Privacy and Compliance
Last updated: 4 October 2026
- ABOUT THIS PRIVACY POLICY
This Privacy Policy explains how PACI IKE, operating under the name EUCRIT (“EUCRIT”, “we”, “us” or “our”), collects, uses, stores, shares and otherwise processes personal data in connection with:
our website;
the EUCRIT learning platform;
Free, Start and Master memberships;
online courses and educational content;
assessments and certificates;
webinars, workshops and live events;
community features;
mentoring, expert sessions and priority Q&A;
organisational and team training;
customer support;
online forms, including the EUCRIT online withdrawal function;
marketing communications; and
other EUCRIT services that refer to this Privacy Policy.
This Privacy Policy should be read together with the EUCRIT Terms of Service and our Cookie Policy.
Acceptance or acknowledgement of this Privacy Policy does not, by itself, constitute consent to processing. Where EUCRIT relies on consent as the lawful basis for a particular processing activity, consent will be requested separately where required by applicable law.
- DATA CONTROLLER
The controller responsible for the processing described in this Privacy Policy is:
PACI IKE
Trading name: EUCRIT
G.E.MI. number: 195210803000
VAT number: EL803355261
Greece
Email: [email protected]
Website: www.eucrit.com
For privacy or data-protection questions, or to exercise your rights, you may contact us at:
- AGE REQUIREMENT
EUCRIT Services that require an account, enrolment or registration are intended only for persons aged 18 or over.
You must be at least 18 years old to:
create an EUCRIT account;
enrol in a free or paid course;
join an EUCRIT membership or community;
register for a webinar or workshop;
participate in mentoring, expert sessions or Q&A; or
use another EUCRIT Service that requires registration.
We may ask you to confirm that you are at least 18 years old.
We do not ordinarily require your full date of birth merely for age verification.
EUCRIT does not knowingly permit persons under 18 to create registered-user accounts.
If we become aware that an account has been created by a person under 18, we may take appropriate steps to restrict or close the account and, where appropriate, delete personal data, subject to legal retention requirements.
Persons under 18 may view publicly accessible areas of the EUCRIT website that do not require registration.
- PERSONAL DATA WE MAY COLLECT
The personal data we process depends on how you interact with EUCRIT.
4.1 Account and identification data
This may include:
first and last name;
email address;
username or account identifier;
password or authentication information managed through the relevant platform;
country;
language or timezone settings;
confirmation that you are aged 18 or over; and
other information necessary to create or administer your account.
4.2 Professional information
Where relevant to a Service, you may provide information such as:
job title;
professional role;
organisation or employer;
professional experience;
education or qualifications;
professional interests;
clinical-research experience; and
areas in which you are interested in receiving training.
We do not require such information unless it is reasonably relevant to the Service or activity concerned.
4.3 Purchase and billing information
Where you make a purchase, we may process:
billing name;
billing address;
country;
transaction amount;
product or membership purchased;
transaction date;
invoice or transaction reference;
applicable VAT or tax information;
membership status;
renewal or cancellation information;
refund or withdrawal information; and
payment-status information.
Payment-card information may be collected and processed directly by Thinkific Payments or other payment-service providers.
EUCRIT does not ordinarily receive or store complete payment-card numbers where those details are processed directly by the payment provider.
4.4 Learning and assessment information
We may process information relating to your participation in EUCRIT learning Services, including:
courses in which you enrol;
lesson or module progress;
completion status;
assessment or quiz responses;
assessment attempts and scores;
assignment or exercise submissions where applicable;
course completion dates;
certificates or credentials issued;
certificate status;
webinar or workshop registrations;
attendance information;
questions submitted to instructors or experts; and
learning interactions necessary to provide the Service.
4.5 Community and user-generated content
If you participate in an EUCRIT community or discussion area, we may process:
your account name or profile information;
posts;
comments;
questions;
replies;
reactions; and
other information that you choose to share.
Information posted in community areas may be visible to other authorised community members.
You should not post information that you are not authorised to disclose.
