GDPR Compliance

Last Updated: November 2, 2026

Cypress-zone is committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR). This page explains how we handle your personal data in accordance with GDPR requirements.

Legal Basis for Processing

We process your personal data under the following legal bases:

Consent: When you enroll in our programs or subscribe to communications
Contract Performance: To deliver training services you have purchased
Legitimate Interests: To improve our services and communicate relevant information
Legal Obligation: To comply with applicable laws and regulations

Your Rights Under GDPR

As a data subject, you have the following rights:

Right to Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of your personal data in certain circumstances
Right to Restriction: Request limitation of how we process your data
Right to Data Portability: Receive your data in a structured, commonly used format
Right to Object: Object to processing based on legitimate interests or for direct marketing
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

Data Protection Officer

For questions regarding data protection or to exercise your rights, please contact us at [email protected].

Data Processing Activities

We process personal data for the following purposes:

Enrollment and program administration
Communication regarding training programs
Payment processing through secure third-party processors
Website analytics and improvement
Marketing communications (with your consent)

Data Retention Periods

We retain your personal data only for as long as necessary:

Active participant data: Duration of program plus 2 years for support purposes
Marketing consents: Until you withdraw consent or 3 years of inactivity
Financial records: 7 years as required by law
Website analytics: 26 months

International Data Transfers

When we transfer data outside the European Economic Area, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of data in transit and at rest
Regular security assessments and updates
Access controls and authentication mechanisms
Employee training on data protection

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.

Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR.

Exercising Your Rights

To exercise any of your rights under GDPR, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by two additional months in complex cases.