Privacy Policy and Your Rights

Espero-Soft Informatiques SRL operates Mudey Formation, an online training platform. It acts as the data controller of your personal data within the meaning of Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018.

This privacy policy describes what data we collect, why and on what legal basis. It also states with whom we share it, how long we retain it and which rights you may exercise. For any privacy question relating to your data, write to us at info@mudey.fr.

We collect the following categories of data:

• •Registration data: surname, first name, email address and password (stored in encrypted form and never in plain text). If you sign in via Google, we receive your name, your email address and your profile picture.
• •Profile data: profile picture, biography, learning preferences.
• •Usage data: courses viewed, progress, assessment results, certificates obtained.
• •Transaction data: purchase history, amounts, invoices. Our payment provider processes your bank card data directly, and it never passes through our servers.
• •Technical data: IP address, browser and device type, pages visited, session identifiers, connection logs.
• •Communication data: exchanges with our support team, applications for instructor status.

We process your data only for specified purposes, each resting on a precise legal basis:

• •Management of your account and access to courses: performance of the contract concluded with you (Article 6.1.b GDPR).
• •Processing of payments and invoicing: performance of the contract and compliance with our legal accounting and tax obligations (Articles 6.1.b and 6.1.c).
• •Tracking your progress and issuing certificates: performance of the contract (Article 6.1.b).
• •Service emails (purchase confirmation, security, update of a course you are following): performance of the contract (Article 6.1.b).
• •Personalised course recommendations: our legitimate interest in offering you relevant content (Article 6.1.f). You may object to this at any time.
• •Newsletters and promotional communications: your consent (Article 6.1.a), which you may withdraw at any time via the unsubscribe link included in every mailing.
• •Audience measurement and improvement of the platform: your consent for non-essential cookies (Article 6.1.a).
• •Security, prevention of fraud and abuse: our legitimate interest in protecting the platform and its users (Article 6.1.f).
• •Responding to requests from authorities and defending our rights in legal proceedings: compliance with a legal obligation and legitimate interest (Articles 6.1.c and 6.1.f).

We never sell your personal data and do not rent it to anyone. We disclose it only to the following recipients:

• •The instructors: of the courses you have enrolled in, and only for the data necessary for educational monitoring (name, progress, results). They are contractually bound by confidentiality.
• •Our technical providers: website hosting (OVH SAS, France); video storage and delivery (Amazon Web Services EMEA SARL, Luxembourg, Paris region); payment processing (Stripe Payments Europe Ltd, Ireland); authentication via Google account (Google Ireland Ltd); sending of transactional emails.
• •The competent authorities: where required by law, or to establish, exercise or defend a right in legal proceedings.

Each of our processors is bound by a contract compliant with Article 28 GDPR. It processes your data only on our documented instructions, for the sole purposes described above.

We systematically favour hosting and storage within the European Union. We host your account data and course content in France and within the European Economic Area.

However, some of our providers belong to groups established outside the European Union. In limited cases (technical support, backups), they may access data from a third country. One of the mechanisms provided for in Chapter V GDPR then governs such transfers. It may be an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework for certified American providers. It may also be the standard contractual clauses adopted by the Commission, supplemented where appropriate by additional technical measures such as encryption.

You may obtain a copy of these safeguards by writing to info@mudey.fr.

We retain your data only for as long as is necessary for the purposes pursued:

• •Account and profile data: for the entire lifetime of your account, then deleted or anonymised within thirty (30) days following its closure.
• •Progress data and certificates: ten (10) years from the issue of the certificate. This period allows us to attest to its authenticity at your request or at the request of a third party authorised by you.
• •Invoices and accounting records: seven (7) years from the closing of the financial year, in accordance with Article III.86 of the Code of Economic Law. This period extends to ten (10) years for documents subject to VAT retention obligations.
• •Technical and security logs: twelve (12) months at most.
• •Cookies and trackers: thirteen (13) months at most from when we place them; we ask for your consent again at least every six (6) months.
• •Commercial prospecting data: three (3) years from your last contact with us.
• •Exchanges with support: three (3) years from the closure of your request.

Upon expiry of these periods, we delete your data or irreversibly anonymise it, unless there is a legal obligation to retain it for longer or a need to defend a right in legal proceedings.

We implement appropriate technical and organisational measures to protect your data against any unauthorised access, alteration, disclosure or destruction. These measures include encryption of communications (HTTPS/TLS) and encryption of passwords by a one-way hash function. They also include strict access controls limited to authorised staff, regular backups and access logging.

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible. We will then notify the Data Protection Authority within seventy-two (72) hours, in accordance with Articles 33 and 34 GDPR.

In accordance with Articles 15 to 22 GDPR, you have the following rights:

• •Right of access: to obtain confirmation that we process your data and to receive a copy of it.
• •Right to rectification: to have your inaccurate or incomplete data corrected.
• •Right to erasure: to request the deletion of your data, subject to our legal retention obligations.
• •Right to restriction: to request the temporary freezing of the processing, in particular while we verify the accuracy of data that you contest.
• •Right to portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another data controller.
• •Right to object: to object at any time to processing based on our legitimate interest, as well as, without condition or justification, to commercial prospecting.
• •Right to withdraw your consent: where the processing relies on your consent, to withdraw it at any time, without this affecting the lawfulness of processing carried out beforehand.

To exercise these privacy rights, write to us at info@mudey.fr. We may ask you for proof of identity in the event of reasonable doubt about your identity. The exercise of your rights is free of charge. We respond within one (1) month, extendable by two (2) months in the case of a complex request, in which case we will inform you.

We use your browsing and progress data to recommend courses that may interest you. This profiling covers only content suggestions: it produces no legal effect concerning you and does not significantly affect you.

We take no decision based solely on automated processing within the meaning of Article 22 GDPR. You may object to this profiling at any time by writing to us at info@mudey.fr.

We place cookies strictly necessary for the operation of the platform (session, authentication, cart, security) without your consent. They are indispensable to the provision of the service that you expressly request.

We only place all other cookies (audience measurement, personalisation and marketing) after your freely given, specific, informed and unambiguous consent. We obtain this consent category by category via our banner on your first visit. Refusing is as simple as accepting, and continuing to browse never constitutes consent.

You may change or withdraw your choice at any time via the “Manage cookies” link at the bottom of every page. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out beforehand.

Our services are not intended for persons under the age of sixteen (16). We do not knowingly collect data concerning a minor under 16 without the prior authorisation of the holder of parental responsibility.

If you are the holder of parental responsibility and find that a minor has provided us with data without your authorisation, contact us at info@mudey.fr. We will delete such data as soon as possible.

We may update this privacy policy to take account of legal or technical developments or changes to our services. We will notify you of any substantial modification by email or via a notification on the platform at least thirty (30) days before it takes effect.

The date of the last update appears at the top of this page. Previous versions of this privacy policy are available on simple request to info@mudey.fr.

For any question concerning this privacy policy or to exercise your rights, you may contact us at: