Privacy policy

Last updated: 21 September 2026

This policy explains what personal data Competrain collects, why, who it is shared with, how long it is kept, and your rights under the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller is PQRA, the sole proprietorship of Dimitrios Leonidas Gkikas:

PQRA — sole proprietorship of Dimitrios Leonidas Gkikas (ΓΚΙΚΑΣ ΔΗΜΗΤΡΙΟΣ ΛΕΩΝΙΔΑΣ)

Leoforos Kifisias 44, 151 25 Marousi, Athens, Greece

VAT / ΑΦΜ: 131680720 · Tax office: ΚΕΦΟΔΕ Αττικής

Email: info@competrain.com

We have not appointed a data protection officer. For anything about your personal data, email info@competrain.com.

2. What we collect and why

Data	Why	Legal basis (GDPR Art. 6)
Account details: name, email address, login credentials	To create and run your account and give you access to your courses	Contract (6(1)(b))
Purchase records: what you bought, when, the amount, and the payment reference	To give you access, handle refunds and keep the accounting and tax records the law requires	Contract (6(1)(b)); legal obligation (6(1)(c))
Learning records: progress, assessment answers and scores, certificates	To track your progress, mark assessments and issue certificates	Contract (6(1)(b))
Certificate verification: your name, the course, the date, your score where there is an assessment, and the certificate reference	To let anyone you show your certificate to check it is genuine, on a public verification page reached through the certificate's reference	Contract (6(1)(b))
Documents you upload and the text extracted from them	To read the document, quote you, and build the training you ask for	Contract (6(1)(b))
Messages you send us	To answer you	Contract (6(1)(b)); legitimate interests (6(1)(f))
Technical data: IP address, browser, request times, error logs	To run, secure and fix the website	Legitimate interests (6(1)(f))
Marketing emails, only if you opt in	To tell you about new courses and offers	Consent (6(1)(a)), which you can withdraw at any time

Payment card details are entered on Stripe's checkout page and handled by Stripe. We do not receive or store your full card number.

3. Documents you upload

When you upload a document to build a course, we read it once and keep only the text inside it.

If you do not buy, that text is deleted within 24 hours.
If you buy, the text becomes the controlled document in your own account, and the upload copy is deleted once your training is built.
If your payment goes through but something on our side stops the training from being built, we keep the text for up to 30 days so we can finish the job, and then delete it.

Please do not upload documents containing health data or other special categories of personal data. If an organisation uses Competrain to train its own staff on its own documents, that organisation decides what goes into its workspace, and we process that data on its behalf.

4. Who we share data with

We do not sell personal data. We share it only with the service providers we need to run Competrain, and with authorities when the law requires it:

Provider	What they do	Location
Stripe	Payment processing. For purchases completed through Stripe's Managed Payments service, Stripe acts as merchant of record and processes payment data under its own privacy notice.	EU and United States
Render Services, Inc.	Website hosting and database	United States
Anthropic, PBC	AI processing: reading uploaded documents and generating training from them	United States
Resend	Sending account and service emails	United States
Our accountant, and the Greek tax authorities	Accounting and tax compliance, as the law requires	Greece

5. Transfers outside the EEA

Some of these providers are in the United States. Where personal data is transferred outside the European Economic Area, it is transferred under a safeguard recognised by Chapter V of the GDPR, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, as applicable to each provider. You can ask us for details.

6. How long we keep data

Account and learning records, and certificates: for as long as you have an account. If you ask us to delete your account, we delete them, except records we must keep by law.
Purchase and accounting records: for as long as Greek tax and accounting law requires.
Uploaded documents: as set out in section 3.
Messages: for as long as needed to deal with your request.
Technical logs: for a limited period set by our hosting provider.

7. Cookies

Competrain uses only the cookies and similar storage needed to keep you signed in and make the website work. It does not use advertising cookies or third-party analytics or tracking. Because these cookies are strictly necessary, the website does not ask for your consent to them. If we ever add analytics or other optional cookies, we will ask for your consent first and update this policy.

8. Your rights

You have the right to:

access the personal data we hold about you and get a copy;
have inaccurate data corrected;
have your data deleted;
restrict how we use it;
receive data you gave us in a portable format;
object to processing based on our legitimate interests; and
withdraw your consent at any time, where we rely on it, without affecting what we did before you withdrew.

To use any of these rights, email info@competrain.com. We will reply within one month. You also have the right to complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), www.dpa.gr, or to the data protection authority where you live.

9. Security

We use encrypted connections (HTTPS), access controls and reputable providers to protect your data. No system is completely secure. If a breach affects your data and puts your rights at high risk, we will tell you as the GDPR requires.

10. Children

Competrain is for professionals and is not directed at children. We do not knowingly collect data from anyone under 16.

11. Changes

We may update this policy. The date at the top shows when it last changed. We will tell registered users about material changes by email.