Last updated: 9 August 2026

This Privacy Policy explains how we process the personal data of visitors to cylacademy.com (the “Site”), under Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act (Chapter 586 of the Laws of Malta).

The Site presents the Change Your Life Academy training programmes for adults and for young people aged 10 to 17, and allows you to request information through contact forms. The Site uses analytics and advertising tools, activated only with your prior consent, as explained in section 4.

1. Who processes your data (Data Controller)

The Bridge – The Third Millennium Teaching Ltd CMS House, Third Floor, St. Peter’s Street, San Gwann SGN 2310, Malta Registration number: C116263 VAT number: MT 3292-4705 Email: privacy@thebridgettmt.com

We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so.

2. What data we process

Browsing data. The server hosting the Site automatically records technical information: your IP address, your browser and device, the date and time of your visit, and the pages you view. This information is used only to operate the Site, keep it secure and protect it from misuse.

Data you provide to us. When you complete an enquiry form you provide us with: first name, surname, email address, telephone number and any information you choose to write in the message field. On some forms relating to programmes for young people we also ask for information about the child the enquiry concerns (see section 6).

Data collected through tracking tools, only if you consent: pages visited, duration and source of your visit, device and browser, interactions with the page (clicks, scrolling), advertising and session identifiers. Some of these tools record browsing sessions in anonymised form.

Contact via WhatsApp. If you write to us using the WhatsApp buttons on the Site, the conversation takes place on the WhatsApp platform and you provide us with your telephone number and the content of your messages.

3. Why we process your data, and on what legal basis

Consent is always optional and may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Cookies and tracking tools

4.1 What they are

Cookies are small text files that websites store on your device to make them work properly, remember your preferences or collect information about your browsing. Alongside cookies, similar technologies may be used (pixels, scripts, identifiers), which this Policy refers to collectively as “tracking tools”.

4.2 The categories we use

Necessary cookies. Required for the Site to function, for security, and to store the choices you make in the banner. They do not require your consent and cannot be disabled.

Analytics cookies. They allow us to understand how the Site is used in aggregate form: which pages are most viewed, where visitors come from, where difficulties arise. They require your consent.

Marketing cookies. They are used to measure the results of our advertising campaigns and to show you relevant ads on the platforms we use. They require your consent.

4.3 How you choose, and how you change your mind

On your first visit a banner allows you to accept or reject non-necessary tools, or to choose category by category. Refusing does not limit your use of the Site in any way.

You can change or withdraw your choice at any time through the cookie settings link or icon available on the Site. Withdrawal applies going forward and does not affect the lawfulness of processing already carried out.

The platform that collects and stores your choices is Cookiebot (Usercentrics A/S, Denmark). Consent is recorded with an anonymous identifier and retained for 12 months as evidence of the choice made.

You can also manage or delete cookies directly in your browser settings: Chrome, Safari, Firefox, Edge. Disabling all cookies in your browser may affect how the Site works.

4.4 The tools present on the Site

Analytics

• Google Analytics 4 (Google Ireland Limited) — analysis of traffic and browsing behaviour.
• Microsoft Clarity (Microsoft Ireland Operations Ltd) — heatmaps and anonymised session recording. It also sets identifiers associated with the bing.com domain.
• Mixpanel (Mixpanel Inc., USA) — analysis of interactions with the Site through a device identifier.

Advertising, remarketing and conversion measurement

• Google Ads (Google Ireland Limited) — conversion measurement and remarketing. This includes the Enhanced Conversions feature, which transmits to Google, in encrypted and irreversible (hashed) form, the email address and/or telephone number you enter in our forms, solely in order to attribute conversions correctly to campaigns. This feature is active only with your consent to the marketing category.
• TikTok Pixel (TikTok Technology Limited, Ireland) — conversion measurement and remarketing.
• Quora Ads Pixel (Quora Inc., USA) — conversion measurement and remarketing on the Quora platform, including measurement of dwell time on pages.
• Meta Pixel and Conversions API (Meta Platforms Ireland Limited) — conversion measurement, remarketing and creation of advertising audiences on Facebook and Instagram. Data is collected both from your browser and, through the Conversions API, directly from our servers to Meta. In both cases transmission takes place only with your consent to the marketing category.

Tag management

• Google Tag Manager (Google Ireland Limited) — centralised management of the tags used on the Site. Part of the measurement may take place in server-side mode: in that case data passes through a server of ours before being forwarded to the services listed above. In this configuration too, tags are activated only where consent is present.

Embedded content

• YouTube and Google Maps (Google Ireland Limited), Vimeo (Vimeo LLC) — videos and maps embedded in our pages. They load only after your consent; if you consent, the provider receives your IP address and may set its own cookies.

4.5 Main cookies used

The durations shown are those set by the respective providers; the exact value can always be checked in your browser.

