Loading
Please wait...
Please wait...
This notice explains how personal data is processed when you use our website or contact us. Cookiebot records and applies the consent choices available on this site.
Until incorporation of a separate legal entity, the controller is the natural person above operating under the trade name "Governance School".
We process details that you actively provide and, after your consent, limited website analytics and sales-intent data:
We use Cookiebot (by Usercentrics A/S, Denmark) as a consent management platform to control cookies and trackers on our website in compliance with GDPR requirements.
Analytics and sales-intent services
With your consent, we use Google Analytics and Google Tag Manager for statistics, Apollo website visitor tracking for marketing, and Apollo form enrichment on public forms. Apollo may identify visiting companies globally and business contacts only for visitors in the United States. When you submit a public form after granting marketing consent, Apollo may receive the business email you entered and enrich or save the business contact under our configured limits. Apollo loads only after marketing consent and never on protected account, learner, manager, or owner pages.
Consent Management
Your consent preferences are stored securely for as long as we rely on your consent for processing. You can change or withdraw your consent at any time using the cookie settings.
Contact Data Processing
We process your data to respond to your enquiry and manage related correspondence. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) or Art. 6(1)(f) GDPR (legitimate interest).
Analytics and sales-intent processing
When you consent, we process data to understand website performance and to identify business interest in our public product, course, pricing, and consulting pages. Legal basis: Art. 6(1)(a) GDPR (consent). Without consent, Apollo and optional Google analytics or advertising tags remain disabled. Necessary hosting and security logs are processed under Art. 6(1)(f) GDPR (legitimate interest).
We use the following service providers under GDPR-compliant data processing terms:
Brevo (Sendinblue SAS)
SMTP relay for contact form submissions (email delivery platform based in Paris, France).
Google Ireland Limited / Google LLC
Analytics and Tag Manager services (only when you consent to statistics/marketing cookies; operates through Google Consent Mode).
Apollo.io (ZenLeads, Inc., United States)
Website visitor analytics, B2B sales-intent identification, and enrichment of public business-contact forms. After marketing consent, Apollo may receive a pseudonymous identifier, IP address, sanitized public page URL, limited referrer or campaign data, and the business email submitted through a public form. Contact-level visitor identification is enabled only for United States visitors. Form enrichment is restricted to company email addresses; phone enrichment, automatic field filling, and field hiding are disabled.
International Transfers: Where data is transferred to the United States, including to Apollo, Google LLC, or Vercel, transfers rely on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as applicable.
Where enabled for an assigned course, Course Tutor is an AI learning assistant. It explains the course and approved supporting sources; it does not provide legal advice or assess a specific organisation or compliance case.
What is processed
The question, up to three current-page conversation turns, selected language, minimum course context, approved evidence passages and generated answer are processed only to provide the response. Learners should not enter personal, confidential or case-specific information.
What we retain
We do not store questions, answers, conversation history, source passages, access links or tokens. We retain only a pseudonymous learner-course usage counter and minimum timestamps needed to enforce the course allowance. Short-lived, content-free request reservations prevent duplicate counting and are removed within 24 hours.
AI provider and location
The beta uses Mistral AI only through its EU regional stateless chat-completions endpoint, subject to approved Zero Data Retention and contractual review. Mistral does not receive the learner's name, email address, access token, invitation ID, employee ID, company ID or assignment ID. EU regional inference and Zero Data Retention do not necessarily apply to all provider control-plane metadata; the applicable safeguards and subprocessor information are documented before activation.
Employer access
Managers and customer administrators cannot access a learner's Tutor question or answer. Individual usage counts are not shown in employer dashboards.
Contact Enquiries
We retain contact data only as long as necessary to answer your enquiry, manage relevant business follow-up, and comply with statutory retention duties (e.g., German commercial and tax law). Withdrawing marketing consent stops future Apollo enrichment; you may also request deletion under the rights below.
Consent Records
Stored for as long as we rely on your consent for processing, to demonstrate compliance with data protection regulations.
You have the rights of access, rectification, erasure, restriction, portability, and objection (Arts. 15–21 GDPR). You can change your cookie consent at any time. You also have the right to lodge a complaint with a supervisory authority.
Competent authority in Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin — datenschutz-berlin.de
We use TLS/SSL encryption for transport and secure email transmission via Brevo SMTP. Cookiebot processes consent data in secure EU-based data centers. Access to all systems is restricted to authorized personnel only.
We may update this notice to reflect changes in our processing. The latest version is always available on this page.
Last updated: 05 September 2026