Privacy statement · v2.0 · 5 August 2026 · Promote Freedom Foundation

Everything we hold ends.

What the Foundation holds about you through agora-ai.eu, on whose authority, who else sees it — and the date each thing is due to go.

12 things we could be holding about you, today

Each bar is one holding; its length is its term. Tap one to jump to its entry.

01 — the line of answer

Who answers

Not just who we are — who you go to, in what order, and who they answer to. The last link is a public authority, and it is meant to be used.

  1. Step one — the controller

    Promote Freedom Foundation

    A private foundation established in Belgium. It decides why and how personal data is processed through agora-ai.eu, and it is legally answerable for it. Agora AI Hub is a project of the Foundation, not a separate legal entity.

  2. Step two — where to write first

    The privacy contact

    Every request, question and complaint about your data starts here. We are not required to appoint a Data Protection Officer under Article 37 GDPR and have not appointed one; saying otherwise would create duties we have not taken on.

  3. Step three — if we get it wrong

    Tell us in writing, and give us the month

    Article 12(3) GDPR requires us to answer without undue delay and in any event within one month. We treat one month as the outside limit, not the target. If a request is genuinely complex we may take up to two further months, and we have to tell you why inside the first month.

  4. Step four — the authority above us

    Belgian Data Protection Authority

    You can complain to the APD / GBA at any time, in Dutch, French or German. It normally expects you to have raised the matter with us first — which is the whole reason step two exists. You can also complain where you live, and you can go to court.

02 — the standing question

What are you here as?

Nothing selected — the board below shows every holding, which is what a regulator or a journalist should see. Choose one or more and yours move to the front.

03 — the holdings

One card per thing we hold

Each has its own purpose, its own single legal basis, its own term and its own recipients — because a list of data over here and a list of legal bases over there is the most expensive drafting mistake in European data protection, and we would rather not repeat it.

Contract → legal obligation · 6(1)(b) → 6(1)(c)

Your order and its invoice

What you bought, what you paid, and the invoice. This is the one holding we cannot delete when you ask.

What exactly
Data
The item, the amount, the date, your billing name and address, and VAT details where they apply. We do not receive your full card number — it goes to the payment provider.
Two bases
While the order is fulfilled: performance of our contract (Art. 6(1)(b)). Once it becomes an accounting document: legal obligation (Art. 6(1)(c)) — Art. III.86 Code of Economic Law, Art. 315 CIR92, Art. 60 VAT Code.
Recipients
WooCommerce · our payment provider · our accountant · the tax authorities, if they ask.
Erasure
You can ask, and for this one we will have to say no. Article 17(3)(b) GDPR lets us refuse erasure where we need the data to comply with a legal obligation. We would rather tell you here than the day you ask.
If you don't
We cannot issue a lawful invoice without billing details, and cannot sell you anything without one.

Ends seven years after the close of the financial year it belongs to locked by law

Contract · Art. 6(1)(b)

Your account

Who you are on the platform and how you sign in.

What exactly
Data
Name, email, username, your password stored as a hash rather than as readable text, your role, and any profile fields you fill in.
Recipients
Hostinger (hosting, Frankfurt) · Tutor LMS (on our own server).
If you don't
An email address and a password are required. Everything on your profile is optional, including your real name.
Ending it
Close the account, or ask us. Removed from live systems within 30 days ; our host's backups run a 90-day rotation, which is how long a deleted account can persist in them.

Ends when you close it

Legitimate interest · Art. 6(1)(f)

A message you send us

Whatever you write in a contact form or an email, and the address we need to reply to.

What exactly
Our interest
Answering the person who wrote to us. We weighed this against your interests and concluded it does not override them, because we keep only what a reply needs and do not profile you. You can ask for that summary, and you can object.
Recipients
Fluent Forms · our mail relay · our mailbox provider pending . They carry it; they do not read it.
If you don't
We cannot reply to a message with no return address. Everything else in the form is optional.

Ends after 24 months pending

Contract · Art. 6(1)(b)

Your course record

Which courses you joined, how far you got, what you scored, and any certificate we issued.

What exactly
Decisions
Quiz marking compares your answer to a stored answer. That is arithmetic, not an automated decision about you under Article 22. If that ever changes, this card changes first.
Recipients
Hostinger · Tutor LMS · the instructor of that course.
Ending it
Goes with your account, plus 12 months so a certificate can be re-issued. Ask and we delete it sooner.

Ends with your account, plus 12 months

Your consent · Art. 6(1)(a)

The update list

Your email address, on a list, because you asked to be told when something happens.

What exactly
Data
Email address, your name if you gave it, and whether each mailing was delivered. Whether opens and clicks are recorded is pending — the inactivity rule below depends on the answer and both will be stated plainly.
If you don't
Entirely optional and never bundled. You can take a course without being on this list.
Ending it
The unsubscribe link in every email. One click, no reason, no login.

Ends when you unsubscribe

Legitimate interest

The security log

Every server records the requests it receives. Ours does too.

What exactly
Data
IP address, time, the address requested, browser string, and blocked or failed sign-in attempts.
Our interest
Keeping the site available and defending learner accounts against automated attack. Limited to request metadata, not used to profile you, deleted on a short cycle. Ask for the summary; object at any time.
Recipients
Hostinger (Frankfurt) · Wordfence (on our own server).

30 days pending

Your consent

Site statistics

How many people read a page. Only if you accepted statistics.

