Privacy Policy

1. Who is responsible for your personal data?

The data controller is:

Adam Gabriela-Florentina EI

37 Rue Saint Isidore, 69003, Lyon, France

Email: contact@professional-english.eu

Adam Gabriela-Florentina EI is responsible for deciding how and why the personal data described in this Privacy Policy is processed.

No Data Protection Officer has been appointed. All questions and requests concerning personal data should be sent to the email address above.

2. Scope of this Privacy Policy

This Privacy Policy explains how personal data is processed in connection with:

-> the website professional-english.eu;

-> enquiries and requests for information or quotations;

-> discovery calls and appointments;

-> commercial communications;

-> the preparation, administration and delivery of training services;

-> relationships with clients, trainees, prospective clients, corporate contacts and suppliers;

-> invoicing, accounting and compliance with legal obligations.

This policy applies whether the information is collected through the website, by email, through Microsoft Bookings, during an online meeting, through a questionnaire or in the course of providing training.

3. Personal data we may collect

Depending on the nature of your interaction with us, we may process the following categories of data.

Identification and contact information

This may include: first name and surname; email address; telephone number; postal address; employer or organisation; job title, department and professional responsibilities; preferred language and communication preferences.

Enquiry and appointment information

This may include: information entered in the website contact form; the subject and content of your enquiry; appointment dates, availability and time zone; information provided when booking a discovery call; correspondence and contact history.

Training and professional information

This may include: employer, profession, role and responsibilities; language level and assessment results; professional communication needs and objectives; attendance and scheduling information; training plans and session records; progress notes and trainer feedback; exercises, assignments and written work; needs-analysis and satisfaction questionnaires; professional situations, documents or terminology discussed during training; CVs, cover letters and information provided for interview or career preparation; audio or video recordings where a session or activity is recorded with your prior knowledge and agreement.

You should avoid providing confidential business information, personal data relating to other people or sensitive personal information unless it is genuinely necessary for the agreed service and you are authorised to disclose it.

Contractual and financial information

This may include: quotations, contracts, orders and correspondence; billing address and invoicing information; payment status and transaction references; bank details where required to make or receive a payment; information needed for accounting, tax and legal compliance.

Payment-card information is not collected through the website.

Testimonials

Where a person agrees to provide a testimonial, we may publish: their first name; a general description of their professional field or role; the content of their testimonial.

Full surnames, photographs and exact job titles are not published unless the person has separately and explicitly agreed to their publication.

Website and technical information

When you visit the website, certain technical information may be processed automatically by the hosting infrastructure, including: IP address; date and time of access; requested pages or files; browser and device information; operating system; referring page; server and security logs.

Information about cookies and similar technologies is provided in the separate Cookie Policy.

4. Why and on what legal basis we use personal data

Enquiries and quotation requests

We use your contact details, professional information and correspondence to respond to enquiries and prepare quotations. This processing is necessary to take steps at your request before entering into a contract. Where applicable, it is also based on our legitimate interest in responding to professional enquiries.

Discovery calls and appointments

We use your contact details, availability and booking information to arrange and manage appointments. This processing is necessary to take steps before entering into a contract or to perform an existing contract.

Training preparation and delivery

We process professional information, language assessments, objectives, attendance, exercises and progress information to prepare, personalise and deliver training services. This processing is necessary for the performance of a contract.

Audio and video recordings

Where a training session or activity is recorded, we process the participants’ voice, image and contributions. Recordings are normally made on the basis of the participants’ prior consent.

Client and contract management

We process identification details, contracts and communications to manage client relationships and provide the agreed services. This is necessary for the performance of a contract and for our legitimate interest in managing professional relationships.

Invoicing and accounting

We process contractual and financial information for invoicing, accounting and tax purposes. This is necessary for the performance of a contract and compliance with legal obligations.

Legal claims

Relevant contracts, communications and training records may be retained where necessary to establish, exercise or defend legal claims. This processing is based on our legitimate interest in protecting our legal rights.

