Privacy Policy — cylacademy.com
Version 3.7 — Last updated: 30 October 2026
In brief
- Who processes your data: The Bridge – The Third Millennium Teaching Ltd, a company based in Malta. Write to us at privacy@thebridgettmt.com.
- Why: to answer your requests and to organise calls, video calls, webinars and programmes; with your consent, to send you marketing communications and to measure and show our advertising campaigns.
- Cookies: without your consent we only use technical cookies. Advertising tools (Meta Pixel) are activated only after you give your consent in the banner. Embedded videos and maps can be viewed without consent, in a mode without profiling cookies. We do not use analytics tools that identify you or store information on your device: we only count, in aggregate form, the visits that come from our ads and the interactions with the page (form, banner, buttons, videos, time and scrolling). Details are in the Cookie Policy.
- Campaign measurement: we link each request we receive to the campaign it came from, without name, email or phone number, to understand which ads work. You can object.
- Children: our programmes for young people aged 10 to 17 are aimed at parents, as is the Change Your Life Education weekend, designed for parents. On the pages for young people and for parents too, only if you accept the Marketing category, we use advertising tools to measure and show our campaigns to parents. We never send platforms any information about the child and we do not record browsing sessions.
- Artificial intelligence: no decision about you is taken by automated means. To analyse our campaigns we use an AI assistant only on aggregated or pseudonymised data, never on data about children.
- Outside the EU: some providers process data in the United States; we use the safeguards required by the GDPR.
- Your rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, complaint to a supervisory authority. We reply within one month.
- Where you are: this Policy applies everywhere. Section 20 sets out the additional rules for the United Kingdom, Switzerland, France, Spain, Germany, Austria, Belgium, the Netherlands and Luxembourg.
1. Controller and contact details
The Bridge – The Third Millennium Teaching Ltd
CMS House, Third Floor, St. Peter's Street, San Gwann SGN 2310, Malta
Registration number (Malta Business Registry): C116263
VAT number: MT 3292-4705
Privacy email: privacy@thebridgettmt.com
We have not appointed a Data Protection Officer (DPO), because we are not required to do so (Article 37 GDPR). For any question, write to the address above.
This Policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), the Maltese Data Protection Act (Cap. 586) and, for Italian users, the Italian Personal Data Protection Code (Legislative Decree 196/2003, "Italian Privacy Code"). It is available in Italian, Spanish, English and French, with the same content.
2. What the Site does and who this Policy is for
cylacademy.com (the "Site") presents the "Change Your Life Academy" training programmes for adults (for example Leadership, Masterclass, University), for young people aged 10 to 17 (for example "Change Your Life Kindle") and for parents (for example "Change Your Life Education", a training weekend for families). On the Site you can request information, ask to be called back, sign up for a webinar, download materials and contact us via WhatsApp, phone or email.
This Policy applies to anyone who visits the Site, fills in a form, uses one of our contact channels or takes part in our calls, video calls and webinars. It does not apply to third-party sites reachable through links, which have their own policies.
3. What data we process and where it comes from
3.1 Browsing data. The systems that host and protect the Site automatically record IP address, browser and device type, date and time of the request, pages visited and referring page. We use this data to run the Site, keep it secure and prevent abuse.
3.2 Data you give us in forms. First name, surname, email, phone number, the programme you are interested in (for the parents' weekend, also the package and the edition) and the information you choose to write in free-text fields. Please do not enter health information or other special category data (Article 9 GDPR), about yourself or others, in free-text fields: we do not need it to reply. If you share it with us spontaneously, we process it only as far as necessary to handle your request and delete it as soon as possible.
3.3 Data about the child provided by the parent. In the forms for our programmes for young people we ask the person with parental responsibility for some information about the child: sex, school year or stage (or age group), any other languages spoken and, in some countries, the region of residence. This data comes from the parent, not from the child, and is used only to assess whether the programme is suitable and to organise it. We do not ask for the child's name in the form; we collect it only at enrolment. In the form for parents (for example the Change Your Life Education one) we do not ask for sex or school: we ask for your children's ages only in bands (under 10, 10-13, 14-17, 18 or over; you can choose more than one). It is optional, except with the “Whole family” package, where we need it to offer you the package and organise the weekend. We never ask for the children's names in the form. See section 7.
3.4 Contact channel data. If you write to us on WhatsApp, call us or send us an email, we process your number or address, your name as it appears on the platform and the content of the conversation. WhatsApp (WhatsApp Ireland Ltd) processes data as an independent controller under its own policy. If you follow our channels on social networks or other messaging apps, those services' privacy policies also apply. Phone calls with our team are not recorded.
3.5 Data from calls, video calls, webinars and downloads. When you speak with our team, join a video call or a webinar or download material, we process the data you give us (name, email, phone, date and time of the appointment) and your participation. See section 6.
