Course registration privacy notice
Before publishing: The project team must replace the fields marked [TO COMPLETE], confirm retention and roles, and approve this notice under the GDPR. This page is an editable draft.
1. Data controller
[TO COMPLETE: full legal name, address and contact email of the organisation responsible for registrations]. Contact for privacy requests: [TO COMPLETE].
2. Personal data collected
First name, last name, email address, optional country, date of registration, and the requested Intermediate or Advanced course level. Supabase Authentication also processes authentication and technical security data necessary for email verification.
3. Purposes and lawful basis
We use this data to verify your email, grant access to the Intermediate and Advanced materials, and record course participation for project implementation and reporting. [TO COMPLETE: confirm and document the applicable GDPR Article 6 lawful basis for each purpose. Do not assume that merely ticking a privacy acknowledgement equals consent.]
4. Recipients and transfers
Personal data is hosted on the selected Supabase infrastructure and may be processed by authorised project staff and the hosting provider as processors. [TO COMPLETE: verify provider contractual terms, data region, subprocessors and any third-country transfer arrangements.]
5. Storage and retention
[TO COMPLETE: state a specific, justified retention period linked to project obligations and a deletion schedule.]
6. Your rights
Subject to the conditions of applicable law, you may request access, rectification, erasure, restriction, or portability of your data, object where applicable, and lodge a complaint with the competent supervisory authority. Contact [TO COMPLETE] to exercise your rights.
7. No marketing by default
Course registration does not include consent for newsletters or promotional communications.