Privacy policy
What data of yours we process, why, on what legal basis, how long we keep it, who else sees it and how you stay in control.
Last revised:
Mandatory identifying details are missing. Fill in src/app/legal/entity.ts before publishing: without a trade licence number and a contact email these documents do not identify the trader as European consumer law requires.
The EU representative is missing. As the company is incorporated outside the Union and directs the program at residents of it, article 27 GDPR requires appointing one in writing and publishing their name and address here.
1. Data controller
ActiveX FZC LLC, a company incorporated in the United Arab Emirates under trade licence no. [Nº DE LICENCIA COMERCIAL], registered at Office No. BC-893273, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Emiratos Árabes Unidos, is the controller of the personal data collected through this site and the virtual campus.
Although we are established outside the European Union, this processing is governed by the General Data Protection Regulation (GDPR): its article 3(2)(a) applies it to anyone offering services to people located in the Union, and our programs are sold in euros and in Spanish and aimed at residents of EU countries. UAE data protection law also applies to us, in particular Federal Decree-Law 45/2021. Where the two differ, we apply whichever protects you more.
Under article 27 GDPR we have designated a representative in the European Union in writing, whom you may address exactly as you would address us on anything concerning this processing: ActiveX LLC, [DIRECCIÓN POSTAL EN LA UE — pendiente].
For anything privacy-related, including exercising your rights, write to activexremote@gmail.com.
2. What data we process
We only process what we need and what you give us, plus what your own use of the platform generates. Specifically:
| Source | Data |
|---|---|
| Information request form | First name, surname, email address, phone number, city, the course or courses you are interested in, the language you were browsing in, and the date of the request. |
| Enrolment | Identification and billing details needed to formalise the contract and issue the invoice. |
| Campus account | Email address and access credentials, role, progress per module, exercise submissions and in-platform communications. |
| Technical data | IP address, browser and device type, and server activity logs, generated automatically when you connect. |
| Cookies and local storage | Language preference, your cookie consent state and your campus session. Full detail in the Cookie policy. |
We neither ask for nor need special categories of data (health, beliefs, union membership, ethnic origin, sexual orientation or biometrics). Please do not include them in free-text fields or campus submissions.
The form includes a hidden honeypot field that people never see and only bots fill in. It collects nothing about you: it exists to discard automated submissions before they are stored.
3. Why we use it and on what legal basis
Every purpose rests on a legal basis under article 6 of the General Data Protection Regulation (GDPR). None is used for anything other than what is declared here.
| Purpose | Legal basis |
|---|---|
| Answering your request and sending you the program, calendar and terms for the course you selected. | Your consent, given when you submit the form (art. 6.1.a GDPR). You may withdraw it at any time. |
| Contacting you to resolve questions about that request, by email or phone. | The same consent, and pre-contractual steps taken at your request (art. 6.1.b GDPR). |
| Managing your enrolment, granting campus access and delivering the training. | Performance of the contract to which you are party (art. 6.1.b GDPR). |
| Issuing invoices and meeting accounting, tax and record-keeping obligations. | Compliance with a legal obligation (art. 6.1.c GDPR). |
| Keeping the site and campus secure, preventing fraud and abuse, and retaining technical logs. | Legitimate interest in protecting the platform and its users (art. 6.1.f GDPR). |
| Sending you information about our own cohorts or programs similar to those you requested or took. | Legitimate interest in marketing to our own customers (art. 6.1.f GDPR and art. 21.2 LSSI-CE). Every message carries an unsubscribe link. |
| Measuring site usage and serving advertising, if you enable those categories in the cookie panel. | Your specific per-category consent (art. 6.1.a GDPR). Without it, those cookies are not set. |
Every field in the request form is necessary in order to reply to you: without them we cannot send the information or get in touch. Nothing is collected just in case.