3.6 Data collected with cookies and similar tools (only with your consent). Pages visited, origin of the visit, interactions (for example submitting a form) and advertising identifiers. Details are in the Cookie Policy.
3.7 Data on where your request came from. When you reach the Site from one of our ads or links, the page address may contain parameters showing the campaign, the ad group and the ad ("UTM" parameters). They are the same for every visitor of that ad and do not identify you. If you submit a form, we record them together with your request and the landing page, for the internal campaign analysis described in section 10. Only if you have accepted the Marketing category we also record the click identifier created by the advertising platform (for example Meta's fbclid parameter), which is different for every click. We also count, in aggregate form, the visits that come from our ads and the interactions with the page (section 10).
3.8 Data we receive from others (Article 14 GDPR). We may receive your contact details:
- from someone who knows you and referred you to us, only if you asked to be contacted;
- from the companies that manage enrolments and payments (section 11), to follow up on our relationship.
In these cases we inform you at the first useful contact and in any event within one month.
3.9 Testimonials, photos, videos and reviews. If you take part in a programme and authorise us, we may publish your testimonial, image or voice (section 8). If we show public reviews left on third-party platforms on the Site, we only show the name and profile picture that the author has made public.
3.10 Providing data. Mandatory form fields are necessary to answer your request: without that data we cannot handle it. The other fields, consent to marketing communications and consent to non-technical cookies are optional: if you do not provide them, you still receive a reply and can use the Site without restrictions.
4. Why we process data and on what legal basis
| Purpose | Legal basis | Data involved |
|---|---|---|
| Running the Site, keeping it secure, preventing abuse, keeping logs | Legitimate interests (Article 6(1)(f) GDPR) in protecting our systems and our users | Browsing data |
| Answering requests for information, calling you back, organising calls and video calls, sending you the material you requested | Pre-contractual steps taken at your request (Article 6(1)(b)) | Form, contact channel and call data |
| Assessing whether a programme is suitable for a young person and organising it | Pre-contractual steps at the parent's request (Article 6(1)(b)); for the child, legitimate interests of the parent and the child in receiving a suitable service (Article 6(1)(f)) | Data about the child provided by the parent |
| Answering requests about the weekend for parents and organising it (package, edition, whether children take part) | Pre-contractual steps at your request (Article 6(1)(b)); for the children's data, the same bases as the previous row | Form data, package, edition, children's age bands |
| Processing information on the child's educational needs or health, if the parent shares it with us | Explicit consent of the parent (Article 9(2)(a)), which can be withdrawn | Only the information needed to organise the programme |
| Managing webinar participation and downloads of materials | Performance of what you requested (Article 6(1)(b)) | Registration and participation data |
| Managing the contractual relationship if you enrol in a programme | Performance of the contract (Article 6(1)(b)) | Enrolment data |
| Sending you marketing communications and content about our programmes by email and phone, and measuring opens and clicks of our emails | Consent (Article 6(1)(a); Articles 122 and 130 Italian Privacy Code; reg. 9 S.L. 586.01 Malta), optional and revocable, given with a single box that states both | Name, email, phone, programme of interest; recipient identifier, open and click events |
| Statistics on use of the Site with tools that identify you or store information on your device (none currently active) | Consent (Article 6(1)(a); Article 122 Italian Privacy Code) via the banner | Data in section 3.6 |
| Aggregate count of the visits that come from our ads and of the interactions with the page | Legitimate interest (Article 6(1)(f)) in measuring the effectiveness of our advertising with aggregated data that identifies no one; it writes nothing to your device (first-party aggregate measurement, according to the Italian Garante's guidelines of 10 June 2021) | Page path, campaign, ad group and ad identifiers, what happened on the page (from a closed list, including time and scroll thresholds), browser family, daily totals (section 10) |
| Advertising on Facebook and Instagram, conversion measurement, remarketing | Consent (Article 6(1)(a); Article 122 Italian Privacy Code) via the banner. With Meta: joint controllership (Article 26) for collection and transmission | Data in section 3.6; email and phone in pseudonymised (hashed) form entered in forms |
| Showing videos and maps embedded in pages, in a mode without profiling cookies | Legitimate interests (Article 6(1)(f)) in presenting our programmes with videos and maps | IP address and technical browser data |
| Internal analysis of the effectiveness of advertising campaigns, also with an AI assistant (section 10) | Legitimate interests (Article 6(1)(f)) in measuring the effectiveness of our advertising; you can object at any time | Pseudonymised data in section 10 |
| Keeping proof of your cookie choices | Legal obligation to demonstrate consent (Article 6(1)(c) and Article 7(1) GDPR) | Random identifier, date, choices, banner version, language, page |
| Showing public reviews left on third-party platforms | Legitimate interests (Article 6(1)(f)) in presenting our business; the author has already made the data public | Author's name and profile picture |
| Publishing participants' testimonials, photos, videos and audio | Consent (Article 6(1)(a)) of the participant or, for children, of the person with parental responsibility, revocable | Image, voice, name, testimonial |
| Complying with legal obligations, responding to authorities, establishing or defending legal claims | Legal obligation (Article 6(1)(c)); legitimate interests (Article 6(1)(f)) | All relevant data |
Consent is always optional and you can withdraw it at any time, without affecting the lawfulness of processing already carried out and without any restriction on your use of the Site.
