Privacy Policy

1. Who is responsible for your personal data?

The data controller is:

Adam Gabriela-Florentina EI 54 Avenue de Riedisheim, 68100, Mulhouse, France Email: contact@professional-english.eu

Adam Gabriela-Florentina EI is responsible for deciding how and why the personal data described in this Privacy Policy is processed.

No Data Protection Officer has been appointed. All questions and requests concerning personal data should be sent to the email address above.

This Privacy Policy explains how personal data is processed in connection with:

• the website professional-english.eu;
• enquiries and requests for information or quotations;
• needs-analysis calls and appointments;
• commercial communications;
• the design, administration and delivery of learning and development programmes and training;
• relationships with client organisations, programme participants, prospective clients, corporate contacts (including HR, L&D and management contacts) and suppliers;
• invoicing, accounting and compliance with legal obligations.

This policy applies whether the information is collected through the website, by email, through Microsoft Bookings, during an online meeting, through a questionnaire or in the course of delivering a programme.

Depending on the nature of your interaction with us, we may process the following categories of data.

Identification and contact information

This may include: first name and surname; email address; telephone number; postal address; employer or organisation; job title, department and professional responsibilities; preferred language and communication preferences.

Enquiry and appointment information

This may include: information entered in the website contact form; the subject and content of your enquiry; appointment dates, availability and time zone; information provided when booking a needs-analysis call; correspondence and contact history.

Programme and participant information

This may include: employer, function, role and responsibilities; learning needs and objectives; input gathered during needs analysis from participants and from HR, L&D or management contacts; communication or language-level assessments where relevant; attendance and scheduling information; programme plans and session records; facilitator notes, feedback and progress summaries; exercises, role-play outputs, assignments and written work; needs-analysis and satisfaction questionnaires; workplace situations, documents and terminology that participants choose to bring into sessions; CVs, cover letters and information provided for interview or career preparation; audio or video recordings where a session or activity is recorded with your prior knowledge and agreement.

Participants are asked not to share confidential business information, personal data relating to other people or sensitive personal information unless it is genuinely necessary for the agreed programme and they are authorised to disclose it. Where possible, practice materials should be anonymised.

Information received from client organisations

Where an organisation commissions a programme, it may give us participants' names, work email addresses, job titles and scheduling details, as well as the objectives of the programme. In that case, the information was not collected from the participant directly, and its source is the commissioning organisation. This policy serves as the information required by Article 14 GDPR, and participants will also be informed of the source and use of their data no later than the first communication with them.

Contractual and financial information

This may include: quotations, contracts, orders and correspondence; billing address and invoicing information; payment status and transaction references; bank details where required to make or receive a payment; information needed for accounting, tax and legal compliance.

Payment-card information is not collected through the website.

Testimonials

Where a person agrees to provide a testimonial, we may publish: their first name or a pseudonym; a general description of their professional field or role; the content of their testimonial, which may be lightly edited for length and clarity.

Full surnames, photographs and exact job titles are not published unless the person has separately and explicitly agreed to their publication.

Website and technical information

When you visit the website, certain technical information may be processed automatically by the hosting infrastructure, including: IP address; date and time of access; requested pages or files; browser and device information; operating system; referring page; server and security logs.

Information about cookies and similar technologies is provided in the separate Cookie Policy.

Enquiries and quotation requests

We use your contact details, professional information and correspondence to respond to enquiries from organisations and individuals and to prepare quotations. This processing is necessary to take steps at your request before entering into a contract. Where applicable, it is also based on our legitimate interest in responding to professional enquiries.

Needs-analysis calls and appointments

We use your contact details, availability and booking information to arrange and manage appointments. This processing is necessary to take steps before entering into a contract or to perform an existing contract.

Programme preparation and delivery

We process participant, needs-analysis, attendance, exercise and progress information to prepare, tailor and deliver learning programmes. Where the participant is the contracting party, this processing is necessary for the performance of a contract. Where an organisation commissions the programme for its employees, it is based on our legitimate interest in delivering the service the client has contracted, taking into account participants' interests and reasonable expectations.

Reporting to commissioning organisations

We provide the commissioning organisation with attendance, progress against the agreed objectives and an end-of-programme report. This is based on our legitimate interest in meeting our contractual obligations to the client, and is limited to what is described in section 8.

