Effective date: 27 August 2026
1. Who is responsible for processing
The data controller is Laszlo Feher, operator of UpSkillCorp in France.
Designated public contact and privacy-rights address: info@upskillcorp.fr. Mailbox delivery has not yet been confirmed.
2. Scope of this policy
This policy covers:
- visits to the public UpSkillCorp website;
- direct contact initiated through the email link on the website; and
- the internal, single-user UpSkillCorp Analytics tool used with UpSkillCorp's own authenticated business account.
3. Information processed
Public website
The website does not provide user accounts or a contact form and does not include advertising pixels, third-party audience analytics, embedded social widgets or remote fonts. The hosting infrastructure may create technical server logs containing information such as an IP address, date and time, requested path, response status, browser user-agent and diagnostic security events.
Direct email
If a person chooses to send an email, the controller receives the sender's email address and whatever identity, message content or attachments the sender voluntarily provides. Providing information beyond what is needed for the request is discouraged.
Internal own-account reporting
The internal app is intended to process data available through authorised API access for the UpSkillCorp account only. Depending on the metrics made available and approved scopes, this may include Pin and Board identifiers, content metadata, publication dates, aggregate performance metrics such as impressions, saves and outbound clicks, and timestamps for internal reports. The app is not intended to access general users' Pins or Boards, manage advertisements or collect account passwords.
4. Purposes and legal basis
Processing is limited to the purposes below and is based on the operator's legitimate interests:
- Website operation and security: administering the service, diagnosing faults and protecting the website and server against misuse.
- Direct enquiries: receiving, administering and responding to messages voluntarily sent to the public email address.
- Internal reporting: obtaining and maintaining authorised API access and understanding the performance of content on UpSkillCorp's own authenticated account for internal planning.
These interests are pursued with a deliberately limited website, minimum API permissions, no public user accounts and no access to other users' Pins or Boards. The public website does not use consent as a basis because it does not set non-essential cookies or operate a consent-based collection feature.
5. Retention
- Server logs: 14 days under the active daily Nginx log-rotation configuration.
- Internal analytics snapshots: 12 months, subject to platform terms and any shorter period required by law or operational need.
- Direct emails: kept only for as long as reasonably needed to answer the request and meet any applicable legal obligations.
Information is deleted or anonymised when it is no longer required, unless a longer period is required by law or needed for the establishment, exercise or defence of legal claims.
6. Recipients and service providers
Access is limited to the UpSkillCorp operator and service providers that are necessary to run the website and app. The public site is hosted by OVH SAS. Pinterest provides the external account and API services used by the internal reporting app. Information is not sold and API information is not shared with advertising services or unrelated third parties.
Providers may process limited information under their own terms and privacy notices. Their role, location and contractual safeguards must be reviewed whenever the service configuration changes.
7. International transfers
The public website does not transmit visitor information to Pinterest. The internal reporting app may communicate with Pinterest systems under Pinterest's terms and privacy documentation. If a service provider processes information outside the European Economic Area, the processing must be covered by the safeguards required by applicable data-protection law. The operator will review this notice if the providers or actual data flows change.
8. Security
Reasonable technical and organisational measures are used to protect information, including encrypted HTTPS transport for the public site, restricted server access, minimum API permissions, private credential storage, security updates and access logging. No internet transmission or storage system can be guaranteed to be completely secure.
9. Rights
Subject to applicable law, individuals may have rights of access, rectification, erasure, restriction, objection and data portability. Because the processing described here relies on legitimate interests, individuals may also object to it. The designated request address is info@upskillcorp.fr; delivery must be confirmed before relying on it for a time-sensitive request. Additional information may be requested only where reasonably necessary to verify identity.
Individuals may also lodge a complaint with their competent data-protection authority. In France, this is the CNIL.
10. Cookies and similar technologies
The current public website does not set cookies or use browser storage, advertising tags or third-party analytics. It therefore does not display a cookie-consent banner. If non-essential cookies or similar technologies are added later, this policy and the consent mechanism must be updated before those technologies are enabled.
11. Changes to this policy
This policy may be updated to reflect changes in the website, the app, providers or applicable requirements. The effective date at the top of the page will be updated when a material revision is published.