Privacy Policy

Last updated: 11 August 2026

1. Introduction

S2 hub ("we", "us" or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use and protect personal data when you use the Silverstripe CMS Certification Platform (the "Platform").

This Privacy Policy applies to visitors, registered users, purchasers and participants in certification examinations.

2. Data Controller

The controller responsible for processing your personal data is:

S2 hub – Verein zur Förderung der Verbreitung von Open Source Software in Europa
ZVR-Nummer: 1622138850
Technoparkstraße 3
4820 Bad Ischl
Austria
Email: info@s2-hub.com

3. Personal Data We Process

3.1 Information You Provide

Depending on how you use the Platform, we may process the following personal data:

• Contact details: name, email address and other contact details provided during registration or purchase.
• Account data: login details and information required to manage your account.
• Certification data: selected certification, applicable Silverstripe CMS version or module, examination responses, examination result and Certificate data.
• Purchase data: purchase date, purchase reference, voucher code, price, currency and refund status.
• Withdrawal and consent data: information about withdrawal requests and, where applicable, your consent to the immediate commencement of the certification service before expiry of the statutory withdrawal period.
• Communication data: messages, support requests and other correspondence with us.

3.2 Payment Information

Payments are processed by Stripe. We do not store complete credit card numbers or complete payment card security codes on the Platform.

We may receive payment-related information from Stripe, such as payment status, transaction reference, payment method, amount and refund status.

3.3 Automatically Collected Information

When you use the Platform, technical information may be processed automatically, including:

• IP address, subject to the Matomo anonymisation configuration;
• browser type and browser version;
• operating system and device information;
• date and time of access;
• requested pages and actions on the Platform;
• referring page, where available; and
• technical error and security information.

3.4 Server Logs

Technical server and security logs may be processed for the operation, security, troubleshooting and protection of the Platform. The Platform is hosted by Hetzner Online GmbH.

4. Purposes and Legal Bases

We process personal data only for specific and lawful purposes. The applicable legal basis depends on the purpose of the processing.

• Performance of a contract – Article 6(1)(b) GDPR: account administration, payment administration, provision of certification examinations, processing examination responses and issuing Certificates.
• Legal obligation – Article 6(1)(c) GDPR: accounting, tax records, legally required business records and responding to lawful requests from authorities.
• Legitimate interests – Article 6(1)(f) GDPR: Platform security, fraud prevention, protection of examination integrity, technical operation, troubleshooting and improvement of the Platform.
• Consent – Article 6(1)(a) GDPR: where we specifically request consent for a particular processing activity. Consent is not assumed merely because you use the Platform.

5. How We Use Personal Data

We use personal data for the following purposes:

• to create and manage user accounts;
• to process purchases and payments;
• to provide and administer certification examinations;
• to assess examination responses and determine results;
• to issue and verify Certificates;
• to send purchase confirmations, examination results and Certificates;
• to process withdrawal and refund requests;
• to provide customer support and process complaints;
• to protect examination content and prevent misuse or fraud;
• to operate, secure and improve the Platform;
• to analyse Platform usage with Matomo; and
• to comply with legal obligations.

6. Data Retention

6.1 Account and Certification Data

We retain contact details, examination data and Certificate-related information for as long as necessary to provide the certification service, issue and verify Certificates, protect the integrity of examinations, handle complaints and claims, and comply with legal obligations.

Certification records may be retained for the lifetime of the relevant Certificate in order to preserve its integrity and verifiability.

Where continued identification of a person is no longer necessary, we may delete or anonymise direct identifiers, such as name and email address, while retaining an anonymised certification record.

6.2 Payment and Accounting Data

Payment, invoice and accounting data is retained for the period required by applicable tax, accounting and commercial record-keeping laws.

6.3 Server and Security Logs

Server and security logs are retained only for as long as necessary for security, troubleshooting, abuse prevention and technical operation, unless a longer retention period is required by law or necessary to establish, exercise or defend legal claims.

The actual retention period for server and security logs is 30 days.

6.4 Matomo Data

Matomo analytics data is retained for 180 days (raw data).

