Privacy policy

1. Who we are

Project Socrates S.à r.l. ("Project Socrates", "we", "us") is the controller of the personal data processed through this website, within the meaning of the EU General Data Protection Regulation (GDPR).

Controller

Project Socrates S.à r.l., 33, Boulevard Prince Henri, L-1724 Luxembourg, R.C.S. Luxembourg B310656

Privacy contact

admin@socrateseducation.org

Data protection officer

[Not appointed, as not required for our activities. Confirm]

We apply data protection by design and by default (Article 25 GDPR): we only ask for what we need, we keep it in the European Economic Area and we delete it when it is no longer necessary.

2. What we collect and why

Consultation requests (contact form)

• Data: full name, firm, role, professional email address, preferred language and, if you choose, a short message. We also record the date and the version of the privacy notice you accepted, and a pseudonymised identifier derived from your IP address to prevent abuse. Your IP address itself is not stored.
• Purpose: to answer your request and, if you wish, to schedule a consultation or readiness diagnostic.
• Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in protecting the form against spam and misuse (Article 6(1)(f) GDPR). [Confirm legal basis: the checkbox currently reads as an acknowledgement of this policy, not as consent]

Email correspondence

• Data: your email address, the content of your messages and any information you choose to share.
• Purpose and legal basis: to reply and manage our professional relationship (Article 6(1)(b) and 6(1)(f) GDPR).

AI chatbot

• Data: the messages you type and any contact details you choose to give. You are told at the start of each conversation that you are interacting with an AI system.
• Purpose: to answer general questions about our programmes and, if you ask us to, to pass your contact details to our team.
• Legal basis: our legitimate interest in answering visitors' questions (Article 6(1)(f) GDPR) and, where you ask to be contacted, steps at your request (Article 6(1)(b) GDPR).
• Provider: [Chatbot vendor and model, data location, confirmation that conversations are not used to train the model]. More information in our AI chatbot notice.

Website analytics

• Data: information about how you use the website (pages visited, device and browser type, approximate location), collected through Google Analytics 4.
• Purpose: to understand which content is useful and improve the website.
• Legal basis: your consent (Article 6(1)(a) GDPR and the Luxembourg Law of 30 May 2005 on privacy in electronic communications). Analytics only runs after you accept it in the cookie banner, using Google Consent Mode v2, and you can withdraw your consent at any time through the cookie settings in the footer.

Technical data and security

• Data: server logs generated when you visit the website (IP address, date and time, pages requested, browser type).
• Purpose and legal basis: to operate the website securely and detect attacks (Article 6(1)(f) GDPR).

We do not use your data for marketing unless you have given separate, explicit consent, we do not sell it, and we do not make decisions about you based solely on automated processing.

3. Who receives your data

Your data is accessed only by authorised people at Project Socrates and by the following service providers, acting as processors under a data processing agreement (Article 28 GDPR):

• Website hosting: [SiteGround Spain S.L., Madrid, Spain, to confirm], servers in the European Economic Area.
• Website development and maintenance: Uncamacaro Agency (Portugal).
• Email: Google Workspace, provided by Google Ireland Limited.
• Analytics (only with your consent): Google Ireland Limited.
• AI chatbot: [vendor to confirm].

We may also disclose data where required by law or by a competent authority.

4. Transfers outside the EEA

Data collected through the contact form is stored on servers in the European Economic Area. Some providers, such as Google, may process data outside the EEA. In that case, transfers are covered by appropriate safeguards under Chapter V GDPR, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. [Confirm the providers you authorise for any transfer outside the EEA]

5. How long we keep it

6. Security

We protect your data with technical and organisational measures appropriate to the risk, including encrypted connections (TLS), encryption of contact form data at rest, two-factor authentication on administrator accounts, daily encrypted backups kept in the EEA, regular updates and restricted access.

7. Your rights

Under the GDPR, you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to its processing, including processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting processing carried out before the withdrawal.

To exercise your rights, write to admin@socrateseducation.org. We will reply within one month. You also have the right to lodge a complaint with the Luxembourg data protection authority: Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.

8. Other information

Cookies. Information on cookies and similar technologies is available in our Cookie policy.

Minors. This website is intended for professionals and is not directed at children under 16.

Changes. We may update this policy to reflect changes in our services or in the law. The date at the top of this page shows the latest version.