Privacy policy
Processing of personal data under the GDPR
1 Controller
The controller under the GDPR is Jordi Bravo, 8, Rue de Stavelot, L-2553 Luxembourg. Data protection enquiries: kontakt@fspreif.com.
2 Account and usage
An account requires an email address and account data to be processed. The basis is performance of the usage contract.
3 Voice recordings
Consent is obtained before the first voice block. The transcript is stored because the assessment report draws its evidence from it. The audio file is deleted automatically after 30 days by default; longer storage is only possible with express consent and can be revoked at any time.
4 Processors
We use OpenAI for language models, speech recognition and speech synthesis, Cloudflare for hosting and delivery, Neon for the database inside the EU, Stripe for payment processing and the platform's mail service for email. Data processing agreements are in place with each of them; transfers to third countries rely on the European Commission's standard contractual clauses.
5 Retention
Audio for 30 days unless expressly requested otherwise. Transcripts and reports until the account is deleted. Invoice data for the statutory retention periods.
6 Your rights
Access, rectification, erasure, restriction, portability and objection. Export and full account deletion are additionally available directly in settings.
7 Right to complain
The competent supervisory authority is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg. You may also contact the supervisory authority where you live.
8 Analytics and cookies
We use necessary sign-in and security cookies. fsp_consent stores your choice for 12 months; you can change it in the footer. Meta Pixel and our visit analytics activate only after consent. _fbp and _fbc match activity to ads. Our fsp_ft cookie stores the first and latest consented visit for 12 months: landing path, referrer host, UTM parameters, gclid, fbclid, gbraid and timestamp. The first measured arrival is the page where you first consent. We copy this attribution to contact and order records, and selected ft_ fields to Stripe Checkout and PaymentIntent. On withdrawal we delete fsp_ft and attribution from open orders and active contacts; paid orders follow statutory retention.
9 Meta Conversions API
With your consent (GDPR Article 6(1)(a)), we also send requested test reports (event Lead), checkout starts and confirmed purchases from our server to Meta Platforms Ireland Limited: order or report reference for deduplication, value and currency for checkouts and purchases, available _fbp/_fbc, IP address, browser user agent and, when available, your SHA-256 hashed email. A hash remains personal data. Consent at checkout is stored for payment confirmation. Withdrawal on this site also stops transmission for associated pending orders. It cannot recall data already sent. Meta may process data in the USA; see https://www.facebook.com/privacy/policy/.
10 Reach measurement / cookies
Historical measurement records are not automatically deleted. Access, objection and deletion requests: kontakt@fspreif.com. Account deactivation ends sign-in; deletion and legally required retention of records are reviewed separately.
11 Email offers
You can choose to receive FSPreif offers and news by email through an initially unticked checkbox at the free test, account signup, contact form and checkout. We store your choice, the wording version and the time. Your result, reply or access arrives without this choice. Checkout also shows a notice about offers for similar courses; its version and time are stored with the order. After a free test, an account or a started purchase we send you a few emails about the course, and every email has an unsubscribe link that works with one click. Analytics cookie consent is separate.