Privacy Statement

1. Who we are

LurnR is a sole proprietorship under French law (entrepreneur individuel), established in France and registered under SIREN 885 206 581 (SIRET 885 206 581 00021), and is the data controller for your personal data.

Trade name: LurnR
Address: 14 Route d'Autun, 71540 Lucenay-l'Évêque, France
Email: [email protected]
Telephone: +31 970 1028 9784
VAT number: TVA non applicable (art. 293B CGI)

2. What data we collect

2.1 Data you provide yourself

• Contact form: name, email address, telephone number, message text
• Appointments (LurnR Agenda, agenda.lurnr.eu): name, email address, preferred date/time
• E-learning account: name, email address, password (hashed)
• Payments (Stripe): billing name, email address (card details are processed by Stripe, not by us)

2.2 Automatically collected data

• IP address and browser information (via web server logs, retained for a maximum of 30 days)
• Page visits and click behaviour (if analytics cookies have been accepted)
• Device type and operating system

2.3 Data of minors

Our services are not directed at persons under the age of 16. We do not knowingly collect personal data from minors. If you suspect that we have collected data from a minor, please contact us.

3. Why we process your data

• Handling contact requests and quotation requests
• Scheduling and delivering coaching and training sessions
• Providing e-learning courses and the associated certificates
• Processing payments and issuing invoices
• Providing access to AI tools (MeetFlow™, ValeriaOS™)
• Improving our website and services (analytics)
• Sending newsletters (only with explicit consent)
• Complying with legal obligations (tax, accounting)

4. Legal basis for processing

We process your personal data exclusively on the basis of one or more of the following legal bases:

• Consent (Art. 6(1)(a) GDPR): for analytics cookies and newsletters
• Performance of a contract (Art. 6(1)(b) GDPR): for coaching, training, e-learning and payments
• Legal obligation (Art. 6(1)(c) GDPR): for tax records and accounting
• Legitimate interest (Art. 6(1)(f) GDPR): for security and fraud prevention

5. How long we retain your data

• Contact form: 2 years after the last contact
• E-learning account: for as long as the account is active + 1 year after deletion
• Invoice and payment data: 7 years (statutory retention obligation)
• Appointment data (LurnR Agenda): 1 year after the appointment
• Web server logs: a maximum of 30 days
• Analytics cookie data: a maximum of 26 months (Google Analytics default)

Once these periods have expired, your data will be securely deleted or anonymised.

6. Sharing with third parties

We never sell your personal data to third parties. We share data exclusively with:

• Stripe Inc. — for payment processing (US, EU–US standard contractual clauses)
• LurnR Agenda (agenda.lurnr.eu) — for appointment scheduling; LurnR's own service (not a third party), this privacy policy applies
• OpenAI — for AI functionality (ValeriaOS™) — anonymised session data
• Google LLC — for analytics purposes (if consent has been given)
• Hosting and infrastructure partners — for running our services (Railway, Cloudflare)

Data processing agreements pursuant to Art. 28 GDPR have been concluded with all processors.

7. Cookies and tracking

Our website uses cookies. You can set your preferences via the cookie banner on our website.

7.1 Necessary cookies

These cookies are required for the website to function (session, CSRF protection, cookie preferences). They cannot be disabled.

7.2 Analytics cookies

Placed only after you have given your consent. We use Google Analytics 4 to gain insight into website usage. IP addresses are anonymised. You can withdraw your consent at any time via "Cookie settings" in the footer.

7.3 Marketing cookies

Placed only after you have given your explicit consent. We may use Meta Pixel and LinkedIn Insight Tag for remarketing purposes.

8. Your rights

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR): you can request which of your data we process
• Right to rectification (Art. 16 GDPR): you can have inaccurate data corrected
• Right to be forgotten (Art. 17 GDPR): you can request the erasure of your data
• Right to restriction (Art. 18 GDPR): you can have processing temporarily restricted
• Right to data portability (Art. 20 GDPR): you can request your data in a readable format
• Right to object (Art. 21 GDPR): you can object to processing based on legitimate interest
• Right to withdraw consent (Art. 7 GDPR): you can withdraw your consent at any time

To exercise your rights, you can contact us via [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL, www.cnil.fr), the French data protection authority, or with the supervisory authority of your own EU member state.

9. Security

We take appropriate technical and organisational measures to protect your personal data:

• All connections are secured with TLS 1.3 encryption (HTTPS)
• Passwords are stored as bcrypt hashes (never in plaintext)
• Access to systems is restricted to authorised personnel and secured with 2FA
• Regular security audits and dependency updates
• Payments are processed exclusively via PCI DSS-certified parties (Stripe)

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will report it to the CNIL and inform you in accordance with Art. 33–34 GDPR.

10. Changes to this privacy policy

We reserve the right to amend this privacy policy. Changes will be published on this page, stating the effective date. In the event of significant changes, you will be notified by email.

11. Contact

Do you have questions about this privacy policy or about the processing of your personal data? Please contact us: