Privacy policy

Reading CertWorthIt needs no account, sets no cookies and runs no analytics or advertising trackers. Personal data comes in only when you ask for a report or the newsletter by email. This page explains what we keep, why, for how long and who processes it.

Who is responsible

The controller is Lumavera OÜ, registry code 17438605, Lõõtsa tn 5, 11415 Tallinn, Estonia. Contact: contact@certworthit.com.

Reading the site

When your browser loads a page, it sends your IP address, the page address, your browser's user-agent string and the time. Cloudflare, Inc., which hosts and protects the site, processes these to deliver the pages and to block attacks and abusive bots. Its security log keeps the IP address of requests it blocks. We keep no visit log of our own. Legal basis: our legitimate interest in running a safe site (GDPR Art. 6(1)(f)).

The "Get my report" button builds your report in your browser. Your browser downloads the published figures for the country you chose, and your experience and goal answers stay on your device unless you also ask for the report by email.

What we store when you ask for a report by email

  • your email address and the site language;
  • what the report is about: the certificate or job, the country, your experience and goal answers, and the page you sent the form from;
  • whether you ticked the separate newsletter box;
  • a consent record: the exact sentence you saw, its version and the time of your request and confirmation;
  • for 30 days, a keyed one-way hash of your IP address, used only to stop automated or repeated sign-ups.

Before the form is sent, Cloudflare Turnstile checks that a person, not a bot, is using it. Turnstile receives your IP address and browser signals for that check and sets no tracking cookie.

Why we use it, and on what basis

  • The report and its monthly update. One request covers one email with your report and, after you confirm by clicking the link in it, a short monthly update for the same certificate or job and country. Legal basis: your consent (GDPR Art. 6(1)(a)).
  • The newsletter, only if you ask for it. A separate monthly email about all the certifications and countries we track. You get it only if you tick its box and confirm. Your report never depends on it. Legal basis: your separate consent (Art. 6(1)(a)).
  • Confirmation first. We send no recurring email until you confirm with the link in the first email.
  • The consent record. We keep it to show what you agreed to and when (Art. 7(1)).
  • Stopping abuse. The IP hash and the Turnstile check protect the forms. Legal basis: our legitimate interest (Art. 6(1)(f)).

The report texts are written in advance with AI from our published figures. Your email address and answers are never sent to an AI service, and we make no automated decisions about you. We do not sell your address, share it with course providers or advertisers, or build a profile of you.

How long we keep it

  • Never confirmed: you get the one report, and your address and choices are deleted 30 days after the request.
  • Monthly update or newsletter: kept until you unsubscribe from that list. That list's data is then deleted within 30 days. When you are on no list any more, your email address is deleted too.
  • IP hash: deleted 30 days after the request.
  • Consent record: kept for 3 years after the consent ends, without your email address, so we can show what was agreed.

Who processes it for us

  • Resend, Inc. sends the emails. It stores your address and the email content in its EU region (Ireland). Resend is a US company. Any transfer outside the EU relies on the Standard Contractual Clauses in its data processing agreement.
  • Cloudflare, Inc. hosts the site and the forms, stores the lists in its database in the EU, and runs Turnstile. Transfers outside the EU rely on its data processing agreement, which includes the EU Standard Contractual Clauses.

Both process data only on our instructions.

Your rights

You can, at any time and free of charge:

  • unsubscribe from the monthly update or the newsletter, each on its own, with the one-click link at the bottom of every email, or by writing to contact@certworthit.com;
  • ask for a copy of your data and have it corrected;
  • ask us to delete it;
  • ask us to restrict or object to its use, and receive it in a portable format;
  • withdraw your consent without affecting the report already sent.

We answer within one month. You can also complain to a data protection authority: in Estonia, the Andmekaitse Inspektsioon (Data Protection Inspectorate), or the authority where you live or work.

Security

Every page and form uses HTTPS. Confirmation links are stored only as one-way hashes. Only the operator has access to the lists.

Changes

When this policy changes, we update the date above. If a change affects how we use an address you already gave us, we tell you by email first.