Privacy Policy — CDSA Academy

1. Data Controller

Clinical Data Science Academy (CDSA)
Brussels, Belgium
Data Protection Officer: dpo@cdsa-academy.com

2. Legal Framework

This Privacy Policy complies with:

General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679
Belgian Data Protection Act — Law of 30 July 2018
ePrivacy Directive — Directive 2002/58/EC (cookie consent)

The Belgian Data Protection Authority (GBA/APD) is the supervisory authority for our data processing activities.

3. What Data We Collect

3.1 Course Registration

When you register for a course, we collect:

Full name, email address
Professional information (company, designation) or academic information (university, field of study)
Learning goals and background description
Coupon codes used

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)

3.2 Contact Form

When you submit a contact inquiry:

Full name, email, workplace, phone number
Areas of interest and message content

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)

3.3 Newsletter

When you subscribe to our newsletter:

Email address

Legal basis: Consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time.

3.4 Chatbot

When you use our chatbot, we may collect:

Name, email, phone (only if you voluntarily provide them)
Message content

Legal basis: Consent (Art. 6(1)(a) GDPR)

4. Data Retention

We retain personal data for the following periods:

Data Category	Retention Period
Registration data	730 days (approx. 2 years) after course completion
Contact submissions	1 year after inquiry resolution
Newsletter subscribers	Until unsubscription or deletion request
Chatbot leads	6 months
Audit logs	3 years (legal obligation)

5. Your Rights (GDPR Articles 15-22)

Under GDPR, you have the following rights:

Right of access (Art. 15) — Request a copy of your personal data
Right to rectification (Art. 16) — Correct inaccurate data
Right to erasure (Art. 17) — Request deletion of your data ("right to be forgotten")
Right to restrict processing (Art. 18) — Limit how we use your data
Right to data portability (Art. 20) — Receive your data in a structured format
Right to object (Art. 21) — Object to processing based on legitimate interests
Right to withdraw consent — At any time, without affecting prior processing

To exercise any of these rights, contact our DPO at dpo@cdsa-academy.com or use our data deletion request form below.

6. Data Security

We implement the following security measures:

Encrypted database connections (TLS/SSL)
CSRF protection on all forms
Input sanitization and parameterized queries (SQL injection prevention)
Security headers (CSP, HSTS, X-Frame-Options)
Rate limiting on API endpoints
Audit logging of all data operations
Access control and principle of least privilege

7. International Data Transfers

Your data is processed and stored within the European Economic Area (EEA). We do not transfer personal data outside the EEA without appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

8. Data Breach Notification

In the event of a data breach that poses a risk to your rights, we will:

Notify the Belgian Data Protection Authority (GBA/APD) within 72 hours
Inform affected individuals without undue delay if the breach is high-risk

9. Cookie Policy

In compliance with the ePrivacy Directive and Belgian law, we use the following cookies:

Cookie	Type	Purpose	Duration
PHPSESSID	Essential	Session management, CSRF protection	Session
cdsa_cookie_consent	Essential	Stores your cookie preferences	1 year

We do not currently use analytics or marketing cookies. If this changes, we will update this policy and request your explicit consent.

10. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

Belgian Data Protection Authority (GBA/APD)
Rue de la Presse / Drukpersstraat 35, 1000 Brussels
contact@apd-gba.be
+32 (0)2 274 48 00

Request Data Deletion

Under GDPR Art. 17, you have the right to request erasure of your personal data. Submit a request below and we will process it within 30 days.