Privacy Policy

Version: 1.0 — 22 March 2026 Controller: AGL Consult Com.V

1. Who is responsible for your data?

AGL Consult Com.V Coebergerstraat 27 2000 Antwerp, Belgium VAT: BE0650532478 E-mail: privacy@ailiteracy-certification.eu

AGL Consult Com.V (hereinafter "we", "us" or "the platform") is the data controller for the personal data processed through the AI Literacy Certification platform at ailiteracy-certification.eu.

2. What data do we process?

Depending on your role on the platform, we process the following categories of personal data:

Organisation administrators (admins)

Name and e-mail address
Company name, VAT number and billing address
Subscription data (plan, start date, expiry date)
Action log (who changed what and when)

Employees (end users)

Name, e-mail address and department
Course progress (which lessons have been completed)
Exam results (score, date, pass/fail status)
Certificate number and issue date

Website visitors

Technical data via Supabase and Vercel: IP address (in server logs), timestamp

What we do not process We do not process special categories of personal data (such as health data or political opinions). Payment card numbers are processed exclusively by Stripe and are never stored by us.

3. Why do we process your data?

Purpose	Legal basis
Delivery of the platform and learning journey	Performance of a contract (Art. 6.1.b GDPR)
Creating and managing user accounts	Performance of a contract (Art. 6.1.b GDPR)
Invoicing and accounting	Legal obligation (Art. 6.1.c GDPR)
Issuing certificates as proof of AI literacy	Performance of a contract (Art. 6.1.b GDPR)
Platform security and fraud prevention	Legitimate interest (Art. 6.1.f GDPR)
Customer support and communication	Legitimate interest (Art. 6.1.f GDPR)

We never process your data for marketing purposes without your prior consent.

4. How long do we retain your data?

Category	Retention period
User accounts and learning data	For the duration of the active subscription, plus a maximum of 2 years after termination (compliance evidence under the EU AI Act)
Certificates	5 years after issue
Invoice and accounting data	7 years (Belgian accounting legislation)
Action logs	1 year
Server logs	30 days

Upon expiry of the retention period, data is permanently deleted or anonymised.

5. With whom do we share your data?

We share your data exclusively with processors acting on our behalf, with whom we have entered into a data processing agreement:

Processor	Role	Location
Supabase Ireland Ltd	Authentication and database	EU — servers in Frankfurt (DE)
Stripe Payments Europe Ltd	Payment processing	EU
Brevo SAS (Sendinblue)	Transactional e-mail	EU — servers in Paris (FR)
Vercel Inc.	Hosting platform	EU — servers in Frankfurt (DE) via AWS

All processors are established in the European Economic Area or provide appropriate safeguards (such as Standard Contractual Clauses) for any transfer outside the EEA. We never sell your data to third parties.

6. Processor vs. controller

For organisations using the platform: the organisation is the data controller for the personal data of its employees. AGL Consult Com.V acts as processor in that context. The rights and obligations in that relationship are set out in the separate Data Processing Agreement (DPA), available at ailiteracy-certification.eu/dpa.

7. Your rights

As a data subject, you have the following rights under the General Data Protection Regulation (GDPR):

Right of access (Art. 15) — You may request details of the personal data we hold about you.
Right to rectification (Art. 16) — You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17) — You may request deletion of your data, to the extent we are not legally required to retain it.
Right to restriction of processing (Art. 18) — In certain cases, you may request that processing be temporarily restricted.
Right to data portability (Art. 20) — You may request your data in a structured, machine-readable format.
Right to object (Art. 21) — You may object to processing based on legitimate interest.

How to submit a request? Send an e-mail to privacy@ailiteracy-certification.eu stating your name and e-mail address. We will handle your request within 30 days. We may ask you to confirm your identity to protect your data.

8. Cookies

The platform uses only strictly necessary cookies for authentication via Supabase (session cookies, valid for 7 days). These cookies do not require consent as they are essential for the operation of the platform.

We currently do not use analytical or marketing cookies. Should this change in the future, we will inform you and request your consent where required.

9. Security

We take appropriate technical and organisational measures to protect your data:

Encrypted connections (HTTPS) required on all pages
Authentication via magic link — no passwords stored
Row Level Security in the database: users can only see data from their own organisation
Hosting within the European Union (Frankfurt)

10. Changes to this privacy policy

We may update this privacy policy from time to time. The date at the top of this document indicates when the latest version took effect. In the event of significant changes, we will notify active users by e-mail.

11. Lodging a complaint

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Belgian supervisory authority:

Gegevensbeschermingsautoriteit (GBA) — Data Protection Authority Rue de la Presse 35 — 1000 Brussels www.dataprotectionauthority.be contact@apd-gba.be

This privacy policy applies to all services offered via ailiteracy-certification.eu. For questions, please contact us at privacy@ailiteracy-certification.eu.