4.6 Mentoring, Q&A and live-session information
Where you participate in mentoring, priority Q&A, workshops, expert sessions or similar Services, we may process:
your name and account information;
booking and attendance information;
questions you submit;
communications associated with the session;
professional information that you voluntarily provide; and
limited notes or administrative records reasonably necessary to deliver or administer the Service.
EUCRIT mentoring and Q&A are educational Services.
You should not disclose patient-identifiable information, unnecessary health information, confidential clinical-trial information, sponsor-confidential information, trade secrets or information belonging to third parties unless EUCRIT has expressly agreed to receive it within an appropriately governed professional engagement.
4.7 Technical and usage data
When you use our website or learning platform, technical information may be generated automatically, including:
IP address;
browser type;
device type;
operating system;
pages or features accessed;
login information;
date and time of access;
referring page;
technical logs;
security events;
error information; and
platform-usage information.
Some of this information may be collected through cookies or similar technologies.
Please see our Cookie Policy for further information.
4.8 Communications and customer-support data
If you contact EUCRIT, we may process:
your name;
email address;
account information;
the content of your correspondence;
support requests;
complaints; and
information reasonably necessary to respond to your request.
4.9 Online withdrawal-function data
If you use the EUCRIT online withdrawal function, we may collect:
your full name;
email address;
the EUCRIT Service or membership concerned;
purchase or contract date, if provided;
order, invoice or transaction reference, if provided;
additional information you choose to provide to identify the contract;
the content of your withdrawal declaration;
date and time of submission; and
technical information necessary to record and securely process the submission.
This information is processed for the purpose of receiving, recording, acknowledging and implementing your statutory withdrawal request and demonstrating compliance with applicable consumer-protection obligations.
- HOW WE COLLECT PERSONAL DATA
We may collect personal data:
directly from you when you register, purchase a Service, complete a form, participate in training or contact us;
through your use of the EUCRIT website or learning platform;
through Thinkific and other service providers used to deliver EUCRIT Services;
through payment providers when they confirm transactions;
through Formspree where a form is implemented using that service;
from an organisation that purchases EUCRIT training on your behalf;
from instructors, mentors or service providers involved in administering a Service; and
from other sources where permitted by law.
Where an Organisational Customer enrols you in EUCRIT training, we may receive basic information such as your name, business email address, organisation and assigned training.
- PURPOSES AND LAWFUL BASES FOR PROCESSING
EUCRIT processes personal data only where there is an appropriate lawful basis under applicable data-protection law.
Depending on the activity, the relevant basis may include performance of a contract, compliance with a legal obligation, legitimate interests or consent.
6.1 Contract performance and steps before entering into a contract
We may process personal data where necessary to:
create and administer your account;
process enrolments;
provide courses and learning content;
manage membership access;
administer assessments;
issue and administer certificates;
provide webinars, mentoring or other purchased Services;
process purchases and membership arrangements;
provide customer support;
administer cancellations; and
otherwise perform our contract with you or take steps at your request before entering into one.
The applicable legal basis is generally Article 6(1)(b) GDPR.
6.2 Compliance with legal obligations
We may process personal data where necessary to comply with legal obligations relating to matters such as:
tax and accounting requirements;
consumer-protection obligations;
statutory withdrawal rights;
regulatory or court requirements;
fraud or unlawful-activity reporting where legally required;
data-subject rights; and
data-protection compliance.
The applicable legal basis is generally Article 6(1)(c) GDPR.
6.3 Legitimate interests
Where appropriate, we may process personal data where necessary for legitimate interests pursued by EUCRIT or another person, provided that those interests are not overridden by your rights and freedoms.
Such interests may include:
operating and improving EUCRIT Services;
maintaining the security and integrity of accounts and systems;
preventing misuse, fraud and unauthorised access;
responding to enquiries and complaints;
maintaining appropriate business records;
protecting EUCRIT's legal rights;
establishing, exercising or defending legal claims;
understanding how Services are used; and
administering relationships with Organisational Customers.
Where we rely on legitimate interests, we consider the nature of the processing and its impact on individuals.
The applicable legal basis is Article 6(1)(f) GDPR.