Testimonials

We publish a person’s first name, a general description of their professional role and their testimonial only with their consent. Consent may be withdrawn at any time.

Communications with existing clients

We may inform existing or former clients about similar services on the basis of our legitimate commercial interests, subject to applicable electronic-marketing rules and the right to opt out at any time.

Professional prospecting

We may use publicly available professional contact details to contact people about services related to their professional responsibilities. This processing is based on our legitimate interest in developing our business.

Opt-out management

When a person objects to commercial communications, we retain the minimum information necessary to ensure that the objection continues to be respected. This is based on our legitimate interests and our obligation to respect marketing objections.

Website operation and security

IP addresses and technical logs may be processed to operate, maintain and protect the website. This is based on our legitimate interest in providing a functional and secure website.

Legal and regulatory requirements

We process information where necessary to comply with applicable legal, accounting, tax or regulatory obligations.

5. Commercial communications

Existing and former clients

Existing or former clients may receive information about services similar to those previously purchased or discussed, where permitted by law. Every commercial message will provide a simple way to object to further communications.

Professional prospects

Professional contact details obtained from public professional sources, company websites, professional directories or professional networking platforms such as LinkedIn may be used to send relevant B2B communications.

Such communications will: relate to the recipient’s professional role; identify the sender; explain how to object to further communications; stop if the recipient objects.

Where personal data was not obtained directly from the recipient, information about its source and use will be provided no later than the first communication, in accordance with Article 14 GDPR.

Personal data is not sold or provided to other organisations for their own marketing.

6. Microsoft Bookings and Microsoft 365

Microsoft Bookings is used to arrange appointments. Microsoft 365 Business Standard services may also be used for professional email, calendars, online meetings, document storage, file sharing, questionnaires and training administration.

When you use these services, relevant personal data may be processed by Microsoft as a service provider acting on our behalf. This may include identification details, contact information, appointment information, communications, documents, meeting information and technical data.

Microsoft may process certain data outside the European Economic Area. Where this occurs, transfers are subject to the safeguards described in Microsoft’s contractual and data-protection documentation, which may include adequacy decisions, the EU-US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.

Microsoft may also process certain data for its own purposes as described in its privacy documentation.

7. Website hosting

The website is hosted by Hetzner Online GmbH, whose services and data centres used for this website are located in Germany.

Hetzner may process website content, IP addresses and technical server logs on our behalf for the purposes of hosting, maintenance, security, backup and incident management.

8. Who may receive your data?

Personal data is only accessible to recipients who need it for one of the purposes described in this policy. These may include: Adam Gabriela-Florentina EI; the client organisation funding or arranging the training, where applicable and subject to the agreed arrangements; Microsoft, in connection with Microsoft 365 and Microsoft Bookings; Hetzner, as the website-hosting provider; website developers or technical-maintenance providers, where access is necessary; accounting, legal or professional advisers subject to confidentiality obligations; public authorities, courts or regulatory bodies where disclosure is legally required; other service providers necessary for delivering an agreed service.

A corporate client will not automatically receive all detailed training notes, exercises, recordings or information disclosed during individual training sessions. The information shared with a sponsoring organisation should be limited to what has been agreed and is necessary, such as attendance, general progress and achievement of training objectives.

Service providers are required to process personal data only for authorised purposes and to provide appropriate protection.

9. International transfers

Hetzner hosts the website in Germany, within the European Economic Area.

Some Microsoft services or support operations may involve access to or processing of data outside the European Economic Area. Where required, appropriate safeguards are used, including an applicable adequacy decision or the European Commission’s Standard Contractual Clauses.

If another provider involving an international transfer is added to the website or training services, this Privacy Policy will be updated where necessary.

10. How long we retain personal data

Personal data is retained only for as long as necessary for the relevant purpose.

Prospects and unsuccessful enquiries

Information is retained for up to three years from its collection or the last meaningful contact from the prospect.

Client information used for marketing

Information may be used during the client relationship and for up to three years after the end of that relationship or the last relevant contact.