We do not use the "soft spam" exemption (Article 130(4) Italian Privacy Code): marketing communications are sent only with your express consent.
5. Forms, CRM and marketing communications
5.1 Where form data goes. The Site's forms are managed with two tools, both appointed as processors (Article 28 GDPR):
- Nubble (Nubble S.r.l., Italy, with servers in Germany): our CRM. We record requests for information there and use it to manage follow-up calls and send emails;
- Tally (Tally BV, Belgium): some forms on the Site are built with Tally; the data submitted reaches our team and the CRM.
The Site's content management system does not store form data.
Our forwarding service. The Site's forms go through a service of ours on Cloudflare (Cloudflare Inc., processor), which forwards them to Nubble. The data stays there only for as long as it takes to forward it: normally a few seconds. If Nubble does not respond, the form waits in an internal queue and we try to send it again for up to 7 days; then we delete it. No other form data stays in that service.
5.2 What you find in forms. Every form shows:
- which fields are mandatory;
- a short notice with a link to this page;
- a statement that you have read this Policy (necessary, but not consent: we answer your request under Article 6(1)(b));
- a separate, optional, unticked box to receive marketing communications and for the measurement of opens and clicks of our emails;
- a mandatory box in which you declare that you are an adult; in forms for programmes for young people and for parents the box reads: “I declare that I am over 18 and a parent or guardian”.
Two-step forms. Some forms are filled in two steps. In the first you give us your name, email and mobile number, and you find a single mandatory box in which you declare that you are an adult, a parent or guardian, and that you have read this Policy. By pressing the submit button of the first step you send us that data: we keep it in our forwarding service for about 15 minutes, waiting for the second step. If you complete it, the request reaches Nubble once. If you stop, after about 15-20 minutes it reaches Nubble with only your name, email and mobile number and we call you back to answer your request (Article 6(1)(b)). The second step, together with the other details, has the optional box for marketing communications: if you stop at the first step you have given no consent and we do not send you marketing communications.
Form for parents (Change Your Life Education). It is completed in a single step. It asks for your first name, email, mobile number, the package you are interested in (one parent, couple, whole family), the edition and, in bands, your children's ages (mandatory only with “Whole family”); it does not ask for surname, sex or school. It has the two mandatory boxes (adult and parent or guardian; having read this Privacy Policy) and the optional box for marketing communications. Package, edition and age bands go only to the CRM: they never reach Meta and do not remain in the records of our forwarding service (which, if the CRM does not respond, keeps the whole form for up to 7 days, as explained above).
5.3 Marketing communications. If you consent, we send you by email and tell you by phone about Change Your Life Academy programmes, events, webinars and offers. You can withdraw your consent at any time using the link at the bottom of every email, by saying so during a call or by writing to privacy@thebridgettmt.com.
5.4 Measuring opens and clicks. The marketing emails we send with Nubble contain a pixel and links that tell us whether you opened them and which links you clicked. This measurement is part of your consent to marketing communications: the box in the form says so explicitly (“…and to the measurement of email opens and clicks”). If you withdraw your consent, we stop both sending you marketing communications and measuring their opens and clicks. We use this data to understand which content is useful and to organise follow-up contacts; we do not use it for automated decisions.
6. Calls, video calls and webinars
Calls. After your request, our team calls you to give you information and, if needed, to arrange a video call. Calls are not recorded. For programmes for young people we always speak with the parent. If information emerges about the child's educational needs or health (for example specific learning difficulties or certifications), we process it only with the parent's explicit consent (Article 9(2)(a) GDPR) and only as far as necessary to organise the programme.
Video calls and webinars. These take place on Zoom (Zoom Communications Inc., USA) or Google Meet (Google), which act as our processors. We do not record video calls or webinars. The provider receives the name and email you join with, your IP address and the technical data of the connection. In webinars, depending on the settings, the name you join with and the messages you write in the chat may be visible to other participants.
Materials. Some free materials are downloaded from a link to an online storage service, which receives your IP address and technical browser data.
7. Data relating to children
Some programmes are for young people aged 10 to 17; others are for parents and, with the “Whole family” package of the Change Your Life Education weekend, children from age 10 take part together with them. These are the rules we follow.
- Forms are reserved for adults with parental responsibility. Forms for programmes for young people and for parents contain the mandatory box “I declare that I am over 18 and a parent or guardian”: without this declaration the form cannot be sent. If a child contacts us directly, we ask them to involve a parent.
- If we find out that a child is writing to us, or that we hold a child's data collected without the parent's involvement, we delete it without delay. You can tell us at privacy@thebridgettmt.com.
