Privacy Policy (GDPR)
AquaExposure places the utmost importance on protecting your privacy and personal data. This policy details how we process your information in accordance with the General Data Protection Regulation (GDPR) and the Belgian law of July 30, 2018.
1. Data Controller
The data controller is:
AquaExposure
[ADRESSE_COMPLETE]
Email: [email protected]
2. Data Collected
We only collect data necessary for the purposes pursued:
- Identification: Name, first name, email address, profile picture (if provided via OAuth).
- Learning Data (LMS): Progress in courses, completed lessons, quizzes. Collection of connection logs is necessary for contract execution and pedagogical improvement.
- Payments: Purchase history. Transactions are managed by certified providers (Stripe/PayPal). AquaExposure does not store any complete banking data.
- Technical: IP address, browser type, connection data.
3. Legal Bases and Purposes
Contract execution
Managing your account, access to courses, provision of ordered services.
Consent
Sending newsletters, use of non-essential cookies (Marketing/Analytics).
Legal obligation
Invoicing, retention of accounting documents (7 years in Belgium).
Legitimate interest
Platform security, fraud prevention (account sharing), experience improvement.
4. Cookies
- Essential cookies: Placed without consent as they are necessary for technical operation and security.
- Marketing/analytics cookies: Require your prior consent (Opt-in) via the dedicated banner.
5. Sub-processors and Transfers Outside the EU
AquaExposure uses technical service providers (sub-processors within the meaning of Art. 28 GDPR) to ensure the platform's operation. These sub-processors are bound by Data Processing Agreements (DPA) compliant with the GDPR.
Some providers are established in the United States. Data transfers to these countries are governed by Standard Contractual Clauses (SCC) approved by the European Commission, in accordance with Articles 46 and 47 of the GDPR and the EU-US adequacy decision (Data Privacy Framework, decision of July 10, 2023).
| Sub-processor | Role | Country | Transfer guarantee |
|---|---|---|---|
| Vercel Inc. | Web hosting | USA (EU servers available) | CCT + DPA |
| Neon Inc. | Database | USA (EU Frankfurt servers) | CCT + EU servers |
| Cloudflare Inc. (R2) | Media and photo storage | USA | CCT + DPA |
| Stripe Inc. | Online payments | USA (EU entity: Stripe Payments Europe) | CCT + DPA |
| Resend Inc. | Transactional emails | USA | CCT |
| Google LLC (Gemma API) | Automated content translations | USA | CCT + Google Cloud DPA |
| PostHog / Plausible | Anonymized analytics | UE | Intra-UE |
5.5 Minimum Age and Protection of Minors
In accordance with Article 8 of the GDPR and the Belgian law of July 30, 2018, the use of AquaExposure services is reserved for persons aged at least 13 years. Below this age, the consent of a holder of parental authority is required.
AquaExposure does not knowingly collect personal data from persons under 13 years of age. If you become aware that a child under 13 has created an account on our platform, please contact us at [email protected] so that we can delete this data.
5.8 Personal Data Breaches
In the event of a personal data breach likely to pose a risk to your rights and freedoms, AquaExposure commits to:
- Notifying the Belgian Data Protection Authority (DPA) within 72 hours of becoming aware (Art. 33 GDPR).
- Informing you personally, without undue delay, if the breach is likely to result in a high risk to your rights (Art. 34 GDPR).
For any questions regarding the security of your data: [email protected]
6. Your Rights
In accordance with the GDPR, you have the following rights:
- Right of access: Obtain a copy of your data.
- Right of rectification: Correct inaccurate data.
- Right to erasure: Request deletion of your account.
- Right to portability: Receive your data in a structured format.
- Right to object: Refuse processing for marketing purposes.
To exercise these rights, contact us by email at [email protected]. A response will be provided within 30 days.
Privacy Questions
How can I delete my data?
In accordance with the GDPR, you can request the deletion of your account and all your personal data by contacting us by email. We will process your request within 30 days.
Is my data shared with third parties?
We never sell your data. It is only shared with our technical sub-processors listed in section 5, bound by Data Processing Agreements (DPA) and Standard Contractual Clauses (SCC) compliant with the GDPR. No data is transferred for commercial purposes.