Marketing objections

The minimum information needed to respect an objection may be retained for as long as necessary to prevent further marketing communications.

Appointment information

Booking information is retained for the time needed to manage the appointment and any relevant follow-up. It is then subject to the retention period applicable to the prospect or client.

Contracts and contractual records

Contracts and information needed to manage contractual rights are retained throughout the relationship. They may then be placed in restricted archives for up to five years, unless a different statutory limitation period applies.

Training records

Training plans, attendance records, assessments, progress information and questionnaires are normally retained for the duration of the training and for up to three years after it ends. They may be retained longer where required by law, a funding arrangement or a contractual obligation.

CVs and interview-preparation documents

These documents are retained for the duration of the service and deleted within six months after it ends, unless the person requests or agrees to longer retention.

Audio and video recordings

Recordings are deleted when the relevant review or training purpose has been completed and normally within three months, unless another period has been expressly agreed.

Testimonials

Testimonials are retained until consent is withdrawn or the testimonial is no longer used.

Invoices and accounting documents

These records are retained for ten years in accordance with applicable French legal obligations.

Technical and security logs

Logs are retained for the period configured by the hosting or technical provider and no longer than reasonably necessary for website security and incident investigation. Information may be retained for longer where this is required by law or necessary to establish, exercise or defend a legal claim.

11. Is providing your data compulsory?

Information identified as required in a contact, booking or contractual process is necessary to respond to your request, arrange the service or fulfil the contract. You are not required to provide optional information. However, if essential information is not provided, it may not be possible to respond to an enquiry, arrange an appointment or deliver the requested service.

12. Your rights

Subject to the conditions and limitations established by the GDPR, you may have the right to: obtain confirmation that your personal data is being processed and receive a copy of it; have inaccurate or incomplete data corrected; request deletion of your personal data; request restriction of processing; object to processing based on legitimate interests; object at any time to the use of your data for direct marketing; receive data you provided in a structured, commonly used and machine-readable format where the right to data portability applies; withdraw consent at any time, without affecting processing carried out before withdrawal; provide instructions concerning the handling of your personal data after your death, where French law applies.

To exercise your rights, contact: contact@professional-english.eu Please describe your request clearly and indicate the email address or other details needed to locate the relevant information.

Proof of identity will only be requested where there are reasonable doubts concerning the identity of the person making the request. Any identity document provided for this purpose will be used only to verify identity and will not be retained longer than necessary. Requests are normally answered within one month. This period may be extended by up to two additional months where permitted by the GDPR, taking into account the complexity and number of requests. You will be informed of any extension within the initial one-month period.

13. Right to complain

If you believe that your personal data has not been processed in accordance with applicable law, you may lodge a complaint with the French supervisory authority:

Commission nationale de l’informatique et des libertés, CNIL

3 Place de Fontenoy

TSA 80715 75334 Paris Cedex 07 France

www.cnil.fr

You may also contact the data-protection authority in the EU or EEA country where you habitually reside, work or believe an infringement occurred.

14. Automated decision-making

Personal data is not used to make decisions based solely on automated processing that produce legal effects or similarly significant effects. No automated profiling is performed.

15. Security

Reasonable technical and organisational measures are used to protect personal data against unauthorised access, disclosure, alteration, accidental loss or destruction. These measures include, where appropriate: encrypted connections; access controls and password protection; restricted access according to operational need; software and security updates; backup and recovery measures; security features provided by Microsoft 365 and Hetzner; confidentiality requirements applicable to service providers.

No method of electronic transmission or storage is completely risk-free. Any suspected personal-data breach will be assessed and, where legally required, reported to the CNIL and affected individuals.

16. Third-party links

The website may contain links to third-party websites. Those websites are responsible for their own processing of personal data. You should consult their privacy information before providing personal data to them.

17. Changes to this policy

This Privacy Policy may be updated to reflect changes in the website, services, suppliers or legal requirements. The date shown at the beginning of the policy indicates when it was last updated. Where a change materially affects how personal data is used, appropriate steps will be taken to inform the individuals concerned.