- Age. Sign-ups to marketing communications and requests are reserved for adults. For programmes for young people, the parent always acts. Where the law allows a child to consent alone to an online service, we respect the age set in the country where the child lives: for example 13 in Malta, Belgium, Portugal and the United Kingdom; 14 in Italy, Spain and Austria; 15 in France, where under 15 consent is given jointly by the child and the parent; 16 in Germany, Ireland and the Netherlands. If in doubt, we ask for the parent's involvement.
- What data about the child. Only the data listed in section 3.3 and, at enrolment, name and date of birth. We do not ask for unnecessary data. Information on special educational needs or health is processed only with the parent's explicit consent.
- No advertising based on children's data. We do not build advertising audiences with children's data, we do not upload customer or contact lists to advertising platforms and we do not advertise to children. Campaigns for programmes for young people and for the Education weekend are aimed at parents. On the Site's pages for programmes for young people and for parents, only if you have accepted the Marketing category in the banner, the measurement and advertising tools described in section 9.3 are active (Meta Pixel and Conversions API). We use them to measure the effectiveness of campaigns aimed at parents and to show our ads to parents who have visited those pages. We send advertising platforms only data relating to the parent (browsing events and, if you fill in the form, email and phone in hashed form, as explained in section 9.3); we never send any information about the child (age, sex, school, languages or other form answers). Without your consent, only technical cookies remain active.
- No session recording. We do not record browsing sessions, either on these pages or anywhere else on the Site.
- The assessment of suitability of a young person for a programme is always made by a person in our team, never by an automated system.
- No data about children in AI. We never enter data about children into artificial intelligence tools (section 16).
- Images and testimonials of children only with the parent's written consent, specific to the publication channel (section 8).
8. Testimonials, photos, videos and reviews
We publish on the Site and on our social media channels photos and videos taken during programmes, written testimonials, video testimonials and, in some cases, messages received from participants, only with the written consent of the person shown or, if a child, of the person with parental responsibility. The consent states the publication channels and you can withdraw it at any time by writing to privacy@thebridgettmt.com: we remove the content from our channels within 15 days. Copies already shared by third parties are outside our control.
When we publish messages we have received (for example chat screenshots), we hide names, profile pictures and data of anyone other than the person who gave consent.
If we show public reviews left on third-party platforms on the Site, we only show the name and profile picture that the author has made public on that platform. If you are the author and do not want your review to appear on our Site, write to us and we will remove it.
9. Cookies, tracking tools and advertising
The full list of cookies, durations and providers is in the Cookie Policy. Here we summarise the points most relevant to your data.
9.1 The banner and your choices. Without consent we only use technical cookies. Analytics and marketing tools are activated only after your consent, which you can give, refuse or change by category (Analytics, Marketing) with our "CYL Consent" banner. The "Reject all" button is as prominent as "Accept all". If you do not choose and keep browsing, only technical cookies remain active. You can change your mind at any time with the "Cookie preferences" button, always visible at the bottom of every page. Your choice is stored for 180 days in the technical cookie cyl_consent. As proof of consent, we record on our content management system a random identifier, the date, your choices, the banner version, the language and the page: no data that directly identifies you.
9.2 Analytics. No analytics tool that identifies you or stores information on your device is currently active on the Site. The "Analytics" category remains in the banner for the future: if we activate a tool of this kind, we will update this Policy and the Cookie Policy and use it only with your consent. We only run the aggregate count of visits from our ads and of interactions with the page described in section 10, which does not need your consent because it writes nothing to your device and does not identify you.
9.3 Advertising and conversion measurement (Meta). With your consent to the Marketing category we use the Meta Pixel (Meta Platforms Ireland Ltd) to measure the effectiveness of our campaigns on Facebook and Instagram, show our ads to people who have visited the Site and create audiences of people with similar interests.
- From our server. We also send Meta the “form submitted” event from our server (Conversions API), with the same event identifier as the browser event, so that Meta counts it only once. We do this only if you have accepted the Marketing category in the banner. We send: email and phone number in hashed form (see below), the ad click identifier and the
_fbpand_fbccookies if present, the IP address and technical data of your browser, the address of the form page and a random event identifier. We do not send your name, any data about your children or any information on how your request is progressing. We do not keep the hash or the IP address that we send to Meta, except for up to 7 days if Meta does not respond and we have to send the event again. If you have not accepted Marketing, nothing is sent from our server. In two-step forms, the event (from the browser and from the server) is sent at the first step, when you send us your name, email and mobile number, with email and phone number in hashed form as in other forms. - Pseudonymised contact data. If you have given Marketing consent and fill in a form, your email and phone number may be sent to Meta in hashed form (an irreversible transformation that Meta uses only to recognise its own users and attribute the conversion to the campaign). Hashing is pseudonymisation, not anonymisation: that is why we only do it with your consent.