This list may change over time depending on the tools in use: we update this Policy whenever there is a material change.

5. Contact and enquiry forms

Forms allowing you to request information and be contacted back are present on the Site and on our landing pages.

The data you enter is collected and managed through HubSpot, which acts as our Data Processor under Art. 28 GDPR. The data is hosted on data centres located in the European Union. HubSpot Inc. is based in the United States and may access the data from the USA for support and maintenance purposes: such access is covered by the safeguards described in section 8.

The forms include separate, non pre-ticked consent boxes:

• acknowledgement of this Privacy Policy (required in order to submit your enquiry);
• optional consent to receive marketing communications and informational material.

Refusing the optional consent does not in any way prevent you from receiving a reply to your enquiry.

If you subscribe to our newsletter, you can unsubscribe at any time using the link at the bottom of every email or by writing to privacy@thebridgettmt.com.

No purchases or payments take place on this Site. We do not collect credit card details or other payment information. Paid enrolment on our programmes is handled by Italian Teaching Srl (VAT/Tax code 02972650184) on the site italianteaching.it: from that point onwards the processing of your data is governed by that site’s privacy policy, which we invite you to read.

6. Data relating to minors

Some of our programmes are aimed at young people aged 10 to 17. In this regard:

• Enquiry forms relating to programmes for young people are reserved for parents or those holding parental responsibility. By completing the form you declare that you are an adult and that you are acting in that capacity.
• The data you provide about the child (for example name and age) is processed solely to assess whether the programme is suitable and to organise it, and is not used for advertising or profiling purposes.
• We do not carry out advertising profiling directed at minors and we do not build advertising audiences based on minors’ data.
• If we become aware that we have collected a minor’s data without the involvement of a person holding parental responsibility, we delete it without undue delay. You can report this to us at any time by writing to privacy@thebridgettmt.com.

7. Who else sees your data

We share data only with parties providing services necessary to the operation of the Site and of our activity, appointed as Data Processors where applicable (Art. 28 GDPR):

We do not sell, disclose or transfer your data to third parties for their own commercial or advertising purposes. We may disclose it to the competent authorities where required by law.

8. Transfers outside the European Union

The Data Controller is based in Malta (EU).

Some of the providers listed above (in particular Mixpanel, Quora, Cloudflare, Vimeo and, for certain operations, Google, Microsoft and HubSpot) may process data in the United States. Such transfers take place on the basis of the Standard Contractual Clauses approved by the European Commission and, where the provider has certified to it, the EU-U.S. Data Privacy Framework, with supplementary protection measures.

You can request a copy of the safeguards in place by writing to privacy@thebridgettmt.com.

9. How long we keep your data

• Server logs (including IP addresses): no longer than 12 months.
• Enquiries not followed by enrolment: 24 months from the last contact.
• Data of clients and programme participants: for the duration of the relationship and subsequently for 10 years, for tax and legal obligations.
• Marketing and newsletter consent: until withdrawal, and reviewed periodically in any event.
• Data collected through cookies: according to the duration indicated for each cookie in section 4.5.
• Cookie consent records: 12 months, as evidence of the consent collected.

10. Your rights

You may at any time ask us to access, rectify, erase or restrict the use of your data, to object to processing based on legitimate interest, and to obtain data portability. Where processing is based on consent, you may withdraw it at any time. You may also object at any time, free of charge and without giving reasons, to processing for direct marketing purposes.

Write to us at privacy@thebridgettmt.com: we will respond within one month.

As the Data Controller is based in Malta, the competent supervisory authority is the Information and Data Protection Commissioner (IDPC) — idpc.org.mt. You may in any case lodge a complaint with the authority of your own country: if you live in the United Kingdom, the Information Commissioner’s Office (ICO) — www.ico.org.uk.

11. How we protect your data

We adopt technical and organisational measures appropriate to protecting data against unauthorised access, loss or misuse: encrypted connection (HTTPS), access restricted to authorised personnel, perimeter and bot protection. No system is 100% secure, but we work to make ours as secure as possible.

12. If this Policy changes

We may update it over time. Changes will be published on this page; the “last updated” date always indicates the version in force. Where changes concern processing based on consent, we will collect your consent again.

13. Transparency Notice on the Use of Artificial Intelligence (EU AI Act)

In accordance with Regulation (EU) 2024/1689, cylacademy.com informs you that certain support processes, graphic layout elements or teaching materials may be produced with the assistance of generative Artificial Intelligence tools. All textual, educational and training content on our site and within our programmes is fully reviewed, verified and approved by our team before publication. Any audio or video material created through voice synthesis or digital avatars is clearly labelled as such, in compliance with legal requirements.

14. Contact

For any questions: privacy@thebridgettmt.com