7. Recipients and Service Providers

7.1 General Principle

We do not sell personal data and do not disclose personal data to third parties for their own advertising or marketing purposes.

Personal data may be disclosed to service providers where this is necessary for payment processing, hosting, security, email delivery or operation of the Platform.

7.2 Stripe

We use Stripe Payments Europe Limited for payment processing. Stripe processes payment and transaction data, including information required for payment processing, fraud prevention, refunds and legal obligations.

Depending on the service and processing activity, Stripe may act as a processor or as an independent controller for certain processing activities. Stripe's own privacy information is available at:

Stripe Privacy Policy

7.3 Hetzner

The Platform is hosted by Hetzner Online GmbH on servers located in Germany. Hetzner processes data on our behalf for hosting, storage, availability and technical operation of the Platform.

An agreement for commissioned processing under Article 28 GDPR is in place with Hetzner.

7.4 Matomo

Matomo is used for website analytics and is operated locally on our servers, provided that this reflects the actual technical configuration of the Platform.

7.5 Legal Disclosure

We may disclose personal data where required to do so by law, court order, regulatory requirement or lawful request from a public authority.

8. International Data Transfers

Hosting is provided by Hetzner on servers located in Germany. Payment processing is provided by Stripe.

Stripe is an international payment service provider. Depending on the specific payment method, service and processing activity, personal data may be processed outside the European Economic Area. Where required, appropriate safeguards under applicable data protection law, such as an adequacy decision, the EU Standard Contractual Clauses or another lawful transfer mechanism, are used.

We do not claim that all Stripe processing takes place exclusively within the European Economic Area.

9. Your Rights

Subject to the applicable legal requirements, you have the following rights under the GDPR:

• Right of access: to request information about your personal data and a copy of that data.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure: to request deletion of your personal data.
• Right to restriction: to request restriction of processing in circumstances provided by law.
• Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format.
• Right to object: to object to processing based on legitimate interests, where the legal requirements are met.
• Right to withdraw consent: where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact us at: info@s2-hub.com.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

In Austria, the competent supervisory authority is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

11. Matomo Analytics

11.1 Cookieless Tracking

The Platform uses Matomo for statistical analysis of Platform usage. Matomo is operated without cookies and IP anonymisation is enabled.

Depending on the technical configuration, the information processed may include a shortened IP address, browser type, operating system, device information, referring page and interactions with the Platform.

Matomo analytics is not used to create advertising profiles or to identify individual users.

11.2 Legal Basis

Matomo analytics is processed on the basis of our legitimate interest in understanding Platform usage, improving functionality and maintaining the security and usability of the Platform, subject to applicable ePrivacy and data protection requirements.

12. Security Measures

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures may include:

• SSL/TLS encryption for data transmission;
• access controls and authentication mechanisms;
• server and network security measures;
• regular security updates and monitoring;
• restricted access to personal data; and
• backup and recovery procedures.

13. Children's Privacy

The Platform is intended for professional users and is not directed at children. We do not knowingly collect personal data from children.

If you believe that a child has provided us with personal data, please contact us at info@s2-hub.com.

14. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on you.

15. Deletion and Anonymisation Requests

You may request the deletion of your personal data by contacting us at info@s2-hub.com.

We will delete personal data where there is no legal obligation or other lawful reason to retain it.

To preserve the integrity and verifiability of issued Certificates, we may anonymise certification records instead of deleting the complete certification record. In that case, direct identifiers such as name and email address will be removed or replaced so that the record can no longer be attributed to an identifiable person by us using reasonably available means.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Platform, our processing activities or applicable legal requirements.

The updated version will be published on the Platform with a new effective date. We recommend reviewing this Privacy Policy periodically.

17. Contact

For questions about this Privacy Policy, data processing or the exercise of your data protection rights, please contact:

S2 hub – Verein zur Förderung der Verbreitung von Open Source Software in Europa
Technoparkstraße 3
4820 Bad Ischl
Austria
Email: info@s2-hub.com

S2 hub takes data protection seriously and aims to address requests and concerns within the applicable legal time limits.