- Joint controllership with Meta. For the collection and transmission to Meta of data via the Meta Pixel and Conversions API only, we are joint controllers with Meta Platforms Ireland Ltd (Article 26 GDPR), under Meta's "Controller Addendum". It is our responsibility to inform you and collect your consent; Meta is responsible for ensuring your rights over the data it holds after transmission. Meta's privacy policy is at facebook.com/privacy/policy; the essence of the arrangement is at facebook.com/legal/controller_addendum. Who the advertiser is. The controller of the Site is The Bridge – The Third Millennium Teaching Ltd. The advertiser, meaning the party that owns the advertising account and the dataset on Meta and has signed Meta's “Controller Addendum”, is Italian Teaching Srl (VAT no. 02972650184) for the campaigns and pages aimed at Italy and Wayky Iberia S.L. (NIF B75269530) for those aimed at Spain.
- No contact lists. We do not upload customer or contact lists to Meta to create audiences.
- Pages for programmes for young people and for parents. These tools are active only with your consent and only with data relating to the parent (section 7).
- No fingerprinting. We do not use device identification techniques other than the cookies and identifiers declared.
9.4 Embedded content. Videos and maps can be viewed by everyone, even without consent, because we embed them in a mode without profiling cookies:
- YouTube (Google Ireland Ltd): we use the youtube-nocookie.com address (privacy-enhanced mode). YouTube does not set profiling cookies; when you start a video it may store technical data needed for playback in your browser;
- Vimeo (Vimeo.com Inc., USA): we use the "Do Not Track" option (parameter
dnt=1), with which Vimeo does not set tracking cookies; - maps: OpenStreetMap, or a box showing the name of the place and a link to Google Maps.
When a video or map loads or you start it, the provider still receives your IP address and technical browser data, as with any content loaded from another site. If you open the link to Google Maps, you leave our Site. Some pages also load technical libraries (styles and scripts) from third-party distribution networks, which receive your IP address and technical browser data.
10. Internal analysis of advertising campaigns
What we do. To understand which campaigns and ads bring requests and enrolments, and to decide how to invest our advertising budget, we use an internal platform managed by us. The platform links:
- the identifier of the request (lead) in our CRM and its date;
- the UTM parameters and the landing page and, only if you have accepted the Marketing category, the click identifier (section 3.7);
- whether the request arrived with only the first step of the form or with both (partial or complete);
- the stage of the sales process and the dates on which a request moves from one stage to another (for example: interested, confirmed, enrolled);
with advertising spend per ad, which we receive from the platforms in aggregated form.
Aggregate count of visits and interactions. When you reach one of our pages from an ad, the page sends our server counts with the page path (without parameters), the campaign, ad group and ad identifiers, which are the same for every visitor of that ad, and the name of what happened, chosen from a closed list: the page was viewed; the form appeared, was seen, you touched a field, you pressed the submit button, the form's check stopped the submission (with the name of the field to correct, never what you wrote), the first or the second step reached our server; which choice you made in the consent banner (Accept, Reject, Close or, in “Manage choices”, whether you turned Marketing on or off); which button or link you pressed, by category and not by address; whether you opened and started a video and whether you reached the halfway point or the end. We also count whether you are still on the page after 10 and 30 seconds and whether you have scrolled to a quarter, half, three quarters or the end: only these thresholds, never the exact time or where you are. To know whether the form works in the browser you use, our server recognises whether you come from the Instagram or Facebook app, from another mobile browser or from a computer, and keeps only that family, never the browser data. Our server adds everything up into daily totals. It uses no cookies or browser storage, does not keep the IP address or the browser data of these visits, assigns no identifiers, does not link the events to one another and shares the data with no one. It does not read or record what you type in the fields, or where you click on the page. The count does not depend on your choice in the banner, because it writes nothing to your device and does not identify you. So it cannot tell who you are or count people one by one: we count events, not people. The totals, which do not relate to any person, are kept for 13 months (section 14).
What data we do not use. The platform contains no name, email or phone number. The data is pseudonymised: it can be traced back to a person only through the CRM, which only authorised people can access. This analysis does not involve sending data to advertising platforms: from them we only receive ad spend and performance data.
What it is for. The analyses are used to take decisions about campaigns (which ads to keep, which to change, how much to invest), not decisions about individuals.
Journey of requests and value over time. To understand how long and how often our ads take a request to each stage, we record the date on which a request moves from one stage to another. To measure the value over time of each campaign, and to credit the right campaign with the progress of someone who comes back through an ad while already having an open deal, we also link the deals of the same customer, including those of different programme lines (for example Kindle and Masterclass). The journey of an individual request can be viewed only by an authorised member of our team, to check how the campaigns are working: those screens show no data about the child and no reasons why a request did not go ahead. We look at value over time only per ad and per group of customers, and we do not show groups of fewer than 5 people; the calculation for each single customer stays inside the internal platform and no screen displays it. The AI assistant and the reports use totals only. We do not send this data to advertising platforms and we do not use it to decide about any individual (for example whom to call first or whom to offer a discount).
