Privacy Policy

Mudey Formation is an online training platform operated by Espero-Soft Informatiques SRL, which acts as the data controller of your personal data within the meaning of Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018.

This policy describes what data we collect, why, on what legal basis, with whom we share it, how long we retain it and which rights you may exercise. For any question relating to your data, write to us at info@mudey.fr.

We collect the following categories of data:

• •Registration data: surname, first name, email address and password (stored in encrypted form and never in plain text). If you sign in via Google, we receive your name, your email address and your profile picture.
• •Profile data: profile picture, biography, learning preferences.
• •Usage data: courses viewed, progress, assessment results, certificates obtained.
• •Transaction data: purchase history, amounts, invoices. Your bank card data is processed directly by our payment provider and never passes through our servers.
• •Technical data: IP address, browser and device type, pages visited, session identifiers, connection logs.
• •Communication data: exchanges with our support team, applications for instructor status.

We process your data only for specified purposes, each resting on a precise legal basis:

• •Management of your account and access to courses: performance of the contract concluded with you (Article 6.1.b GDPR).
• •Processing of payments and invoicing: performance of the contract and compliance with our legal accounting and tax obligations (Articles 6.1.b and 6.1.c).
• •Tracking your progress and issuing certificates: performance of the contract (Article 6.1.b).
• •Service emails (purchase confirmation, security, update of a course you are following): performance of the contract (Article 6.1.b).
• •Personalised course recommendations: our legitimate interest in offering you relevant content (Article 6.1.f). You may object to this at any time.
• •Newsletters and promotional communications: your consent (Article 6.1.a), which you may withdraw at any time via the unsubscribe link included in every mailing.
• •Audience measurement and improvement of the platform: your consent for non-essential cookies (Article 6.1.a).
• •Security, prevention of fraud and abuse: our legitimate interest in protecting the platform and its users (Article 6.1.f).
• •Responding to requests from authorities and defending our rights in legal proceedings: compliance with a legal obligation and legitimate interest (Articles 6.1.c and 6.1.f).

We never sell your personal data and do not rent it to anyone. We disclose it only to the following recipients:

• •The instructors: of the courses in which you are enrolled, and only for the data necessary for educational monitoring (name, progress, results). They are contractually bound by confidentiality.
• •Our technical providers: website hosting (OVH SAS, France); video storage and delivery (Amazon Web Services EMEA SARL, Luxembourg, Paris region); payment processing (Stripe Payments Europe Ltd, Ireland); authentication via Google account (Google Ireland Ltd); sending of transactional emails.
• •The competent authorities: where required by law, or to establish, exercise or defend a right in legal proceedings.

Each of our processors is bound by a contract compliant with Article 28 GDPR and processes your data only on our documented instructions, for the sole purposes described above.

We systematically favour hosting and storage within the European Union. Your account data and course content are hosted in France and within the European Economic Area.

However, some of our providers belong to groups established outside the European Union and may, in limited cases (technical support, backups), access data from a third country. Such transfers are then governed by one of the mechanisms provided for in Chapter V GDPR: an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework for certified American providers, or the standard contractual clauses adopted by the Commission, supplemented where appropriate by additional technical measures such as encryption.

You may obtain a copy of these safeguards by writing to info@mudey.fr.

We retain your data only for as long as is necessary for the purposes pursued:

• •Account and profile data: for the entire lifetime of your account, then deleted or anonymised within thirty (30) days following its closure.
• •Progress data and certificates: ten (10) years from the issue of the certificate, in order to be able to attest to its authenticity at your request or at the request of a third party authorised by you.
• •Invoices and accounting records: seven (7) years from the closing of the financial year, in accordance with Article III.86 of the Code of Economic Law, this period being extended to ten (10) years for documents subject to VAT retention obligations.
• •Technical and security logs: twelve (12) months at most.
• •Cookies and trackers: thirteen (13) months at most from the time they are placed; your consent is requested again at least every six (6) months.
• •Commercial prospecting data: three (3) years from your last contact with us.
• •Exchanges with support: three (3) years from the closure of your request.

Upon expiry of these periods, your data is deleted or irreversibly anonymised, unless there is a legal obligation to retain it for longer or a need to defend a right in legal proceedings.

We implement appropriate technical and organisational measures to protect your data against any unauthorised access, alteration, disclosure or destruction: encryption of communications (HTTPS/TLS), encryption of passwords by a one-way hash function, strict access controls limited to authorised staff, regular backups and access logging.

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible and will notify the Data Protection Authority within seventy-two (72) hours, in accordance with Articles 33 and 34 GDPR.

In accordance with Articles 15 to 22 GDPR, you have the following rights:

• •Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
• •Right to rectification: to have your inaccurate or incomplete data corrected.
• •Right to erasure: to request the deletion of your data, subject to our legal retention obligations.
• •Right to restriction: to request the temporary freezing of the processing, in particular while we verify the accuracy of data that you contest.
• •Right to portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another data controller.
• •Right to object: to object at any time to processing based on our legitimate interest, as well as, without condition or justification, to commercial prospecting.
• •Right to withdraw your consent: where the processing is based on your consent, to withdraw it at any time, without this affecting the lawfulness of processing carried out beforehand.

To exercise these rights, write to us at info@mudey.fr. We may ask you for proof of identity in the event of reasonable doubt about your identity. The exercise of your rights is free of charge and we respond within one (1) month, extendable by two (2) months in the case of a complex request, in which case we will inform you.

We use your browsing and progress data to recommend courses that may interest you. This profiling is limited to content suggestions: it produces no legal effect concerning you and does not significantly affect you.

We take no decision based solely on automated processing within the meaning of Article 22 GDPR. You may object to this profiling at any time by writing to us at info@mudey.fr.

Cookies strictly necessary for the operation of the platform (session, authentication, cart, security) are placed without your consent, as they are indispensable to the provision of the service that you expressly request.

All other cookies (audience measurement, personalisation and marketing) are only placed after your freely given, specific, informed and unambiguous consent, obtained category by category via our banner on your first visit. Refusing is as simple as accepting, and continuing to browse never constitutes consent.

You may change or withdraw your choice at any time via the “Cookie management” link at the bottom of every page. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out beforehand.

Our services are not intended for persons under the age of sixteen (16). We do not knowingly collect data concerning a minor under 16 without the prior authorisation of the holder of parental responsibility.

If you are the holder of parental responsibility and find that a minor has provided us with data without your authorisation, contact us at info@mudey.fr: we will delete such data as soon as possible.

We may update this privacy policy to take account of legal or technical developments or changes to our services. Any substantial modification will be notified to you by email or via a notification on the platform at least thirty (30) days before it takes effect.

The date of the last update appears at the top of this page. Previous versions are available on simple request to info@mudey.fr.

For any question concerning this privacy policy or to exercise your rights, you may contact us at: