Privacy notice
Last updated 22 October 2026
This notice explains what personal data SCMBase keeps, why, for how long, and your rights. SCMBase is run by Zenland Video Games Ltd ("we"), registered in Ireland, company no. 749295, registered office Hartnett Enterprise Acceleration Centre, Limerick, Ireland. We are the data controller. Write to us at hello@scmbase.com about anything in this notice.
Who this is for
SCMBase is for lecturers and students in further and higher education, and for people learning on their own. It isn't meant for children: please don't sign up if you're under 16.
What we keep, and why
| What | Why | Legal basis |
|---|---|---|
| Your name, email address and password (stored only as a one-way hash, never readable) | To run your account and sign you in | Contract |
| For lecturers: your college or university, whether and when your account was approved, and when you last confirmed (once a year) that you're still there | To check that lecturer tools go only to people who teach | Legitimate interests (keeping the service safe) |
| Your classes, and which class each student is in | So lecturers can run classes and students can join them | Contract |
| Your saved games | So you can carry on where you left off | Contract |
| Your lab records: the steps you complete, your answers, your simulation runs and the goals you meet, with the time of each | To mark your work and show your lecturer your progress | Contract (for a class, your institution's arrangement with your lecturer) |
| Your course progress: the chapters you've read, how much of each video you've watched and where you stopped, and your quiz answers and scores | To show your progress, let you continue where you left off, and (for a certificate) open the exam | Contract (for a class, your institution's arrangement with your lecturer) |
| Sign-in sessions (stored only as a one-way hash of a random token) and the codes we email you (also hashed) | To keep you signed in, and to check sign-ups and password resets | Contract |
| IP addresses, briefly, and the server's logs; for a lecturer sign-up, a scrambled (hashed) form of the network address it came from, kept until it's decided, or for 30 days if it's turned down | To limit repeated attempts and stop abuse | Legitimate interests (security) |
| Anonymous counts from free accounts' labs (with no link to the person) | To see which lab steps people find hard, and improve them | Legitimate interests |
| For an institution's order (the order form): the institution, its billing address and VAT number, the name, role and email of the person ordering, the finance contact's email, the names and emails of the lecturers it's for, and the quotations and invoices we issue; a scrambled (hashed) form of the network address the order came from | To quote, open the class, invoice the institution and keep the accounts the law requires | Contract (with the institution); legal obligation (accounts and VAT) |
| Purchases (when payments open): what you bought and when, and Paddle's customer and subscription numbers so we can match a payment to your account. Paddle, our reseller, holds your payment details; we never see your card | To give you what you paid for, and keep the accounts the law requires | Contract; legal obligation |
| Emails you send us | To answer them | Legitimate interests |
Who can see it
- Your lecturer sees the work of students in their own classes: progress, answers, runs and marks, and can export marks to a spreadsheet. A lecturer can also export a class's lab records with the students' names replaced by S1, S2 and so on, for research.
- Our service providers, who process data for us under contract:
- Namecheap, Inc., our hosting company: SCMBase's server and its database (your account, classes, games and records) are on Namecheap's servers in Phoenix, Arizona, in the United States.
- Brevo (Sendinblue SAS, Paris, France), which sends SCMBase's emails, such as sign-up codes, lecturer account emails and institutions' quotations and invoices: it receives your name, your email address and the email itself, with anything attached.
- Bunny (BUNNYWAY, informacijske storitve d.o.o., Slovenia), which stores and streams the course videos: when you watch one, it receives your device's IP address and the video you're watching, but not your name or email.
- Google (Google Workspace), for our own email: what you write to us at hello@scmbase.com.
- When payments open, Paddle (Paddle.com Market Ltd), which sells our subscriptions, the books and the certificate courses as the merchant of record and is a controller of the payment data in its own right.
- Nobody else. We don't sell personal data, and we don't use it for advertising.
Where a provider handles data outside the European Economic Area, it does so under the European Commission's standard contractual clauses or another lawful safeguard. Namecheap keeps our database in Phoenix, Arizona, in the United States, under its Data Processing Addendum. Bunny's network delivers videos from servers around the world, including outside the EEA, under standard contractual clauses. Google relies on the EU–US Data Privacy Framework and standard contractual clauses. Brevo keeps the data it handles for us in the EU.
How long we keep it
- A sign-up whose emailed code is never typed in: deleted after 24 hours.
- A free account: deleted, with its saves, after 90 days without use.
- A student in a class: their lab records for a class are deleted when their lecturer removes them from it. When the class ends, the student's account becomes a free account, with their work, and is deleted with its records 90 days after the end unless they go on using it. The class itself, with its list of students and the lecturer's view of their work, is deleted 90 days after the class's licence ends.
- An order whose emailed code is never typed in: deleted after 24 hours; an order turned down before its quotation: after 30 days.
- Sign-in sessions: 30 days.
- Backups: the server makes a copy of the database each night, kept for 14 days, and one a week kept for 8 weeks; we also keep the last 30 nightly copies on our own computer. So anything deleted is gone from the backups within ten weeks.
- Purchase records, and institutions' quotations and invoices: as long as Irish tax law requires (currently six years).
Cookies and your browser
The website sets no cookies and has no tracking or advertising. The SCMBase app keeps your sign-in and a few settings in your browser's local storage, which is needed for the app to work; nothing in it is used to follow you around the web.
Your rights
You can ask for a copy of your data, ask us to correct it or delete it, object to or restrict how we use it, or ask for it in a form you can take elsewhere. Email hello@scmbase.com; we answer within a month. If your account is part of a class, we may need to involve your lecturer. You can also complain to the Data Protection Commission (dataprotection.ie).
Changes
If we change this notice in a way that matters, we'll say so in the app and by email before the change takes effect.