Audio and video recordings

Where a training session or activity is recorded, we process the participants' voice, image and contributions. Recordings are normally made on the basis of the participants' prior consent.

Client and contract management

We process identification details, contracts and communications to manage relationships with client organisations and their contacts and to provide the agreed services. This is necessary for the performance of a contract and for our legitimate interest in managing professional relationships.

Invoicing and accounting

We process contractual and financial information for invoicing, accounting and tax purposes. This is necessary for the performance of a contract and compliance with legal obligations.

Legal claims

Relevant contracts, communications and programme records may be retained where necessary to establish, exercise or defend legal claims. This processing is based on our legitimate interest in protecting our legal rights.

Testimonials

We publish a person's first name or pseudonym, a general description of their professional role and their testimonial only with their consent. Consent may be withdrawn at any time.

Communications with existing clients

We may inform existing or former clients about similar services on the basis of our legitimate commercial interests, subject to applicable electronic-marketing rules and the right to opt out at any time.

Professional prospecting

We may use publicly available professional contact details to contact people about services related to their professional responsibilities. This processing is based on our legitimate interest in developing our business.

Opt-out management

When a person objects to commercial communications, we retain the minimum information necessary to ensure that the objection continues to be respected. This is based on our legitimate interests and our obligation to respect marketing objections.

Website operation and security

IP addresses and technical logs may be processed to operate, maintain and protect the website. This is based on our legitimate interest in providing a functional and secure website.

Legal and regulatory requirements

We process information where necessary to comply with applicable legal, accounting, tax or regulatory obligations.

Existing and former clients

Existing or former clients may receive information about services similar to those previously purchased or discussed, where permitted by law. Every commercial message will provide a simple way to object to further communications.

Professional prospects

Professional contact details obtained from public professional sources, company websites, professional directories or professional networking platforms such as LinkedIn may be used to send relevant B2B communications.

Such communications will: relate to the recipient's professional role, such as HR, L&D or management responsibilities; identify the sender; explain how to object to further communications; stop if the recipient objects.

Where personal data was not obtained directly from the recipient, information about its source and use will be provided no later than the first communication, in accordance with Article 14 GDPR.

Personal data is not sold or provided to other organisations for their own marketing.

Microsoft Bookings is used to arrange appointments, including needs-analysis calls. Microsoft 365 Business Standard services may also be used for professional email, calendars, online meetings, document storage, file sharing, questionnaires and programme administration.

When you use these services, relevant personal data may be processed by Microsoft as a service provider acting on our behalf. This may include identification details, contact information, appointment information, communications, documents, meeting information and technical data.

Microsoft may process certain data outside the European Economic Area. Where this occurs, transfers are subject to the safeguards described in Microsoft's contractual and data-protection documentation, which may include adequacy decisions, the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

Microsoft may also process certain data for its own purposes as described in its privacy documentation.

The website is hosted by Hetzner Online GmbH, whose services and data centres used for this website are located in Germany.

Hetzner may process website content, IP addresses and technical server logs on our behalf for the purposes of hosting, maintenance, security, backup and incident management.

Personal data is only accessible to recipients who need it for one of the purposes described in this policy. These may include: Adam Gabriela-Florentina EI; the client organisation commissioning or funding the programme, where applicable and subject to the agreed arrangements; Microsoft, in connection with Microsoft 365 and Microsoft Bookings; Hetzner, as the website-hosting provider; website developers or technical-maintenance providers, where access is necessary; accounting, legal or professional advisers subject to confidentiality obligations; public authorities, courts or regulatory bodies where disclosure is legally required; other service providers necessary for delivering an agreed service.

A commissioning organisation will not automatically receive detailed session notes, individual exercises, recordings or the content of what participants disclose during sessions. Reporting is limited to what has been agreed in advance: attendance, participation, progress against the agreed objectives and an end-of-programme report. Participants are told what will be reported before the programme begins.

Service providers are required to process personal data only for authorised purposes and to provide appropriate protection.

Hetzner hosts the website in Germany, within the European Economic Area.

Some Microsoft services or support operations may involve access to or processing of data outside the European Economic Area. Where required, appropriate safeguards are used, including an applicable adequacy decision or the European Commission's Standard Contractual Clauses.

If another provider involving an international transfer is added to the website or programme delivery, this Privacy Policy will be updated where necessary.