6.4 Consent
Where required, we may rely on your consent for activities such as:
certain marketing communications;
non-essential cookies or similar technologies;
certain optional surveys;
publication of identifiable testimonials;
use of photographs or recordings where consent is the appropriate basis; or
other optional processing for which consent is specifically requested.
The applicable legal basis is Article 6(1)(a) GDPR.
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
- MARKETING COMMUNICATIONS
EUCRIT may send marketing or promotional communications where permitted by applicable law.
Where consent is required, we will obtain it before sending the relevant communication.
You may unsubscribe from marketing communications at any time by:
using the unsubscribe mechanism included in the communication; or
contacting us at [email protected].
Opting out of marketing does not prevent us from sending Service-related communications that are necessary for your account, purchase, membership or contractual relationship.
We may retain limited suppression information after an opt-out so that we can respect your preference and avoid sending further marketing communications to the same address.
- COOKIES AND ANALYTICS
EUCRIT and its service providers may use cookies and similar technologies for purposes such as:
authentication;
security;
platform functionality;
remembering preferences;
performance;
analytics; and
other functions described in our Cookie Policy.
Where applicable law requires consent for non-essential cookies or similar technologies, those technologies will be used subject to the applicable consent mechanism.
You can find further information in the EUCRIT Cookie Policy.
- PAYMENTS
Payments may be processed through Thinkific Payments or another payment provider identified during checkout.
Payment providers may process personal data independently or on behalf of EUCRIT as necessary to:
authorise transactions;
process payments;
issue refunds;
prevent fraud;
handle disputes or chargebacks; and
comply with financial or legal requirements.
EUCRIT ordinarily receives transaction and payment-status information rather than complete payment-card credentials.
The relevant payment provider's own privacy information may also apply to its processing activities.
- ONLINE WITHDRAWAL FUNCTION AND FORMSPREE
EUCRIT may use Formspree to operate online forms, including the EUCRIT statutory withdrawal function.
Where you submit the withdrawal form, the information entered in the form is transmitted through Formspree so that EUCRIT can:
receive your withdrawal declaration;
identify the relevant contract;
record the date and time of the request;
send or arrange the legally required acknowledgement;
process any applicable refund, cancellation or access change;
maintain evidence of compliance with consumer law; and
respond to related enquiries or disputes.
Form submissions may be stored by Formspree as part of the form-processing service.
EUCRIT will configure forms to collect only information reasonably necessary for the relevant purpose.
You should not include unnecessary sensitive or confidential information in online forms.
Where Formspree or another provider processes personal data outside the European Economic Area, EUCRIT will rely on an applicable lawful transfer mechanism as described in Section 13 below.
- THINKIFIC AND OTHER SERVICE PROVIDERS
EUCRIT uses external service providers where reasonably necessary to operate and deliver its Services.
These may include providers of:
learning-management systems;
website hosting;
payment processing;
online forms;
email and communications;
videoconferencing;
webinars;
analytics;
security;
cloud infrastructure;
technical support; and
professional services.
In particular, EUCRIT uses Thinkific for functions that may include:
account creation;
course enrolment;
course delivery;
membership administration;
learning progress;
assessments;
community functionality;
certificates;
checkout; and
payment-related functionality.
Thinkific maintains its own privacy and data-protection documentation and supports GDPR-related data-processing arrangements. Thinkific
Where a provider acts as a processor on behalf of EUCRIT, we require personal data to be processed in accordance with applicable data-protection obligations and the relevant contractual arrangements.
- WHO WE MAY SHARE PERSONAL DATA WITH
We may disclose personal data where reasonably necessary to:
technology and hosting providers;
Thinkific and payment providers;
Formspree and other form-processing providers;
email or communications providers;
webinar or videoconferencing providers;
instructors, mentors or experts where necessary to deliver a Service;
professional advisers such as accountants, auditors or lawyers;
Organisational Customers in the limited circumstances described below;
public authorities, regulators, courts or law-enforcement bodies where required by law; and
a purchaser, successor or adviser in connection with a legitimate corporate restructuring, merger, acquisition or transfer of business, subject to applicable law.
We do not disclose personal data to third parties merely because they request it.
