Privacy Policy (GDPR)

AquaExposure places the utmost importance on protecting your privacy and personal data. This policy details how we process your information in accordance with the General Data Protection Regulation (GDPR) and the Belgian law of July 30, 2018.

1. Data Controller

The data controller is:
AquaExposure
[ADRESSE_COMPLETE]
Email: [email protected]

2. Data Collected

We only collect data necessary for the purposes pursued:

Identification: Name, first name, email address, profile picture (if provided via OAuth).
Learning Data (LMS): Progress in courses, completed lessons, quizzes. Collection of connection logs is necessary for contract execution and pedagogical improvement.
Payments: Purchase history. Transactions are managed by certified providers (Stripe/PayPal). AquaExposure does not store any complete banking data.
Technical: IP address, browser type, connection data.

3. Legal Bases and Purposes

Contract execution

Managing your account, access to courses, provision of ordered services.

Consent

Sending newsletters, use of non-essential cookies (Marketing/Analytics).

Legal obligation

Invoicing, retention of accounting documents (7 years in Belgium).

5. Sub-processors and Transfers Outside the EU

AquaExposure uses technical service providers (sub-processors within the meaning of Art. 28 GDPR) to ensure the platform's operation. These sub-processors are bound by Data Processing Agreements (DPA) compliant with the GDPR.

Some providers are established in the United States. Data transfers to these countries are governed by Standard Contractual Clauses (SCC) approved by the European Commission, in accordance with Articles 46 and 47 of the GDPR and the EU-US adequacy decision (Data Privacy Framework, decision of July 10, 2023).

Sub-processor	Role	Country	Transfer guarantee
Vercel Inc.	Web hosting	USA (EU servers available)	CCT + DPA
Neon Inc.	Database	USA (EU Frankfurt servers)	CCT + EU servers
Cloudflare Inc. (R2)	Media and photo storage	USA	CCT + DPA
Stripe Inc.

5.5 Minimum Age and Protection of Minors

In accordance with Article 8 of the GDPR and the Belgian law of July 30, 2018, the use of AquaExposure services is reserved for persons aged at least 13 years. Below this age, the consent of a holder of parental authority is required.

AquaExposure does not knowingly collect personal data from persons under 13 years of age. If you become aware that a child under 13 has created an account on our platform, please contact us at [email protected] so that we can delete this data.

5.8 Personal Data Breaches

In the event of a personal data breach likely to pose a risk to your rights and freedoms, AquaExposure commits to:

Notifying the Belgian Data Protection Authority (DPA) within 72 hours of becoming aware (Art. 33 GDPR).
Informing you personally, without undue delay, if the breach is likely to result in a high risk to your rights (Art. 34 GDPR).

For any questions regarding the security of your data: [email protected]

6. Your Rights

In accordance with the GDPR, you have the following rights:

Right of access: Obtain a copy of your data.
Right of rectification: Correct inaccurate data.
Right to erasure: Request deletion of your account.
Right to portability: Receive your data in a structured format.
Right to object: Refuse processing for marketing purposes.

To exercise these rights, contact us by email at [email protected]. A response will be provided within 30 days.

Privacy Questions

How can I delete my data?

In accordance with the GDPR, you can request the deletion of your account and all your personal data by contacting us by email. We will process your request within 30 days.

Is my data shared with third parties?

We never sell your data. It is only shared with our technical sub-processors listed in section 5, bound by Data Processing Agreements (DPA) and Standard Contractual Clauses (SCC) compliant with the GDPR. No data is transferred for commercial purposes.