Privacy Notice

1. Who we are (the data controller)

The data controller responsible for your personal data is Open Learning AI, which operates the brand Open Learning AI and the website pmopenlearning.eu.

Registered controller entity name and address: TODO: founder to confirm the registered legal entity name, company number, and registered address of the data controller.

If you have any question about this notice or about how your data is handled, contact us at hello@pmopenlearning.eu.

2. What this site is for

Open Learning AI is an annual membership that helps project managers and their teams build and evidence AI literacy to the EU AI Act Article 4 standard. This is professional training, not legal advice, and not an official EU certification. It helps your team build and evidence AI literacy; your organisation remains responsible for its own compliance.

On this site you can reserve a founding seat with a fully-refundable €49 deposit. Reserving involves a payment at checkout and, afterwards, a short optional survey. The sections below explain what data each of those steps involves.

3. What data we collect

We keep this to the minimum we need. We collect:

• Reservation and contact details. Your full name and work email, which you provide at checkout and on the post-deposit survey, so we can hold your seat and contact you about the founding cohort.
• Survey answers. The short answers you give on the post-deposit survey, such as your country, your role or industry, which membership you are considering, whether your organisation has an AI-literacy or AI-use policy, what is driving your interest, whether you would present a case to the cohort, and how you heard about us. These help us decide whether to run the cohort and shape what it covers.
• Payment data. Your €49 deposit is taken by our payment processor, Stripe. Card and billing details are collected and processed by Stripe, not by us. We receive only confirmation of the transaction and the limited details needed to manage your reservation and any refund (such as your email, country, and an order reference). We never see or store your full card number.
• Analytics and cookie data. If, and only if, you accept analytics cookies, we and our analytics and advertising providers set cookies and collect data such as pages viewed, approximate location, device and browser type, and how you arrived at the site. This is tagged to a campaign identifier so we can measure this specific campaign. See section 7 on cookies.

We do not ask for special-category data (such as health, religion, or political views) and you should not send it to us. We collect only the fields listed above; we do not add extra fields "just in case".

4. Why we use your data, and our legal basis

Under the GDPR we must have a lawful basis for each use. Ours are:

Where we rely on consent, you can withdraw it at any time (see section 8); withdrawing consent does not affect processing we already carried out lawfully before you withdrew.

5. Who else processes your data

We use a small number of trusted service providers (processors) to run the site. Each handles only the data needed for its role, under our instructions:

• Stripe: our payment processor. It processes your payment, collects and stores your billing and card details, and executes refunds on our instruction. Our Stripe account is held with Stripe, Inc. (United States); payments from the EU may be processed through its EU affiliate, Stripe Payments Europe, Ltd.
• Tally: the forms tool that hosts the Article 4 Readiness Check and the post-deposit survey, and stores the answers you submit.
• Meta: provides the Meta Pixel, which (only after you accept analytics cookies) measures visits and campaign results.
• LinkedIn: provides the LinkedIn Insight Tag, which (only after you accept analytics cookies) measures visits and campaign results.
• Our email tool: used to email you about your reservation and the cohort. We have not sent any cohort email yet; we will name the provider here before the first one goes out.
• Cloudflare Pages (Cloudflare, Inc.): the static hosting provider that serves this website and processes the basic server logs needed to deliver it securely.

Some of these providers process data outside the European Economic Area, mainly in the United States. Where they do, the transfer is protected by an appropriate safeguard: where the provider is certified under the EU–U.S. Data Privacy Framework we rely on the European Commission's adequacy decision for it, and otherwise on the Commission's Standard Contractual Clauses.

We do not sell your personal data, and we do not share it with anyone other than the providers listed above except where the law requires us to.

6. How long we keep your data

We keep your data only as long as we reasonably need it:

• Reservation and survey data is kept while your reservation is active and the founding cohort decision is being made, and for at most 12 months after that decision. If the cohort does not run, or you ask us to delete your data, we remove it promptly.
• Payment and transaction records are kept by us and by our payment provider for as long as accounting and tax law requires.
• Analytics data is retained according to the retention settings of each analytics provider, and only if you accepted analytics cookies.

When we no longer need your data, we delete it or anonymise it.

7. Cookies and consent

We use two kinds of cookies. Essential cookies make the page work and remember your cookie choice; these are always on because the site cannot function without them. Analytics and marketing cookies (the Meta Pixel and LinkedIn Insight Tag) are never set until you accept them in the cookie banner. If you decline, or simply do not accept, those tags do not load at all.

You can change your mind at any time. To withdraw or change your cookie consent, use the button below; it clears your stored choice and shows the banner again so you can re-decide.

Your cookie choice has been reset. The banner will appear so you can choose again.

8. Your rights

Under the GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectification: ask us to correct data that is wrong or incomplete.
• Erasure: ask us to delete your data where there is no overriding reason to keep it.
• Objection: object to processing we base on legitimate interest.
• Withdraw consent at any time, for marketing emails and for analytics cookies, without affecting processing already carried out.

You also have the right to restrict processing and to data portability where those apply. To exercise any of these rights, email hello@pmopenlearning.eu. We will respond within the time the GDPR allows.

If you believe we have handled your data unlawfully, you have the right to complain to your local EU data protection authority. We would appreciate the chance to resolve it with you first.

9. Changes to this notice

We may update this notice as the programme and our providers are finalised. When we make a material change, we will update the date at the top of this page.