AI assistant. For these analyses we also use an artificial intelligence assistant (Claude, by Anthropic PBC, USA), which acts as our processor under a data processing agreement. We give the assistant only aggregated or pseudonymised data, never contact data and never data about children. See sections 13 and 16.
Legal basis and objection. We process this data on the basis of our legitimate interests in measuring the effectiveness of our advertising (Article 6(1)(f) GDPR). We have limited the data to what is strictly necessary and we pseudonymise it. You can object at any time by writing to privacy@thebridgettmt.com: from then on we exclude your request from these analyses. Your objection also covers the dates of stage changes and the linking of deals of the same customer.
11. Enrolment and payments
No payments are made on the Site and we do not collect card details or other payment instrument data. Enrolment in programmes and payments are managed by these companies:
| Company | Country of the programmes | Website |
|---|---|---|
| Italian Teaching Srl, VAT no. 02972650184 | Italy | italianteaching.it |
| Wayky Iberia S.L., NIF B75269530, Carretera KM 4, 45900 Almorox (Toledo) | Spain | waykyiberia.es |
For the enrolment and payment stage these companies process your data as independent controllers, each under its own privacy notice, which you receive at enrolment together with the terms of sale. To allow you to complete your enrolment, we share with them the data of your request (name, contact details, chosen programme) under Article 6(1)(b) GDPR. If you enrol in a programme in another country, or in a programme for parents such as Change Your Life Education, we tell you which company manages the enrolment before you complete it.
12. Who receives your data
We share data only with those who need it to provide what you requested or to run the Site. We do not sell or transfer your data to third parties for their own marketing purposes.
| Recipient | Role | What for |
|---|---|---|
| Google – Google Cloud (data centres in the European Union) | Processor | Hosting of the Site and of the content management system ("Woppy"), both managed by us; server logs; consent records |
| Cloudflare Inc. (USA) | Processor | Content delivery network and protection against attacks: all visits to the Site go through Cloudflare, which processes IP address, requested page and technical browser data; it also acts as an intermediary when forms are sent to Nubble, keeping the data only for as long as necessary (section 5.1) |
| Nubble S.r.l. (Italy, servers in Germany) | Processor | CRM, forms, management of requests, sending emails |
| Tally BV (Belgium) | Processor | Forms |
| Zoom Communications Inc. (USA) | Processor | Video calls and webinars |
| Google (Google Meet); Google Ireland Ltd (YouTube) | Processor for Google Meet; independent controller for YouTube | Video calls; embedded videos |
| Meta Platforms Ireland Ltd | Joint controller (collection and transmission via Meta Pixel and Conversions API); independent controller for subsequent processing | Advertising and measurement |
| Anthropic PBC (USA) | Processor | AI assistant for internal campaign analysis, only on aggregated or pseudonymised data |
| Vimeo.com Inc. (USA) | Independent controller | Embedded videos |
| OpenStreetMap Foundation (United Kingdom), if we use its maps | Independent controller | Embedded maps |
| WhatsApp Ireland Ltd | Independent controller | Contact channel |
| Italian Teaching Srl (Italy); Wayky Iberia S.L. (Spain) | Independent controllers (section 11) | Enrolments and payments |
| Legal, tax and insurance advisers; banks; authorities | Independent controllers or processors | Compliance and defence of legal claims |
| Authorised persons (employees and contractors, trainers and tutors) | Authorised under our authority | The activities described in this Policy |
The up-to-date list of processors is available on request at privacy@thebridgettmt.com.
13. Transfers of data outside the European Economic Area
The controller is based in Malta. Some providers process data, in whole or in part, in the United States or the United Kingdom. For these transfers we use the safeguards in Chapter V of the GDPR:
- the adequacy decision on the EU–US Data Privacy Framework (Decision (EU) 2023/1795), for certified US providers: Cloudflare Inc., Google LLC, Meta Platforms Inc., Vimeo.com Inc. and Zoom Communications Inc. The decision was upheld by the EU General Court on 3 September 2025 (case T-553/23); an appeal is pending before the Court of Justice (C-703/25 P). Standard Contractual Clauses are also in place with these providers as a fallback safeguard;
- the Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914), with a transfer impact assessment, for Anthropic PBC;
- the adequacy decision for the United Kingdom, for OpenStreetMap Foundation, if we use its maps.
You can ask us for a copy of the safeguards by writing to privacy@thebridgettmt.com. The list of countries required by Swiss law is in section 20.
