1. Who is the Data Controller?

2. Data Collected

Within the use of the website and our training services, we collect the following categories of personal data:

• Identity & contact: name, first name, email, phone number
• Training data: registrations, attendance, results/certificates if applicable
• Billing: postal address, VAT number (if applicable), payment details (via service provider)
• Technical data: IP address, cookie identifiers, logs, browsing data
• Submitted content: messages via forms, comments (if enabled)

3. Purposes and Legal Bases (Art. 6 GDPR)

• Respond to your requests (contact form): legitimate interest (managing communications) and/or pre-contractual measures
• Manage registrations and provide training (learner account creation, invitations, follow-up): performance of a contract
• Billing & compliance with tax/accounting obligations: legal obligation
• Send training-related information (reminders, practical details): performance of a contract/legitimate interest
• Prospection/Newsletter (if separate): consent (withdrawable at any time)
• Improve the website & measure audience: consent for non-essential cookies (see § Cookies)
• Website security & fraud prevention: legitimate interest

4. Cookies and Trackers

We use:

• Strictly necessary cookies (site operation, security, session management) – exempt from consent
• Analytics cookies (Google Analytics 4) – subject to prior consent
• Functional cookies (preferences) – consent required if not strictly necessary
• Marketing cookies (if used) – subject to prior consent

On your first visit, a banner allows you to accept, refuse or set your cookie preferences. You may withdraw your consent at any time via the banner (“Manage my cookies” link) or through your browser settings.

5. Recipients and Processors

We do not sell your data. We may share it, in a limited and contractually regulated manner (Art. 28 GDPR), with:

• Website hosting provider
• Emailing/newsletter tools
• Payment processors (e.g., Stripe/PayPal) – payment data processed by these providers
• Training management tools / LMS / CRM
• Consultants/experts (accounting, legal) for our legal obligations

The updated list of these processors is available upon request.

6. Transfers outside the EEA

Some providers may host or access data outside the European Economic Area. In such cases, we ensure appropriate safeguards (e.g., EU Standard Contractual Clauses) and, where necessary, additional measures. Details are available upon request.

7. Data Retention

We retain your data only for as long as necessary for the purposes described:

• Relationship & registration management: duration of the contractual relationship + 10 years
• Prospection/newsletter: until consent withdrawal or 1 year of inactivity
• Accounting/tax: supporting documents kept 10 years (Belgian law)
• Security logs: 6 months
• Cookies: depending on their purpose

Longer periods may apply in case of legal obligation or defense of legal claims.

8. Security

We implement appropriate technical and organisational measures (access control, encryption where possible, backups, logging, data minimisation) to protect the confidentiality, integrity and availability of your data (Art. 32 GDPR).

9. Your Rights (GDPR)

You have the rights of access, rectification, erasure, restriction, objection (including to direct marketing), portability, and the right to withdraw your consent at any time (without affecting prior lawful processing).

To exercise your rights: info@payrollontheground.com.
If we have reasonable doubts about your identity, we may request additional information to verify it.

10. Complaint to the Belgian Authority

If you believe that your rights are not respected, you may lodge a complaint with the Belgian Data Protection Authority (APD/GBA):
Data Protection Authority – Rue de la Presse 35, 1000 Brussels – contact@apd-gba.be – +32 (0)2 274 48 00 – Complaint form and information available on the APD website.

11. Minors

Our services are primarily intended for professional/adult audiences. If a minor registers, parental or guardian consent may be required depending on the case.

12. Automated Decision-Making

No decision producing legal effects is based solely on automated processing, including profiling. If this changes, we will specify the logic, significance and expected consequences.

13. Policy Updates

We may update this policy to reflect legal or technical changes. The current version is the one published on this page, with its last update date.