We do not sell personal data for monetary consideration.
Where a third party processes personal data for its own purposes, its own privacy policy may also apply.
- INTERNATIONAL DATA TRANSFERS
Some service providers used by EUCRIT may process or store personal data outside Greece or outside the European Economic Area.
Where personal data is transferred outside the EEA, EUCRIT will use a transfer mechanism permitted by applicable data-protection law.
Depending on the destination and provider, this may include:
a European Commission adequacy decision;
Standard Contractual Clauses approved by the European Commission; or
another lawful safeguard permitted under the GDPR.
Where appropriate, supplementary safeguards may also be applied.
For example, Formspree states that its services are hosted using infrastructure in the United States and that it relies on Standard Contractual Clauses in its role as a data processor. Formspree
You may contact us at [email protected] if you would like further information about safeguards applicable to a particular transfer.
- ORGANISATIONAL CUSTOMERS
Where your employer, CRO, clinical research site, institution or another organisation purchases EUCRIT training for you, EUCRIT may process your personal data in connection with that organisational arrangement.
Depending on the agreed Service, EUCRIT may provide the Organisational Customer with limited information relating to:
your enrolment;
assigned courses;
completion status;
training progress;
assessment completion;
certificates; or
other information reasonably necessary to administer the purchased training.
EUCRIT will not provide an Organisational Customer with information unrelated to the training arrangement merely because the organisation purchased access.
The Organisational Customer may separately act as a controller in relation to personal data that it provides to EUCRIT or receives from EUCRIT.
Where relevant, you should also review your organisation's own privacy information.
- CERTIFICATES AND CREDENTIAL VERIFICATION
Where EUCRIT issues a certificate or credential, we may retain information reasonably necessary to:
create the certificate;
record the learner's completion or assessment;
verify authenticity;
respond to verification requests;
manage withdrawal, cancellation or invalidation of a credential; and
protect the integrity of the certification system.
Where certificate verification is available, only information reasonably necessary to verify the credential will be disclosed.
Possession of a certificate does not itself authorise a third party to obtain unrelated personal data about the learner.
- SPECIAL CATEGORY DATA AND CONFIDENTIAL INFORMATION
EUCRIT's standard educational Services are not designed to collect health data, patient information or other special categories of personal data.
In particular, users should not submit patient-identifiable information or unnecessary health information in:
community posts;
course discussions;
mentoring sessions;
priority Q&A;
webinars;
workshops;
support communications; or
withdrawal and contact forms.
Users must also not disclose confidential study, sponsor, employer or third-party information unless they are authorised to do so.
If EUCRIT receives sensitive information that is not necessary for the relevant Service, we may delete, restrict or otherwise appropriately handle that information.
Where EUCRIT undertakes a separate professional engagement that genuinely requires processing of special-category or confidential information, appropriate contractual, privacy and security arrangements should be established for that engagement separately.
- DATA RETENTION
EUCRIT retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, consumer-protection, contractual and dispute-resolution requirements.
Retention periods may differ according to the category of data.
Factors used to determine the appropriate period include:
the duration of the account or contractual relationship;
the nature of the Service;
the period during which certificate verification is reasonably required;
applicable tax and accounting retention requirements;
consumer-law obligations;
applicable limitation periods;
the existence of complaints or disputes;
security requirements; and
whether continued retention is necessary to establish, exercise or defend legal claims.
Account information may be retained for the duration of the account and for an appropriate period after closure where necessary for legal or administrative purposes.
Transaction and billing records are retained for periods required by applicable tax, accounting and commercial law.
Withdrawal records may be retained for an appropriate period in order to evidence compliance with consumer-protection obligations and deal with related claims.
Certificate and credential records may be retained for as long as reasonably necessary to support legitimate verification and integrity purposes.
Marketing information is retained until you withdraw consent, object or unsubscribe, subject to retention of limited suppression information where necessary to respect your preference.
Where personal data is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable law.
- DATA SECURITY
EUCRIT takes appropriate technical and organisational measures designed to protect personal data against:
unauthorised or unlawful processing;
accidental loss;
destruction;
alteration;
unauthorised disclosure; and
unauthorised access.
