Privacy policy

1. Who is responsible for your data

Let's Learn IT (LLIT) is the controller of the personal data processed through this website.

Contact details (company name, registered address, enterprise number and a privacy contact e-mail address): to be completed during the legal review.

2. Which data we collect

Account data: your first and last name, e-mail address, phone number and preferred language.

Optional data: default company billing details that you choose to save in your profile.

Registration data: the courses, editions and sessions you register for and the status of each registration (for example confirmed or withdrawn).

Consent records: which version of the privacy policy and the terms you accepted, and when.

Cookies: only strictly necessary cookies, for your sign-in session and your chosen language. We do not use tracking or advertising cookies.

Participant data: when you register other people, their first name, last name, e-mail address and mail language, and the fact that you declared that they were informed (see section 7).

3. Why we use your data and on what basis

To manage your account and your registrations for courses. Basis: performance of the agreement you enter into with us.

To contact you about your registrations by e-mail or phone, for example to confirm a place, announce a change or cancel a session. Basis: performance of the agreement.

To keep proof that you accepted the privacy policy and the terms. Basis: our legitimate interest in being able to demonstrate your consent, and your consent itself.

We do not sell your data and we do not use it for automated decision-making.

To register people on behalf of a registrant, send them their own confirmation and calendar file and keep attendance for them. Basis: see section 7.

4. Who processes your data on our behalf

Hosting: the database is a self-hosted Supabase installation on a server in Frankfurt, Germany.

E-mail: the e-mails we send you (verification, password reset, confirmations) are sent through a Google consumer mail account. This means Google processes the content and the metadata of these e-mails. No data-processing agreement with Google is in place for this account yet. This is flagged for the legal review, and the sending route can be changed to a provider with such an agreement.

We do not share your data with other parties, unless the law requires it.

5. How long we keep your data

Retention periods are to be defined during the legal review. Until then we keep your data while your account exists.

Once paid courses start, invoice data will be kept for as long as Belgian law requires.

A record of who was registered, including participants who were later replaced or removed, is kept for as long as the registration is kept (see section 7).

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format and to object to its processing.

Where processing is based on your consent, you may withdraw it at any time.

You may lodge a complaint with the Belgian Data Protection Authority (www.gegevensbeschermingsautoriteit.be).

7. Participants registered by someone else

A person with an account (the registrant) can register colleagues, employees or other people for a course. For each of them we receive from the registrant a first name, a last name, an e-mail address and a language for the e-mails. We receive nothing else about them, and they do not need an account.

Source: if you were registered by someone else, your details come from the registrant named in the e-mail you received, not from you. The registrant declares that they may share these details with us and that they informed you.

Purposes: to organise the course you were registered for, to send you your confirmation and a calendar file, to keep attendance and to issue certificates.

Legal basis: for the registrant, performance of the agreement with us (Article 6(1)(b) GDPR). For the other participants, the legitimate interest of LLIT and of the registering party (the company if there is one, otherwise the registrant) in providing the place that was booked for them (Article 6(1)(f) GDPR). Your consent is not the basis, because somebody else registers you.

Retention: we keep these details as long as needed for these purposes and for our administration. If a participant is replaced or removed, or a registration is withdrawn, we keep a record that the person was registered for as long as the registration itself is kept. The exact periods are to be defined during the legal review.

Right to object: you can object at any time, on grounds relating to your situation, to the use of your details for these purposes (Article 21 GDPR). Reply to the e-mail you received. We then stop using your details for these purposes, unless we have compelling legitimate grounds to continue.

Your other rights: you have the right of access, correction, erasure, restriction and portability, and the right to lodge a complaint with the Belgian Data Protection Authority (www.gegevensbeschermingsautoriteit.be).

Controller and privacy contact: see section 1 (to be completed during the legal review).

8. Changes to this policy

When this policy changes, it gets a new version number. After a new version is published, you will be asked to accept it before you continue.

9. Open points for the legal review

Controller identity and privacy contact details.

The Google consumer mail account used for sending e-mail: no data-processing agreement is in place; decide whether to accept this or move to a provider that offers one.

Retention periods, including the retention of invoice data.

Legal bases for each purpose.

The information notice for colleagues who are registered by someone else as part of a group.

The wording of section 7 (participants registered by someone else): the legal basis, the retention periods and the one-page legitimate-interest assessment.