Personal data is retained only for as long as necessary for the relevant purpose.

Prospects and unsuccessful enquiries

Information is retained for up to three years from its collection or the last meaningful contact from the prospect.

Client information used for marketing

Information may be used during the client relationship and for up to three years after the end of that relationship or the last relevant contact.

Marketing objections

The minimum information needed to respect an objection may be retained for as long as necessary to prevent further marketing communications.

Appointment information

Booking information is retained for the time needed to manage the appointment and any relevant follow-up. It is then subject to the retention period applicable to the prospect or client.

Contracts and contractual records

Contracts and information needed to manage contractual rights are retained throughout the relationship. They may then be placed in restricted archives for up to five years, unless a different statutory limitation period applies.

Programme records

Programme plans, attendance records, assessments, progress information, end-of-programme reports and questionnaires are normally retained for the duration of the programme and for up to three years after it ends. This includes participant details received from a commissioning organisation. They may be retained longer where required by law, a funding arrangement or a contractual obligation.

CVs and interview-preparation documents

These documents are retained for the duration of the service and deleted within six months after it ends, unless the person requests or agrees to longer retention.

Audio and video recordings

Recordings are deleted when the relevant review or training purpose has been completed and normally within three months, unless another period has been expressly agreed.

Testimonials

Testimonials are retained until consent is withdrawn or the testimonial is no longer used.

Invoices and accounting documents

These records are retained for ten years in accordance with applicable French legal obligations.

Technical and security logs

Technical and security logs are retained for approximately 14 days and then automatically deleted, and for no longer than reasonably necessary for website security and incident investigation. Information may be retained for longer where this is required by law or necessary to establish, exercise or defend a legal claim.

Information identified as required in a contact, booking or contractual process is necessary to respond to your request, arrange the service or fulfil the contract. You are not required to provide optional information. However, if essential information is not provided, it may not be possible to respond to an enquiry, arrange an appointment or deliver the requested service.

Subject to the conditions and limitations established by the GDPR, you may have the right to: obtain confirmation that your personal data is being processed and receive a copy of it; have inaccurate or incomplete data corrected; request deletion of your personal data; request restriction of processing; object to processing based on legitimate interests; object at any time to the use of your data for direct marketing; receive data you provided in a structured, commonly used and machine-readable format where the right to data portability applies; withdraw consent at any time, without affecting processing carried out before withdrawal; provide instructions concerning the handling of your personal data after your death, where French law applies.

To exercise your rights, contact: contact@professional-english.eu. Please describe your request clearly and indicate the email address or other details needed to locate the relevant information.

Proof of identity will only be requested where there are reasonable doubts concerning the identity of the person making the request. Any identity document provided for this purpose will be used only to verify identity and will not be retained longer than necessary. Requests are normally answered within one month. This period may be extended by up to two additional months where permitted by the GDPR, taking into account the complexity and number of requests. You will be informed of any extension within the initial one-month period.

If you believe that your personal data has not been processed in accordance with applicable law, you may lodge a complaint with the French supervisory authority:

Commission nationale de l'informatique et des libertés, CNIL 3 Place de Fontenoy TSA 80715 75334 Paris Cedex 07 France www.cnil.fr

You may also contact the data-protection authority in the EU or EEA country where you habitually reside, work or believe an infringement occurred.

Personal data is not used to make decisions based solely on automated processing that produce legal effects or similarly significant effects. No automated profiling is performed.

Reasonable technical and organisational measures are used to protect personal data against unauthorised access, disclosure, alteration, accidental loss or destruction. These measures include, where appropriate: encrypted connections; access controls and password protection; restricted access according to operational need; software and security updates; backup and recovery measures; security features provided by Microsoft 365 and Hetzner; confidentiality requirements applicable to service providers.

No method of electronic transmission or storage is completely risk-free. Any suspected personal-data breach will be assessed and, where legally required, reported to the CNIL and affected individuals.

The website may contain links to third-party websites. Those websites are responsible for their own processing of personal data. You should consult their privacy information before providing personal data to them.

This Privacy Policy may be updated to reflect changes in the website, services, suppliers or legal requirements. The date shown at the beginning of the policy indicates when it was last updated. Where a change materially affects how personal data is used, appropriate steps will be taken to inform the individuals concerned.