Flalingo Visitor Privacy Notice

This notice is provided by Global Education Technology, C-corp (“Flalingo”) as controller, in order to meet the transparency obligations set out in Article 13 of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) and comparable data protection laws in other jurisdictions.

1. Identity of the Controller

When you visit our website, your personal data is processed by Flalingo, acting as controller, to the extent described below.

2. Purposes of Processing

The personal data collected by Flalingo is processed for the following purposes as part of our corporate communication processes:

• carrying out communication activities and managing customer relationship processes,
• receiving and evaluating suggestions for the improvement of our business processes, and conducting and reviewing our business activities,
• operating information security processes, troubleshooting and ensuring the technical functioning of our services,
• following up on requests and complaints,
• conducting our activities in compliance with applicable law and providing information to competent authorities and public bodies,
• if you give your consent, carrying out advertising, campaign and promotion processes.

3. Categories of Personal Data Processed

In order to achieve the purposes set out above, we process the following categories of personal data:

• Identity data: name, surname, age and similar (for example where you complete a contact form).
• Contact data: e-mail address, mobile telephone number and similar.
• Customer transaction data: records of requests or complaints submitted to us through our communication channels and similar.
• Transaction security data: device information, IP address, operating system type, browser information, cookie and log records and similar.
• Marketing data: where you give consent, newsletter subscriptions, permissions for commercial electronic messages, campaign and preference information and similar.
• Legal process data: correspondence with judicial and administrative authorities and with competent public bodies and institutions.

4. How We Collect Your Data and the Legal Bases for Processing

Your personal data is collected through digital channels: by your completing the contact forms on our website, by your sending us an e-mail, and through automated systems such as the cookies operating on our site.

Your personal data is processed on the following legal bases:

• Compliance with a legal obligation (GDPR Art. 6(1)(c)): retention obligations under applicable legislation and the provision of information to competent authorities.
• Legitimate interests, provided that your fundamental rights and freedoms are not prejudiced (GDPR Art. 6(1)(f)): maintaining customer communication, ensuring the security of our site and of transactions, troubleshooting and improving service quality. You may object to this processing at any time as described in section 6.
• Consent (GDPR Art. 6(1)(a)): only where you have specifically given your consent, sending you commercial electronic messages for the purpose of advertising, campaigns and the promotion of our services, as well as any non-essential cookies. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Detailed information about the cookies used on our site, their purposes and how you can manage your preferences is set out in our Cookie Policy.

5. Transfers of Personal Data

Recipients: your data may be shared with our suppliers and service providers that provide data analysis, hosting, marketing and support services; with private-law professional advisers from whom we obtain services (in fields such as law, accountancy and information technology); with companies providing storage, archiving and information technology support (servers, hosting, software, cloud computing); and, upon a lawful request, with legally competent public authorities and institutions.

International transfers: your personal data may be transferred to countries other than your own, including the United States, for purposes such as customer relations and following up requests and complaints. Where personal data is transferred out of the European Economic Area, the United Kingdom or another jurisdiction that restricts international transfers, we rely on:

• an adequacy decision of the competent authority in respect of the destination country, or
• where no adequacy decision applies, appropriate safeguards within the meaning of Chapter V of the GDPR — in particular the Standard Contractual Clauses adopted by the European Commission and, for the United Kingdom, the International Data Transfer Agreement or Addendum — together with any supplementary technical and organisational measures required.

Where neither of the above applies, a transfer will be made only in reliance on a statutory exception provided by applicable law or, failing that, on the basis of your separately obtained explicit consent. You may request a copy of the safeguards we rely on using the contact details in section 1.

6. Your Rights

You have the following rights in relation to your personal data:

• to be informed whether your data is being processed and, if so, to access it and obtain a copy (GDPR Art. 15),
• to be informed of the purposes of processing and whether your data is used in accordance with those purposes,
• to know the recipients or categories of recipients to whom your data has been disclosed, including transfers to other countries,
• to have inaccurate or incomplete personal data rectified (GDPR Art. 16),
• to have your personal data erased where the conditions provided by law are met, even if it was processed lawfully (GDPR Art. 17),
• to obtain restriction of processing in the circumstances provided by law (GDPR Art. 18),
• to request that any rectification, erasure or restriction be notified to the third parties to whom your data has been disclosed (GDPR Art. 19),
• to receive your personal data in a structured, commonly used and machine-readable format and to have it transmitted to another controller (GDPR Art. 20),
• to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing purposes (GDPR Art. 21),
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or otherwise significantly affects you, and to object to such a decision (GDPR Art. 22),
• to withdraw your consent at any time where processing is based on consent (GDPR Art. 7(3)), and
• to claim compensation for damage suffered as a result of unlawful processing of your personal data.

If you are a resident of California, you also have the right to know what personal information we collect, use, disclose and sell or share; to request its deletion or correction; to opt out of the sale or sharing of your personal information; to limit our use and disclosure of sensitive personal information; and not to be discriminated against for exercising these rights.

You may exercise these rights at any time and free of charge by contacting us by e-mail at info@flalingo.com, by telephone on +1 401 203 1078, or by post at 445 South California Avenue, Palo Alto, CA 94306, USA. No specific form or particular wording is required, and further details of our request handling are set out in our Privacy Policy. We will ask you for additional information only where we have reasonable doubts as to your identity. We will respond without undue delay and in any event within one (1) month of receipt, or within forty-five (45) days if you are a California resident; where a request is complex or where you have made a number of requests, we may extend this period as permitted by applicable law and will inform you of the extension and the reasons for it.

If you are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority of your country of residence, place of work or the place of the alleged infringement (GDPR Art. 77), and you may also have the right to seek a judicial remedy.

This document is also available in other languages; in the event of any conflict between a translation and this English version, this English version shall prevail.