Privacy policy

I.General provisions

• The data controller under Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) is eXpansePi s.r.o, company ID 19145535, registered office Rybná 716/24, Staré Město, 110 00 Praha, Czech Republic (the “controller”).
• Controller contact details:

  Address: Rybná 716/24, Staré Město, 110 00 Praha, Czech Republic

  Email: info@expansepi.com

  Phone: +420 775 715 700

• Personal data means any information relating to an identified or identifiable natural person.
• The controller has not appointed a data protection officer.

II.Sources and categories of personal data processed

• The controller processes the personal data you have provided, or personal data obtained in order to fulfil your order.
• The controller processes your identification and contact details and the data necessary to perform the contract.
• Contact form: when you send a non-binding enquiry we process your name, email address, optional phone number and the text of your message. This data is used solely to answer your enquiry.

III.Legal basis and purpose

The legal basis for processing is:

• Performance of the contract between you and the controller.
• Compliance with legal obligations arising from the rules governing accreditation (Act No. 563/2004 Coll. and Decree No. 176/2009 Coll.).
• The controller's legitimate interest in direct marketing.
• Your consent, in the case of analytics and advertising cookies and related tools.

The purpose of processing is:

• Handling your order and exercising rights arising from the contractual relationship. Without the necessary data the contract cannot be concluded.
• Sending commercial communications and other marketing activities.
• Measuring traffic and advertising effectiveness, where you have given consent.

The controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR.

IV.Retention period

• The controller retains personal data for the period necessary to exercise rights and obligations arising from the contractual relationship (10 years, due to the statutory archiving obligation for accredited courses).
• Data processed for marketing purposes is retained for a maximum of 3 years or until consent is withdrawn. After that period the controller erases the data.
• Your cookie consent record is stored in your browser for 12 months; after that we ask you again.

V.Recipients of personal data

• Parties involved in delivering services and processing payments under the contract.
• Parties providing technical operations and marketing services.
• The Ministry of Education, Youth and Sports and the Czech Labour Office (administration and inspection of reskilling programmes).
• Vercel Inc. – the hosting provider for this website. It processes the technical data required to deliver the page (IP address, browser type) and, once consent is given, cookieless aggregate traffic statistics.
• Google Ireland Ltd. / Google LLC – measurement of traffic and advertising effectiveness. Loaded only after consent is given.
• Email service provider – delivery of contact form messages to our mailbox.

Transfers to third countries: Using Google and Vercel services involves transfers to the USA, safeguarded by an adequacy decision (Data Privacy Framework).

VI.Cookies and third-party tools

• Essential cookies: the site sets no advertising or analytics cookies until you give consent. Your consent decision is stored in your browser's local storage rather than in a cookie, and is never sent to our server.
• Analytics and advertising cookies: once consent is given we load Google Ads (gtag.js) and Vercel's cookieless traffic measurement. Before consent these tools are not loaded at all and no request is made to their servers.
• Enhanced conversions: if you submit a course application after giving consent, we send Google your email address and phone number in irreversibly hashed form (SHA-256) so that a conversion can be attributed to an advertisement. We do not send them in readable form.
• Withdrawing consent: you can change your choice at any time using the “Cookie settings” link in the site footer. Withdrawing consent stops the tools from loading and removes the Google cookies already created.

VII.Your rights

• The right of access, rectification, restriction of processing, erasure, portability, and the right to object.
• The right to withdraw consent in writing or electronically to the controller's address.
• The right to lodge a complaint with the Czech Office for Personal Data Protection.

VIII.Data security

• The controller has taken all technical and organisational measures (encryption, passwords) to secure its data stores.
• All communication with this website is encrypted (HTTPS).
• We do not process personal data in paper form.
• Access is limited to authorised persons.

IX.Final provisions

• By submitting an order you confirm that you are aware of these terms and accept them.
• You agree to them by ticking the consent box in the form (or by submitting it).
• The controller is entitled to amend these terms and publish new versions on the website.