YOUR INFORMATION

Privacy, in
plain language.

Last updated: October 9, 2026.

Who is responsible

The data controller is Giacomo Superti, operating this reader-resource service under the name Peak Cert US (previously Next Cert US). For privacy requests or support, email nextcertus@gmail.com.

What we collect and why

• Requested book resources: your email address, the book selected, and any name and surname you choose to provide. Email is required for email delivery; name and surname are optional. We save the request in the book’s contact list and send the requested resource link. The legal basis is providing the companion service you request (Article 6(1)(b) GDPR). No review is required to receive the resources.
• Optional marketing: only if you select the separate, unchecked opt-in, we use your contact details to send Peak Cert US book news, study resources and offers. We record the time, source and wording version of that choice. The legal basis is your consent (Article 6(1)(a)). You can withdraw it at any time using the unsubscribe link in a marketing email or by contacting us. This does not affect resource access or the lawfulness of earlier processing.
• Security and delivery: the hosting and email services process network and delivery information, including IP addresses, request times, email addresses and delivery or failure events. Our application stores keyed fingerprints of email and IP addresses, request identifiers and status to prevent abuse and duplicate messages. The legal basis is our legitimate interest in keeping the service secure and reliable (Article 6(1)(f)). These fingerprints are pseudonymous, not anonymous.
• Support: if you email us, we process your address and the information you include to answer and resolve your request. The basis is providing the requested support or our legitimate interest in handling correspondence. Please do not send health information, passwords or payment details.

Brevo is configured to count transactional email opens and clicks without associating those counts with individual contacts. Delivery and failure logs remain necessary to operate the service. We do not sell personal information or make decisions with legal or similarly significant effects through automated profiling. The website does not use advertising or analytics cookies. Read our cookie information.

Who processes the information

Cloudflare hosts and protects the website and runs the request service. The application’s antiabuse database is configured in the EU; network processing uses Cloudflare’s international infrastructure. Brevo stores the contact lists and sends the emails; its primary hosting is in France and Germany. Google Gmail handles correspondence sent to our support address. Access is limited to the operator and service providers needed to run the service, or authorities where disclosure is legally required.

Some processing may take place outside the European Economic Area. Where applicable, providers use an adequacy decision or the European Commission’s standard contractual clauses with relevant safeguards. See Cloudflare’s data processing terms, Brevo’s data processing terms and Google’s transfer information. Contact us to ask about applicable safeguards.

How long information is kept

Book-resource contact records are retained while needed to provide the requested companion service and resolve related support requests. Marketing contact records are retained while your subscription remains active; withdrawal stops marketing. We review whether records are still needed at least annually. You can request deletion at any time, subject to any information necessary for a legal obligation or claim. Minimal suppression and consent records may be retained to respect your choice and demonstrate how it was handled.

Application antiabuse records older than seven days are removed when subsequent form requests run; if the service is inactive, removal takes place on the next request. Brevo is configured to retain transactional delivery logs for one month and not to store previews of new transactional emails. Deletion may take up to 24 hours after the retention period ends. Support correspondence is retained for the time needed to resolve the issue and any related follow-up, then reviewed for deletion. Cloudflare and Google also apply their own service and security retention rules. Backup copies are access-restricted and follow the same purpose limits rather than being used for further marketing.

External study resources

Quizzes open on PanQuiz, audio on Google Drive, videos on YouTube, and book or review links on Amazon. These services are contacted when you choose their links and apply their own privacy terms. This website does not embed their players or tracking scripts. Leaving a review is optional; we do not check whether you leave one.

Your rights

Under the GDPR, where applicable, you can request access, correction, deletion, restriction and portability of your data. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent without affecting prior lawful processing. Email nextcertus@gmail.com; we normally respond within one month and will explain any lawful extension. We may ask for proportionate information to verify your identity.

You can complain to your local supervisory authority, including Italy’s Garante per la protezione dei dati personali. Providing an email is necessary for email delivery, but marketing consent is never mandatory.