4. How long we keep it
| Data | Retention |
|---|---|
| Information requests that do not lead to enrolment | 12 months from the last contact. After that they are deleted, unless you ask us to do it sooner. |
| Enrolled students' data | Throughout the training relationship and, afterwards, blocked for the limitation periods applying to contractual liability: 6 years under commercial law and 4 under tax law. |
| Invoicing and accounting records | The periods imposed by the tax and commercial legislation in force at the time. |
| Technical and security logs | 12 months at most. |
| Record of your cookie consent | 12 months, after which you are asked again. |
Once the period ends, data is deleted or anonymised so that you can no longer be identified. While blocked, it is kept solely at the disposal of courts and competent authorities.
5. Who else accesses your data
We do not sell, rent or share your data with third parties for their own purposes. We do work with providers who process it on our behalf, on our instructions and under a signed processor agreement (art. 28 GDPR):
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database holding requests and campus accounts, and the authentication service. | European Union / United States depending on the contracted region. |
| Vercel | Hosting and content delivery for the site and the campus. | European Union / United States. |
| Slack | Internal alert to the team when a new request arrives. The message includes your name, email, phone, city and the course you are interested in. | United States. |
Our accounting and tax advisers and the payment providers involved in enrolment may also access data, strictly as needed. We will also disclose data to public authorities and courts where a legal obligation requires it.
Certifying bodies receive, where applicable, only the data strictly required to issue and verify the diploma of those who complete the program.
6. International transfers
There are two distinct movements here and they should not be conflated.
The first is towards us. We are established in the United Arab Emirates, a country for which the European Commission has adopted no adequacy decision. Access to your data from our offices is therefore an international transfer, which we cover with the standard contractual clauses approved by the European Commission, signed with our EU representative, together with the additional measures arising from the transfer impact assessment: encryption in transit and at rest, role-based access control and minimisation of the data leaving the Union. Where the transfer is necessary to perform the training contract you requested, it is additionally covered by article 49(1)(b) GDPR.
The second is towards the providers. Supabase, Vercel and Slack are established in the United States or may access data from there. Those transfers rely on the EU-US Data Privacy Framework adequacy decision where the provider is certified under it, or on standard contractual clauses with additional measures where it is not.
You can request a copy of the safeguards applied by writing to activexremote@gmail.com.
7. Automated decisions and profiling
We take no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not profile you to decide on your admission or on the terms offered to you.
8. Your rights
The law grants you a set of rights you can exercise at any time, free of charge:
- Access: know what data of yours we process and obtain a copy.
- Rectification: correct inaccurate data or complete incomplete data.
- Erasure: ask us to delete data when it is no longer needed or you withdraw consent.
- Objection: object to processing based on our legitimate interest, including marketing.
- Restriction: ask us to keep data but stop using it while a claim is resolved.
- Portability: receive the data you provided in a structured, commonly used format and transmit it to another controller.
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise them, write to activexremote@gmail.com stating which right you wish to exercise. We may ask you to prove your identity if we have reasonable doubts about who is making the request. We reply within one month, extendable by two more for complex requests, telling you why.
If you believe we have not handled your request properly, you may complain to the data protection supervisory authority of the EU country where you live, where you work or where the problem arose. If you live in Spain, that is the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es). We would appreciate the chance to put it right first.
9. Security
We apply technical and organisational measures appropriate to the risk: encrypted communications, role-based access control, row-level security in the database, authentication for campus accounts, backups and access logging. The requests table is not reachable from the browser: it is written only from the server and can be read only by authorised staff.
No system is infallible. Should a security breach occur that poses a high risk to your rights, we will inform you without undue delay and notify the supervisory authority under articles 33 and 34 GDPR.
10. Minors
Neither the site nor the programs are aimed at people under 18, and we do not knowingly collect their data. If we find we have processed a minor's data without the appropriate authorisation, we will delete it. If you are a parent or guardian and believe this has happened, write to us.
11. Changes to this policy
If what we do with data changes, this policy changes. We will publish the new version here with its revision date and, where the change is substantial and affects consent-based processing, we will tell you and ask for fresh consent.