14. How long we keep data
| Data | Retention period |
|---|---|
| Server logs (with IP addresses) | 6 months, unless needed to investigate abuse |
| Form data in our forwarding service (waiting to be sent to the CRM or to Meta) | First step of two-step forms: about 15 minutes, at most 20. If the CRM or Meta do not respond: up to 7 days. Then deleted |
| Requests for information not followed by enrolment | 24 months from the last contact, then deletion |
| Data about the child provided by the parent (including the children's age bands in the form for parents), without enrolment | 12 months from the last contact |
| Data from calls, video calls, webinars and downloads | 24 months from the last contact |
| WhatsApp and email conversations | 12 months from the last message, unless you enrol |
| Data of customers and programme participants | Duration of the relationship plus 10 years for tax and legal obligations |
| Consent to marketing communications and data used to send them | Until withdrawn; contacts inactive for 24 months are in any case removed from marketing lists |
| Email open and click data | 12 months |
| Pseudonymised data from the internal campaign analysis | For the same period as the data of the request it relates to; then deleted or anonymised |
| Dates of stage changes and the journey of an individual request (pseudonymised data) | 24 months from the last stage change, even if the request itself is kept longer; then deleted. Only the totals per ad remain, which relate to no individual |
| Linking of the deals of the same customer (calculation of value over time) | Only for as long as needed for the calculation and not beyond the deletion of the request; afterwards only the totals per ad remain |
| Aggregate totals of visits and interactions (no personal data) | 13 months, then deleted |
| Published testimonials, photos, videos | Until consent is withdrawn or for the period stated in the authorisation |
| Data collected through cookies | Duration of each cookie, set out in the Cookie Policy |
| Record of cookie choices (proof of consent) | 12 months from the choice |
| Data needed to defend a legal claim | For the duration of the dispute and of the limitation periods |
At the end of these periods data is deleted or anonymised.
15. Your rights
You can ask us at any time to:
- access your data and receive information on how we use it (Article 15);
- rectify it if inaccurate or incomplete (Article 16);
- erase it (Article 17);
- restrict its processing (Article 18);
- receive it in a structured format and transmit it to another controller (portability, Article 20);
- object to processing based on legitimate interests, including the internal campaign analysis, on grounds relating to your situation (Article 21(1));
- object at any time, free of charge and without giving reasons, to direct marketing, including related profiling (Article 21(2) and 21(3));
- withdraw consent whenever you wish, without affecting processing already carried out (Article 7(3)): for cookies with the "Cookie preferences" button, for emails with the unsubscribe link, otherwise by writing to us.
To exercise your rights, write to privacy@thebridgettmt.com. We reply within one month, which may be extended by two months in complex cases, in which case we will tell you. We may ask you to confirm your identity. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
Complaints. If you believe the processing breaks the law, you can lodge a complaint with a supervisory authority. The lead authority for the controller is the Information and Data Protection Commissioner (IDPC) of Malta, Second Floor, Airways House, High Street, Sliema SLM 1549, idpc.org.mt. You can also contact the authority of the country where you live or work or where the alleged infringement took place, for example:
- Italy: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it;
- Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, aepd.es;
- France: Commission nationale de l'informatique et des libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr;
- United Kingdom: Information Commission (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk.
The authorities of other European countries are listed on the website of the European Data Protection Board (edpb.europa.eu); those of countries with specific rules are in section 20. You can also go to court.
16. Automated decisions, profiling and artificial intelligence
No automated decisions with significant effects. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The assessment of suitability for programmes, including for young people, admission and terms are always decided by people in our team.
Profiling for marketing purposes. Advertising platforms use their own algorithms to choose who to show our ads to, based on data collected with your consent (section 9.3). You can object and withdraw your consent at any time (section 15).
How we use artificial intelligence.
- Campaign analysis. We use an AI assistant (Claude, by Anthropic PBC) to analyse the results of our advertising campaigns, only on aggregated or pseudonymised data, without contact data and never with data about children (section 10). The assistant helps us decide about campaigns, not about individuals.
- Internal support. We use generative AI tools to support our team's work: drafts of texts, translations, graphics, organisation of work. We do not enter children's data or special category data (for example health data) into these tools.
- Providers. We only use providers that contractually commit not to use our data to train their models.
- Human review. Replies to your requests and the texts we publish are always reviewed by a person.
- No chatbots. There are currently no AI-based chatbots or virtual assistants on the Site or on our channels: you are always answered by people in our team. If we ever introduce one, we will tell you at the start of the conversation and update this Policy.
- AI-generated content. Realistic images, videos and audio created or significantly altered with AI are labelled as such on the content itself (Article 50 of Regulation (EU) 2024/1689, "AI Act"). We never create synthetic content depicting children.
- Children. We do not make AI tools available to children. In programmes for young people we do not use emotion recognition systems or AI tools that assess participants.
17. How we protect data
We take technical and organisational measures appropriate to the risk (Article 32 GDPR): encrypted connection (HTTPS); access to the Site, the CRM and our tools limited to authorised staff, with personal credentials and two-factor authentication; access logging; system updates; backups; written instructions to staff; agreements with providers; content management panel accessible only to authorised users; servers reachable only through our protection network; pseudonymisation of the data used for campaign analysis. In the event of a personal data breach that poses a risk to your rights, we notify the IDPC within 72 hours and, if the risk is high, you as well.
