Privacy Policy
IN-STAR LLC · Kyiv, Ukraine · Effective: June 2026
This Privacy Policy describes how IN-STAR LLC ("INSTAR", "we", "us") collects, uses, stores, and protects your personal data when you use our website, courses, consulting services, or contact us. We are committed to protecting your privacy and processing your data lawfully, fairly, and transparently.
1. Data controller
| Controller | IN-STAR LLC |
| Address | 28 Mykhaila Boichuka Str, Kyiv 01103, Ukraine |
| info@in-star.eu | |
| Data protection contact | info@in-star.eu (subject: Data Protection) |
For EU/EEA residents: INSTAR processes your data as a data controller under the General Data Protection Regulation (GDPR). Where INSTAR engages European clients through its partner entity Novennia, Novennia may act as a separate or joint data controller — see the applicable engagement documentation.
2. Data we collect
2.1 Data you provide directly
- Registration data — name, email, phone, organization, job title — when you register for a course, request a consultation, or contact us.
- Payment data — name, billing details — collected and processed by Way4Pay. INSTAR does not store full card numbers.
- Course data — learning progress, assessment results, attendance — collected through our LMS (Moodle).
- Communication data — messages, emails, inquiry content.
- Feedback and testimonials — submitted voluntarily.
2.2 Data collected automatically
- Technical data — IP address, browser, device, operating system — from server logs and analytics.
- Usage data — pages visited, time on site, navigation patterns.
- Cookies — see our Cookie Policy.
3. Legal basis for processing (GDPR)
| Processing activity | Legal basis | Details |
|---|---|---|
| Course registration and delivery | Art. 6(1)(b) — Contract | Necessary to deliver the course or service purchased. |
| Processing payment | Art. 6(1)(b) — Contract | Necessary to complete your purchase. Payment processed by Way4Pay. |
| LMS access and course records | Art. 6(1)(b) + (c) | Course delivery and PMI PDU records. |
| Responding to inquiries | Art. 6(1)(b)/(f) | Necessary to respond to your request. |
| Course-related communications | Art. 6(1)(b) | Updates directly related to your course or engagement. |
| Marketing communications | Art. 6(1)(a) — Consent | Only where you have opted in. You may withdraw consent at any time. |
| Analytics and website improvement | Art. 6(1)(f) — Legitimate interests | You may object via cookie settings. |
| Legal compliance | Art. 6(1)(c) — Legal obligation | Ukrainian law: business records, invoicing, tax documentation. |
4. How we share your data
4.1 Third parties we share data with
- PMI (Project Management Institute) — course completion records and PDU awards under our PMI ATP obligations. Data transferred to the USA under appropriate safeguards. See pmi.org/privacy-policy.
- Credly (Pearson) — digital badge and certificate issuance. Data transferred to the USA. See credly.com/privacy.
- Way4Pay — payment processing. No card data stored by INSTAR. Ukrainian-registered payment processor.
- Moodle / MoodleCloud — LMS provider for course delivery. See moodle.com/privacy.
- Email service providers — for transactional and course-related emails. Contracted processors only.
- Analytics providers — anonymous/pseudonymous usage data. See Cookie Policy.
- Legal authorities — where required by law, court order, or regulatory obligation.
4.2 We do not sell your data
INSTAR does not sell, rent, or trade personal data to third parties for marketing purposes.
5. International data transfers
Some service providers (PMI, Credly, MoodleCloud) are located outside the EU/EEA and Ukraine. Where we transfer personal data of EU/EEA residents to countries not recognized as providing adequate protection under GDPR, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- the provider's participation in a recognized adequacy framework; or
- your explicit consent where the above cannot apply.
Ukraine: INSTAR processes data of Ukrainian residents under Ukrainian Law 'On Personal Data Protection' No. 2297-VI.
6. Data retention
- Course registration and completion records — duration of course + 5 years (PMI PDU audit requirements).
- Payment records — 7 years (Ukrainian tax and accounting law).
- LMS data — 2 years after last course activity, unless longer retention is required.
- Marketing preferences — until you withdraw consent.
- Inquiry and communication data — 3 years from last contact.
- Certificate records — indefinitely (to verify credentials if requested).
- Website analytics — 13 months (industry standard).
7. Your rights
Under GDPR (for EU/EEA residents) and Ukrainian data-protection law, you have the right to:
- access — request a copy of the personal data we hold about you (Art. 15);
- rectification — request correction of inaccurate data (Art. 16);
- erasure — request deletion of your data, subject to legal retention obligations (Art. 17);
- restriction — request that we limit how we process your data (Art. 18);
- data portability — receive your data in a machine-readable format (Art. 20);
- object — to processing based on legitimate interests or direct marketing (Art. 21);
- withdraw consent at any time, without affecting prior processing.
To exercise any of these rights, contact us at info@in-star.eu (subject: Data Rights Request). We respond within 30 days. We may need to verify your identity before processing your request.
Right to lodge a complaint: EU/EEA residents may lodge a complaint with the data protection authority in their EU member state. Ukrainian residents may contact the Commissioner for Human Rights of the Verkhovna Rada of Ukraine (ombudsman.gov.ua).
8. Security
INSTAR implements appropriate technical and organisational measures to protect personal data against unauthorized access, loss, destruction, or disclosure — including secure HTTPS connections, access controls, password protection, and periodic security reviews. No method of internet transmission is 100% secure. We notify affected individuals of material data breaches as required by law.
9. Children
Our services are intended for adults (18+) and business professionals. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us at info@in-star.eu.
10. Cookies
Our website uses cookies. See our Cookie Policy for full details and to manage your preferences.
11. Changes to this policy
We may update this Privacy Policy. The updated version will be posted on this page with a new effective date. For material changes, we will notify you by email or a prominent notice on our website.
12. Contact us
IN-STAR LLC · 28 Mykhaila Boichuka Str, Kyiv 01103, Ukraine · info@in-star.eu (subject: Privacy / Data Protection).
Effective: June 2026