, Happydemy will also inform users directly affected by the breach through transparent, timely, and clear communication.
16. Changes to This Policy
16.1 Update Procedure
Happydemy LTD reserves the right to update this Privacy Policy at any time to:
comply with regulatory changes
reflect changes in the Services offered
introduce organisational or technical improvements
Each update will be published with a new "Last Updated" date displayed at the top of the document.
16.2 Notification of Changes
If the changes are significant or substantially affect the User's rights, Happydemy LTD will notify them through:
visible communications on the Platform
direct messages to registered Users, where appropriate
We encourage periodic review of the Privacy Policy to stay informed about our data practices.
16.3 Effective Date
Changes will take effect from the date of their publication, unless otherwise stated.
17. Official Contacts
17.1 Data Controller
Happydemy LTD
71 Baggot Street Lower
Dublin D02 P593 – Ireland
Company Number: 763825
Registered with the Data Protection Commission (DPC), Ireland.
17.2 Contact Channels
For any communication regarding the protection of personal data:
Dedicated form on our official website in the Contact Us section
Through the channels available within the Happydemy Platform
17.3 Competent Authority
The User has the right to complain to the Irish Data Protection Commission:
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28 – Ireland
Website: https://www.dataprotection.ie