Privacy policy

This policy explains what personal data this website (flexskill.education) collects, why, and what rights you have. The website is run by the company named at the end of this page, which is the controller of the personal data described here. You can contact us about anything in this policy at the email address shown there.

In short

• You can read the whole website without giving us anything. We collect personal data only when you send an enquiry, create an account or sign in, or agree to analytics.

• We do not sell personal data, show advertising, or use your data to make automated decisions about you.

• Analytics runs only if you agree to it, and you can change your mind at any time.

Enquiries sent through this website

The contact page has a short enquiry form. When you send it, we receive your name, your email address, your message, the course and course date you chose (if you chose one), and which language version of the website you were using. We use them to reply to you and to discuss the course you asked about. A copy of each enquiry is also emailed to the website's administrators, so that we see it straight away.

Your name, email address and message are required, because without them we cannot reply. We do not record your IP address or any other details of your device with the enquiry.

Legal basis: where you are asking about taking part in a course, we process your enquiry to take steps you asked for before a possible contract (GDPR Art. 6(1)(b)). Otherwise we rely on our legitimate interest in answering people who write to us (Art. 6(1)(f)).

How long: we keep an enquiry until we have answered it and any discussion about a course that follows from it has ended, and then delete it. You can ask us to delete it sooner.

The full enquiry form on Typeform

The contact page also links to a longer form hosted by Typeform. If you open it, you leave this website. That form asks for your role, the courses you are interested in, how many people from your school may attend, the name and location of your school or organisation, your full name, your work email address, a phone or WhatsApp number, and how you plan to fund the training.

Typeform S.L. (Barcelona, Spain) stores your answers for us as our processor. We use and keep them in the same way, and on the same legal basis, as enquiries sent through this website. Typeform's own pages set their own cookies, which Typeform's notices on those pages explain.

Accounts and signing in

You can create an account with your email address and a password. At present an account lets you sign in and nothing more: no part of the public website requires one. Our staff use the same sign-in to manage the website.

For an account we hold your email address, your role on the website, when the account was created and when it was last used to sign in. Your password is stored by Google's Firebase Authentication service only as a hash, a one-way scrambled form that we cannot read. To protect sign-in from abuse, Firebase Authentication also processes your IP address and browser details and keeps them for a few weeks.

When you sign in, the website sets a cookie that keeps you signed in for up to five days. The cookie policy describes it.

Legal basis: providing the account you asked for (Art. 6(1)(b)). An email address and a password are required to create one.

How long: we keep your account until you ask us to delete it, or until we close it. After deletion, Google removes the account data from its live and backup systems within 180 days. We also keep a record that the account was created (its internal ID and the time) in the website's security log. Once the account is deleted, that ID no longer leads to you.

Protecting the website from abuse

To limit how many enquiries, sign-ins and new accounts can be sent from one connection, we keep short-lived counters. A counter is stored against a one-way hash of your IP address rather than the address itself, is not linked to your enquiry or account, and is deleted automatically within two days.

Like any website, ours is hosted on servers that record technical logs of requests: the IP address, browser details, the address requested, the time and the result. We use them to keep the website running and secure, and they are deleted after 30 days.

Legal basis: our legitimate interest in keeping the website available and secure (Art. 6(1)(f)).

Analytics, only with your consent

If you agree to analytics in the cookie banner or in the cookie settings, the website loads Google Analytics, provided by Google Ireland Limited. It records which pages you view and their titles, your approximate location (country and city, derived from your IP address), the type of device and browser you use, and a random identifier stored in a cookie on your device. For visitors in the EU, Google discards the IP address once it has derived the approximate location.

We have switched off Google signals and ad personalisation, so this data is not combined with your Google account and is not used for advertising. If you do not agree, Google Analytics is not loaded at all.

Legal basis: your consent (Art. 6(1)(a), and for the cookies § 109(8) of the Slovak Electronic Communications Act, No. 452/2021 Coll.). You can withdraw it at any time through "Cookie settings" at the foot of every page. Withdrawing does not affect measurement made before you withdrew.

How long: Google keeps individual measurement events for 2 months, and data linked to the analytics identifier for 14 months. After that only aggregated statistics remain, which identify nobody.

Your cookie choice

When you answer the cookie banner, your choice is stored in a cookie on your device for six months. It is not sent to our server.

Who processes your data for us

• Google, through Firebase and Google Cloud, hosts the website, its database and its logs. The website runs in the Netherlands and the database is stored in the EU. Firebase Authentication, which handles accounts and passwords, runs in the United States.

• Google Ireland Limited provides Google Analytics, if you agree to it.

• Typeform S.L. hosts the full enquiry form.

• Google, through Google Workspace, provides the email account that sends these copies.

These providers process personal data on our behalf as our processors. We do not sell or rent personal data, and we do not share it with anyone else unless the law requires us to.

Transfers outside the EU

Firebase Authentication processes account data in the United States, and Google may also process analytics data and our email there. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has decided that it provides an adequate level of protection (Commission Implementing Decision (EU) 2023/1795). Where the framework does not apply, Google's data processing terms add standard contractual clauses.

Your rights

You can ask us for:

• a copy of the personal data we hold about you (access);

• correction of anything that is inaccurate (rectification);

• deletion (erasure), for example of an enquiry or an account;

• restriction of processing, for example while we consider an objection;

• your data in a portable, machine-readable form, where we process it on the basis of a contract or your consent.

You can object at any time to processing based on our legitimate interests, such as answering an enquiry or keeping security logs, on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

Where processing is based on your consent, you can withdraw it at any time. For analytics, use "Cookie settings".

Write to the email address at the end of this page. We will reply within one month. If a request is complex we may extend that by up to two further months, and will tell you why within the first month. If we cannot otherwise be sure a request comes from you, we may ask you to confirm your identity.

If you think we have handled your data unlawfully, you can complain to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk), or to the data protection authority where you live or work.

Other things to know

• We make no automated decisions about you and do no profiling.

• The website is meant for adults who work in education and is not directed at children.

• Links to other websites, such as our social media profiles, take you to services with their own privacy policies.

We update this policy when the website changes what it collects. The date below shows the current version.

Last updated: 1 October 2026.