Measures may include, where appropriate:
access controls;
authentication measures;
secure service providers;
encrypted transmission;
appropriate contractual safeguards;
restricted administrative access;
security monitoring;
backup and recovery measures; and
incident-response procedures.
No internet-based service or method of electronic storage can be guaranteed to be completely secure.
However, this does not limit EUCRIT's obligations to implement appropriate security measures under applicable law.
- PERSONAL DATA BREACHES
EUCRIT maintains procedures for identifying, assessing and responding to personal-data breaches.
Where required by the GDPR, EUCRIT will notify the competent supervisory authority of a personal-data breach without undue delay and, where feasible, within 72 hours after becoming aware of it.
Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, EUCRIT will notify those individuals without undue delay unless an applicable legal exception applies.
- YOUR DATA-PROTECTION RIGHTS
Subject to the conditions and limitations of applicable law, you may have the following rights under the GDPR:
Right of access
You may request confirmation as to whether we process personal data concerning you and obtain access to that data and related information.
Right to rectification
You may request correction of inaccurate personal data and completion of incomplete information.
Right to erasure
You may request deletion of personal data in circumstances provided by law.
The right to erasure is not absolute and may not apply where continued processing is required, for example, to comply with a legal obligation or establish, exercise or defend legal claims.
Right to restriction
You may request restriction of processing in circumstances specified by the GDPR.
Right to data portability
Where the legal requirements are satisfied, you may request personal data that you provided to us in a structured, commonly used and machine-readable format and may have the right to transmit that data to another controller.
Right to object
You may object to processing based on legitimate interests on grounds relating to your particular situation.
You may object at any time to processing of your personal data for direct marketing.
Withdrawal of consent
Where processing is based on consent, you may withdraw consent at any time.
Rights relating to automated decision-making
Where applicable, you have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.
EUCRIT does not intend to make significant decisions concerning learners solely through automated processing unless clearly disclosed and lawfully implemented.
- HOW TO EXERCISE YOUR RIGHTS
To exercise a data-protection right, contact:
Please state clearly which right you wish to exercise and provide sufficient information for us to identify the relevant data.
We may request reasonable information necessary to verify your identity before acting on a request.
We will respond within the period required by applicable law.
Under the GDPR, the ordinary response period is one month, subject to the permitted extension for complex or multiple requests.
The exercise of GDPR rights is ordinarily free of charge, although the GDPR permits limited exceptions for manifestly unfounded or excessive requests.
- RIGHT TO LODGE A COMPLAINT
You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that the processing of your personal data infringes applicable data-protection law.
EUCRIT's supervisory authority in Greece is the:
Hellenic Data Protection Authority
Information on complaints and data-subject rights is available through the Authority's official website.
The Hellenic Data Protection Authority confirms that individuals may complain concerning alleged infringements of data-protection law and rights under Articles 15 to 22 GDPR. dpa.gr
We encourage you to contact EUCRIT first at [email protected] so that we have an opportunity to address your concern, although this does not remove any right you have to contact a supervisory authority.
- THIRD-PARTY LINKS AND SERVICES
EUCRIT websites or learning materials may contain links to third-party websites or services.
EUCRIT is not responsible for the privacy practices of third parties acting independently as controllers.
You should review the privacy information of the relevant third party before providing personal data to it.
- CHANGES TO THIS PRIVACY POLICY
EUCRIT may update this Privacy Policy where reasonably necessary to reflect:
changes in law;
changes in EUCRIT Services;
new processing activities;
changes in service providers;
security or technical developments; or
changes in business operations.
The updated version will display a revised “Last updated” date.
Where a change materially affects how we process personal data, we will provide additional notice where required by applicable law.
Where processing requires consent, we will not treat continued use of EUCRIT Services as a substitute for obtaining consent where applicable law requires a new or specific consent.
- CONTACT
For questions concerning this Privacy Policy, the processing of your personal data or the exercise of your rights, please contact:
PACI IKE – EUCRIT
Greece
G.E.MI.:
195210803000
VAT number:
EL803355261
Email:
[email protected]
Website:
www.eucrit.com