This policy explains how Cryptaguard SRL (Fazantenlaan 9, 1600 Sint-Pieters-Leeuw, Belgium, BE 1007.610.660), the controller, processes personal data on regulation-cra.eu. Contact: info@regulation-cra.eu.
In short: you can read everything on this site without an account and without any tracking. We do not use advertising or third-party trackers. Audience measurement runs on our own server and only if you accept it. An account (email address only) is needed solely to save course progress, assessment results and certificates.
What we process, why and how long
| Data | Purpose | Legal basis | Retention (proposed — to be validated) |
|---|---|---|---|
| Email address, account identifier, role, interface language | Sign-in by one-time code; your learning space | Contract (providing the service you request) | While the account exists. An account whose address was never confirmed (code requested but never entered) is deleted after 30 days. After 3 years without sign-in, we email you a notice; without a sign-in within 30 days, the account and its learning data are deleted |
| Sign-in codes and sessions | Secure sign-in | Contract; security | Codes expire after 10 minutes; sessions end after 30 days, or 14 days without activity |
| Course enrolment, lessons completed, assessment attempts and answers, scores | Training, server-side grading, certificate eligibility | Contract | While the account exists |
| Certificate (name you choose to display, course, version, date, identifier, status) | Issue and allow verification of your certificate | Contract; legitimate interest in preventing fraud | 10 years after issue, unless you ask for deletion — a deleted certificate can no longer be verified |
| Transactional email records (status, provider message id, a one-way hash of the address — never the code or content) | Deliver sign-in codes and learning emails; detect failures | Contract; legitimate interest | 12 months |
| Audience measurement (pseudonymous visitor id in a cookie, pages viewed, selected events such as a download, campaign parameters, approximate referrer site, page loading and responsiveness timings — “Core Web Vitals”) | Understand which content is useful | Consent (only if you accept) | Events 13 months; cookie 6 months |
| Consent choices (choice, policy version, date, pseudonymous identifier) | Prove and respect your choice | Legal obligation | 13 months |
| Web server logs (IP address, date, requested address, browser) | Security, abuse prevention, troubleshooting | Legitimate interest | 14 days |
| Security and administration log (actions such as role changes, certificate issue or revocation — never codes, tokens or full email addresses) | Accountability and security | Legitimate interest | 12 months |
| Purchases of paid courses (course, date, amount and currency, Stripe payment and checkout identifiers, your request for immediate access and acknowledgement of the loss of the right of withdrawal, terms version) | Provide the course you bought; prove the consent given; accounting | Contract; legal obligation (accounting) | While the account exists; payment records are also kept by Stripe and in our accounts for the period required by accounting law [to be confirmed by the publisher] |
| Encrypted backups of the application database (all of the above account and learning data) | Restore the service after an incident | Legitimate interest; security | 35 days, then overwritten |
We do not record the words you type in the search box or your answers in the applicability checklist; the checklist runs in your browser and nothing you select is sent to us.
Providers (processors)
| Provider | Role | Location |
|---|---|---|
| OVHcloud | Server hosting the website | Server located in Germany |
| Convex, Inc. | Application database and server functions | Deployment in the AWS eu-west-1 region (Ireland) |
| Resend | Sending transactional emails | [To be confirmed by the publisher] |
| Stripe (Stripe Payments Europe, Limited) | Payment of paid courses on Stripe's hosted payment page; card details are entered on Stripe's page and never reach us | Ireland; [transfers outside the EEA and Stripe's own role as controller for some processing — to be completed by the publisher] |
Some providers are companies established outside the European Economic Area. Where personal data may be accessed from outside the EEA, the transfer relies on the safeguards stated in each provider's data processing agreement. [To be completed by the publisher: the specific safeguard for each provider — for example an adequacy decision such as the EU–US Data Privacy Framework, or Standard Contractual Clauses.]
We do not sell personal data and do not use it for advertising. We do not send newsletters; any future newsletter will require separate, explicit consent.
Cookies
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
__Host-cra_at, __Host-cra_rt | Keep you signed in (HttpOnly, Secure) | Strictly necessary — only after you sign in | 30 days |
cra_consent | Remember your cookie choice | Strictly necessary | 6 months |
cra_vid | Pseudonymous audience measurement on our own server | Optional — only after you accept | 6 months |
You can change your choice at any time with “Cookie preferences” at the bottom of every page. Refusing has no effect on access to the content.
Your rights
You may request access, rectification, erasure, restriction, portability of your data, object to processing based on legitimate interest, and withdraw consent at any time (without affecting earlier processing). Write to info@regulation-cra.eu; we answer within one month. From your learning space you can also export your data and ask for your account to be deleted.
Deleting an account removes or anonymises it in the live systems promptly; copies in backups disappear when those backups expire. [Backup retention period to be confirmed by the publisher.]
You may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be — or with the authority of your place of residence.
Changes
We will update this policy when processing changes and show the date of the last update at the top of the page.