1. Third-Party Processors
We engage a small number of third-party processors to operate the service: a hosting provider for stationportal.one, an email delivery provider for transactional notifications, a learning management platform for cohort scheduling, and an accounting platform for invoicing. Each processor is bound by a written agreement that obliges them to apply at least the security standards we apply ourselves and to process personal data only on our documented instructions. A current list of processors is available on written request to contact@stationportal.one.
2. Categories of Personal Data Collected
We collect the data you provide directly: full name, email address, optional company name, course of interest, billing information for paid enrolments, and the content of any messages you send us through the contact form. We also collect data generated by your use of the service: log entries (IP address, device, browser), course assignment submissions, mentor review notes, and basic analytics about which pages you visited. We do not collect special category data and we do not knowingly collect data from children under sixteen.
3. Scope of This Notice
This notice describes how FlowMint Academy collects, uses, retains, and discloses personal data when you visit stationportal.one or enrol in a course. It applies to all visitors and learners worldwide. Where a separate written agreement with an enterprise client client governs the processing of learner data inside a private cohort, that agreement prevails over this notice for the data covered by it. References to "we", "us", and "the Academy" mean FlowMint Academy operating under Korean law.
4. Contact and Data Controller Identity
The data controller for personal data processed under this notice is FlowMint Academy, registered in Seoul, Republic of Korea. You can reach the team responsible for data protection at contact@stationportal.one for any question about this notice or to exercise your rights. We aim to respond to data protection enquiries within fifteen business days; complex requests may take longer and we will tell you if that is the case.
5. Your Rights
Subject to applicable law, you have the right to request access to your personal data, to ask us to correct inaccurate data, to request deletion of data we no longer need to retain, to object to or restrict certain processing, and to data portability where the processing is automated. Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You also have the right to lodge a complaint with the Personal Information Protection Commission of Korea or with another competent supervisory authority in your jurisdiction.
6. Retention
We retain personal data only for as long as we need it. Account data and billing records are retained for five years after the end of your last cohort, in line with Korean accounting and tax record-keeping requirements. Mentor review notes and assignment submissions are retained for three years to support alumni support requests. Marketing email subscriptions are retained until you unsubscribe and for a short additional period to honour your unsubscribe request. Web server logs are retained for ninety days.
7. Purposes of Processing
We process personal data to provide the service you have asked us to provide: enrolling you in courses, scheduling clinics, delivering mentor feedback, and issuing invoices. We also use data to communicate operationally about your cohort, to improve our courses by reviewing aggregated assignment patterns, to send marketing email only where you have opted in, and to comply with our legal obligations including tax record-keeping. We do not sell personal data, and we do not use personal data for automated decision-making with significant effects on you.
8. Security Measures
We apply technical and organisational measures appropriate to the sensitivity of the personal data we process. These include encrypted connections, access controls based on role and need-to-know, regular review of processor agreements, and an incident response procedure for suspected breaches. No system is perfectly secure and we do not promise that it is. If a personal data breach occurs that is likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority in line with applicable law.
9. International Data Transfers
Some of our processors are located outside the Republic of Korea, including in the European Economic Area and the United States. Where we transfer personal data internationally, we rely on legally recognised mechanisms such as adequacy decisions issued by the Personal Information Protection Commission, standard contractual clauses, or comparable safeguards. We do not transfer personal data to any jurisdiction without first reviewing whether the legal regime of that jurisdiction provides an adequate level of protection.
10. Changes to This Notice
We may update this notice from time to time, for example to reflect new processors, new product features, or changes in applicable law. The date of last update is shown at the top of this page. Material changes will be communicated to you by email or by a notice on stationportal.one before they take effect. We encourage you to review this page periodically to stay informed about how we protect your personal data.