18. Changes to this Policy
We may update this Policy when our tools, providers or the law change. The version in force is always the one published on this page, with the date at the top. If the changes concern processing based on consent, we will ask for your consent again; for other significant changes we will let you know on the Site or, if you are one of our contacts, by email.
19. Legal information about the Site
Under Directive 2000/31/EC (Maltese Electronic Commerce Act, Cap. 426, and Article 7 of Italian Legislative Decree 70/2003):
The Bridge – The Third Millennium Teaching Ltd · CMS House, Third Floor, St. Peter's Street, San Gwann SGN 2310, Malta · Register: Malta Business Registry, no. C116263 · VAT number MT 3292-4705 · Email: privacy@thebridgettmt.com.
The terms of sale of the programmes are provided to you at enrolment by the company that manages it (section 11).
20. Country-specific information
This Policy applies to all users of the Site. The laws of some countries provide additional rules or rights, set out below. If you live in a country not listed, the general rules of this Policy apply.
If you are in the United Kingdom
If you are in the United Kingdom, you also have the rights described in section 15 under the UK GDPR and the Data Protection Act 2018. You can exercise them by writing to privacy@thebridgettmt.com.
Complaints. You can make a complaint to the Information Commission (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk. We recommend contacting us first, as we may be able to resolve the issue more quickly.
If you are in Switzerland
The Federal Act on Data Protection (FADP) of 25 September 2020 also applies.
Disclosure of data abroad. Your data may be disclosed to the following countries: Member States of the European Union and of the European Economic Area, United Kingdom (countries with adequate protection under Annex 1 of the Data Protection Ordinance); United States (to providers certified under the Swiss-U.S. Data Privacy Framework and, in other cases, on the basis of the Standard Contractual Clauses recognised by the Federal Commissioner). The list of providers is in sections 12 and 13.
Cookies. You can object at any time to the use of tools that are not strictly necessary with the "Cookie preferences" button.
Complaints. You can contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch.
If you are in France
Children. In France a child can consent alone to online services from the age of 15; under 15, consent is given jointly by the child and the holder of parental responsibility (Article 45 of Law no. 78-17 of 6 January 1978). Our forms are reserved for adults.
Cookies. You can refuse all non-essential tools with a button presented at the same level and with the same appearance as the accept button. We keep your choice, whether consent or refusal, for 6 months (180 days); after that we ask you again.
Marketing phone calls. We call you to offer our programmes only if you have given us your prior consent (Article L.223-1 Code de la consommation). Consent is valid for a maximum of 12 months and you can withdraw it at any time, including verbally during the call. We keep proof of consent for 3 years.
Post-mortem instructions. You can give us instructions on the retention, erasure and disclosure of your data after your death (Article 85 Law 78-17) by writing to privacy@thebridgettmt.com.
Complaints. You can contact the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
If you are in Spain
Children. In Spain a child can consent alone to the processing of their data from the age of 14 (Article 7 Ley Orgánica 3/2018). Under 14, the consent of the parent or guardian is required. Our forms are reserved for adults.
Marketing communications. We send you marketing communications by email and call you to offer our programmes only with your consent. We respect advertising exclusion systems (Lista Robinson, Article 23 LOPDGDD).
Complaints. You can contact the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, aepd.es.
If you are in Germany or Austria
Children. The age for consenting alone to online services is 16 in Germany and 14 in Austria. Our forms are reserved for adults.
Cookies. We store information on your device, or access it, only if strictly necessary to provide the service you requested or with your consent (§ 25 TDDDG; § 165 TKG 2021).
Advertising. We contact you by email or phone for promotional purposes only with your prior and express consent.
Complaints. You can contact the data protection authority of your Land (list at bfdi.bund.de) or, in Austria, the Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, dsb.gv.at.
If you are in Belgium, the Netherlands or Luxembourg
Children. The age for consenting alone to online services is 13 in Belgium and 16 in the Netherlands and Luxembourg. Our forms are reserved for adults.
Marketing calls. In Belgium we do not call numbers registered on the "Ne m'appelez plus / Bel me niet meer" list, unless you have given express consent. In the Netherlands we call you for marketing purposes only with your consent.
Complaints. Belgium: Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Bruxelles, autoriteprotectiondonnees.be. Netherlands: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl. Luxembourg: Commission nationale pour la protection des données, 15 Boulevard du Jazz, 4370 Belvaux, cnpd.lu.
If you are in another country
If you are in another Member State of the European Union or the European Economic Area, the GDPR and your country's national law on cookies and electronic communications apply. You can contact your country's authority (list at edpb.europa.eu). If you are outside Europe, we process your data in accordance with the GDPR, which applies to us as a controller established in Malta. The laws of your country may also apply: for any question, write to us at privacy@thebridgettmt.com.
For any question about this Policy: privacy@thebridgettmt.com.