Privacy Policy

This is a translation for your convenience. In case of any discrepancy, the Spanish version prevails.

1. Data controller

The controller of the data collected through this website is:

Owner: Ramón Osvaldo Correa (trade name: Empyria / Empyria LMS)
Tax ID (CUIT, Argentina): 20-18544645-0
Address: Felipe Moré 1724, Rosario (CP 2000), Santa Fe, Argentina
Email: info@empyrialms.com
Website: www.empyrialms.com

2. Legal framework

This policy is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD) for users in the European Economic Area, and by Argentine Law 25,326 on Personal Data Protection. Where additional local rules of the user’s country of residence apply, they will be observed.

3. Empyria’s two roles

Two different situations should be distinguished, because Empyria’s role is not the same in each:

a) This commercial website. For the data a visitor voluntarily provides through the contact or demo request forms, Empyria acts as data controller.

b) Our clients’ virtual campuses. For the data of students, teachers and administrators registered in a client’s campus, Empyria acts solely as data processor. The client is the controller of that data and decides its purposes. Empyria does not use a client’s students’ data for its own purposes, does not share it with third parties and does not use it for marketing. The terms of that processing are governed by the service agreement signed between the parties.

4. Data we collect on this site and purpose

We do not request or process special categories of personal data through this site. No automated decisions or profiling take place.

5. Analytics and ads

Site audience measurement uses cookieless aggregate analytics, which stores no identifiers on the user’s device and cannot identify specific people. To measure our campaigns we use the Meta pixel and the Google Ads tag, only if the visitor accepts them on the cookie banner (legal basis: consent), which can be withdrawn at any time from "Cookie settings". Those providers process data under their own policies and may transfer it outside the European Economic Area with the safeguards set out in the GDPR. We do not use Google Analytics. More details in the Cookie Policy.

6. Instagram, Facebook and WhatsApp data (Empyria LMS app)

Empyria LMS is Empyria’s app registered with Meta. A client academy can use it to connect its professional Instagram account (and, when available, its Facebook Page and WhatsApp Business number) to handle the messages and comments it receives from its dashboard. The academy itself makes the connection, by logging in with Meta and accepting the permissions.

Data we receive from Meta: the ID of the connected account and its access token; and, for people who message or comment on that account, their Instagram-scoped ID, username and public name, the text of their messages, comments, mentions and story replies, and the date. We do not receive passwords, contact lists or payment data.

How it is used: only so the academy can see and reply to those conversations from its dashboard, and for the automatic replies the academy itself sets up (for example, sending a link by direct message to someone who commented a keyword on a post). We do not sell or share this data, we do not use it for our own or third-party advertising, and we do not combine it with other academies’ data.

Who is responsible: the academy that connected its account is the controller of the data of the people who message it; Empyria acts as processor on its behalf. The data is stored in that academy’s campus, on its own server; Empyria only receives Meta’s notifications in order to route them to the right campus. The access token is stored encrypted.

How long it is kept: while the account is connected and the academy uses the service. When the account is disconnected, the token is deleted immediately. Conversations are deleted when the academy deletes them, when it cancels the service (after the retention period in section 8) or when a person requests it.

How to request deletion: anyone can remove Empyria LMS’s access from their Instagram or Facebook settings (Settings → Apps and websites → Empyria LMS → Remove); Meta then notifies us and we disconnect the account automatically. You can also request deletion of your data by writing to info@empyrialms.com with your Instagram username and the academy you messaged: we delete it, together with the academy, within 30 days at most and confirm by email.

7. Zoom data (live classes)

A client academy can connect its Zoom account to the Empyria app to create and run its live classes from its campus. The academy makes the connection itself, by signing in to Zoom and accepting the permissions.

What we store: the access authorization issued by Zoom (stored encrypted) and the ID and email of the connected Zoom account. The number and passcode of each class are kept in the academy's campus so its students can join.

What it is used for: only to create, start and end the classes the academy launches from its campus, and to let its students join. We do not access recordings, chats, contacts or other meetings of the account. We do not sell or share this data and do not use it for advertising.

How it is deleted: when the academy clicks “Disconnect Zoom” in its campus, or removes the app from Zoom (App Marketplace → Manage → Added Apps → Remove), we delete the authorization and the account data immediately.

8. Retention period

Contact data is kept for as long as needed to handle the request and, where applicable, for the duration of the business relationship. After that, it is kept blocked for the legal limitation periods applicable to tax and contractual matters, and then deleted. If the enquiry does not lead to a business relationship, the data is deleted twelve months after the last contact.

9. Recipients and international transfers

We do not share personal data with third parties for commercial purposes. Only the providers that render services we need to operate may access it, as data processors and under contract: hosting and infrastructure provider, email provider and, where applicable, a cookieless analytics tool.

Empyria is based in Argentina. European Commission Decision 2003/490/EC recognizes Argentina as a country with an adequate level of personal data protection, so transfers from the European Economic Area require no additional safeguards. Where a provider is located elsewhere, the transfer relies on standard contractual clauses approved by the European Commission.

10. User rights

Anyone may exercise the following rights over their personal data:

• Access: know what data of theirs we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of their data.
• Objection: object to a specific processing.
• Restriction: request that processing be restricted.
• Portability: receive their data in a structured format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise them, just write to info@empyrialms.com stating the right you wish to exercise. We will reply within one month at most. If a user believes their rights have not been properly handled, they may file a complaint with the competent supervisory authority: the Spanish Data Protection Agency (www.aepd.es) in Spain, or the Agency for Access to Public Information in Argentina.

If the request concerns data hosted in the virtual campus of an Empyria client, it must be addressed to that institution, which is the data controller. Empyria will forward the request to the client and help them handle it.

11. Security measures

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss or alteration: HTTPS encryption of communications, password storage using hash functions, protection against cross-site request forgery, access validation on every page and role-based permissions.

12. Minors

This commercial website is aimed at adults with legal capacity to contract. We do not knowingly collect data from minors through this site. When a client’s virtual campus registers underage students, it is up to that client, as data controller, to obtain the consent of parents or guardians under the applicable law.

13. Changes

This policy may be updated to reflect regulatory changes or changes in the services provided. The date of the last update appears at the top of the document. We recommend reviewing it periodically.

14. Contact

For any question about this policy or the processing of personal data, write to us at info@empyrialms.com.