Data Controller
| Item | Detail |
|---|---|
| Controller | Sujata Agarwal, trading as LinguaSUpra |
| Address | Um Trenker 19, L-6962 Senningen, Luxembourg |
| hello@linguasupra.com | |
| Phone | +352 661 502 425 |
What We Process, Why, and On What Legal Basis
| Data / Activity | Purpose | Legal basis (GDPR) |
|---|---|---|
| Server / access log data (IP address, timestamp, browser, referrer URL) | Secure, stable technical operation of the website; detecting and investigating misuse | Art. 6(1)(f) — legitimate interest |
| Enquiries by email, phone, or WhatsApp (name, contact details, message content) | Responding to your enquiry | Art. 6(1)(b) pre-contractual steps, or Art. 6(1)(f) legitimate interest |
| Booking data via Cal (name, email, selected date/time, notes) | Scheduling and managing your appointment | Art. 6(1)(b) pre-contractual steps |
| Client and coaching records (role, sector, objectives, session notes) | Designing and delivering your coaching programme | Art. 6(1)(b) contract performance |
| Billing data (name, billing address, VAT details, payment records) | Invoicing; Luxembourg accounting and tax compliance | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation |
| Analytics data via Google Analytics 4 (see §2.4) | Understanding website usage to improve the site | Art. 6(1)(a) — consent via cookie banner |
WhatsApp — Additional Notice
WhatsApp is provided by WhatsApp Ireland Limited, part of the Meta group. When you message us via WhatsApp, your phone number and message content are also processed by WhatsApp/Meta under Meta’s own privacy policy, over which we have no control. If you prefer your data not to be processed by Meta, please contact us by email instead.
Google Analytics 4 — Detailed Notice
With your consent, given via the cookie banner, this website uses Google Analytics 4 (“GA4”), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
| Aspect | Detail |
|---|---|
| Purpose | Statistical analysis of website usage (pages viewed, session duration, traffic sources) to improve site content and performance. |
| Data collected | Usage and interaction data collected via cookies (see §3.2); GA4 does not log or store your full IP address. |
| Legal basis | Art. 6(1)(a) GDPR — your consent, given through the cookie banner before any GA4 cookie is set. |
| Retention | Event-level data is retained for 14 months, after which it is automatically deleted (GA4 configured retention setting). |
| International transfer | Google may process data outside the EEA. Transfers rely on the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses, as implemented by Google. |
| Google Analytics property / measurement ID | [PLACEHOLDER — GA4 Measurement ID to be inserted once the property is created, e.g. G-XXXXXXXXXX] |
| Opt-out | You may install the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout), or decline analytics cookies via the cookie banner. |
| Google’s own policy | See Google’s Privacy Policy at policies.google.com/privacy for how Google itself processes data as part of providing GA4. |
Recipients and Processors
| Recipient | Role / Purpose |
|---|---|
| Lovable (Lovable Labs, Inc.) | Website hosting and infrastructure |
| Cal | Appointment scheduling |
| Google Ireland Limited | Website analytics (Google Analytics 4), only after consent |
| Email service provider | Sending and receiving business email at hello@linguasupra.com |
| WhatsApp Ireland Limited (Meta) | Messages you initiate via WhatsApp |
| Accountant / tax adviser | Invoicing and Luxembourg tax compliance, where necessary |
Each recipient acting as our processor is bound by appropriate data-processing terms under Art. 28 GDPR. We do not sell personal data, and we do not share personal data with third parties for their own independent marketing purposes.
International Data Transfers
Where a provider listed above processes data outside the European Economic Area — in particular Google (GA4) and Meta (WhatsApp) — the transfer relies on an adequacy decision of the European Commission under Art. 45 GDPR, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses under Art. 46 GDPR, or (for Google) the EU–U.S. Data Privacy Framework. A copy of the relevant safeguard can be requested at hello@linguasupra.com.
Retention Periods
| Data Type | Retention Period |
|---|---|
| Server log data | Automatically deleted or anonymised within approximately 30 days, unless needed to investigate a specific security incident |
| Enquiry data not leading to a client relationship | Deleted no later than 12 months after last contact, or earlier on request |
| Client and coaching records | Retained for the duration of the business relationship, then per statutory periods below |
| Invoicing / accounting data | Up to 10 years, as required by Luxembourg commercial and tax law |
| Google Analytics 4 event data | 14 months (see §2.4) |
Your Rights
| Right | What It Means |
|---|---|
| Access (Art. 15) | Request confirmation of, and access to, the personal data we hold about you. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete data. |
| Erasure (Art. 17) | Request deletion of your data, where a legal ground for erasure applies. |
| Restriction (Art. 18) | Request that we limit how your data is processed in certain circumstances. |
| Portability (Art. 20) | Receive your data in a structured, commonly used, machine-readable format. |
| Objection (Art. 21) | Object to processing carried out on the basis of legitimate interest. |
| Withdraw consent | Withdraw consent at any time, without affecting processing carried out before withdrawal. |
To exercise any of these rights, contact hello@linguasupra.com. We will respond within the timeframe required by the GDPR (generally within one month).
Automated Decision-Making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
Data Security and Breach Notification
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, proportionate to the nature of the data processed. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNPD without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Art. 33 GDPR, and will notify affected individuals directly where the breach is likely to result in a high risk, in accordance with Art. 34 GDPR.
Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The competent authority in Luxembourg is:
- Commission Nationale pour la Protection des Données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg — www.cnpd.lu
Obligation to Provide Data
Provision of personal data is generally voluntary. However, certain data — such as contact details for an enquiry, or billing information for a paid engagement — is necessary to respond to you or to perform a contract; without it, we may be unable to provide the requested service.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The version published on this website is always the current and applicable one.