What exactly
Note
In Belgium there is no exemption for analytics, and we do not pretend there is.
Recipients
Pending — the tool will be named with its country and transfer mechanism, or this card will be deleted rather than left vague.

14 months pending

Contract

What you write in the platform

Forum posts, comments, assignment uploads.

What exactly
Who sees it
Course forums and assignments are configured to be visible only to people on that course and to instructors, and are not indexed by search engines. If you ever find course content reachable from outside, tell us — we treat that as an incident.
Ending it
Delete it yourself where the platform allows, or ask us. Others may already have read it — we can remove a record, not a memory.

With your account

Steps before a contract

An application to work or teach

What you sent so we could consider you.

What exactly
Recipients
The people making the decision, and no one else. Not shared with partners or funders.
What we ask
Only what the decision needs. We do not ask about health, beliefs, ethnic origin, political opinion, sexual orientation or criminal history, and you do not have to volunteer them.
Ending it
Deleted six months after the decision. Longer only if you tell us in writing you want us to come back to you — and then it rests on your consent, which you can take back.

6 months after the decision

Legitimate interest

Working correspondence

If you are a partner, funder, donor or journalist: your work contact details and our thread.

What exactly
Where we got it
From you, or from your organisation's public contact page. If we ever obtain your details elsewhere, Article 14 requires us to tell you the source, including whether it was publicly accessible — and we will, within one month.
If you don't
Nothing here is required of you. We can work with an organisation through a shared inbox.
Note
The financial record of a donation or grant is a separate holding, kept seven years like an invoice. This card is correspondence only.

24 months after our last contact

Strict necessity, then legitimate interest

Your language choice

Which language you are reading in.

What exactly
Storing it
Covered by the strict-necessity exemption in Article 5(3) ePrivacy, because you asked for the page in that language. Reading it back afterwards rests on our legitimate interest in not asking you again.
Recipients
Weglot .

This visit

04 — the hand-off

Where it goes

Every organisation outside the Foundation that touches any of it, by name, with the country and what allows the data to be there. Named — not "our trusted partners". A category is not a recipient.

  • Hostingerprocessor
    DoesRuns the server this site and the Academy live on.
    WhereFrankfurt, Germany
    What allows itOur contract requires processing in the EEA. Whether their support reaches it from outside is pending.
  • Tutor LMSsoftware on our server
    DoesAccounts, courses, progress, certificates.
    WhereOur own server · EEA
    What allows itNo transfer — learning data stays on our server.
  • Wordfencesoftware on our server
    DoesBlocks automated attacks and abusive sign-ins.
    WhereOur own server
    What allows itNo transfer for the log. Whether threat data leaves the server is pending.
  • WooCommercesoftware on our server
    DoesOrders, invoices, the shop.
    WhereOur own server · EEA
    What allows itNo transfer for the order record.
  • Fluent Formssoftware on our server
    DoesReceives and stores what you type into a form.
    WhereOur own server · EEA
    What allows itNo transfer.
  • Complianzsoftware on our server
    DoesAsks the cookie question, keeps the record of your answer.
    WhereOur own server · EEA
    What allows itNo transfer.
  • Our accountantindependent controller
    DoesKeeps the Foundation's books, as Belgian law requires.
    WhereBelgium · EEA
    What allows itNo transfer.
  • Weglotprocessor
    DoesServes the site in its other languages.
    Where
    What allows itPending — location and mechanism to be stated.
  • Our mail relayto be named
    DoesDelivers the emails we send you.
    Where
    What allows itPending — if outside the EEA this row will name the adequacy decision or safeguard, and how to get a copy.
  • Our mailbox providerto be named
    DoesHolds the mailbox your message arrives in.
    Where
    What allows it
  • Our payment providerindependent controller · to be named
    DoesTakes the payment. They see the card; we do not.
    Where
    What allows itFor its own anti-fraud duties a payment provider acts as a controller in its own right, under its own notice, which this row will link.
  • Statistics toolto be named or removed
    DoesCounts readers, if you accepted statistics.
    Where
    What allows itIf we run no statistics tool this row is deleted, not left vague.

05 — stated separately, because the law says it must be

You can tell us to stop.

Four holdings above — , , , and — run on our legitimate interest. That basis gives you a specific right, and Article 21(4) GDPR requires it to be presented clearly and separately rather than buried in a list. Those are buttons: each takes you to the holding it names.

Object at any time, on grounds relating to your particular situation. Write to the privacy contact and say what you are objecting to and why. We then have to stop — unless we can demonstrate compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend a legal claim. The burden of showing that is ours, and if we rely on it we will explain it in writing.

If we ever process your data for direct marketing, you can object at any time and we stop. No exceptions, no balancing, no reasons required.

06 — the request desk

Rights are worth what they cost to use

Pick one and this desk writes the request — the correct article, the correct address, the correct wording. Copy it, send it from your own email, and the clock starts.

Access — see what we hold

Article 15 GDPR

You are entitled to know whether we hold data about you and, if we do, to a copy of it, plus the purposes, the recipients, the retention, where we got it, and whether any decision about you is automated.

To: europe@agora-ai.eu Subject: Request under Article 15 GDPR — access Dear Promote Freedom Foundation, I am making a request under Article 15 GDPR. Please confirm whether you process personal data about me and, if so, provide a copy of it together with the purposes, the categories of data, the recipients, the retention periods, the source where you did not obtain it from me, and whether any automated decision-making is involved. I am writing from the email address I use with you. [your name]

One month to answer, as Article 12(3) requires — without undue delay, and one month as the outside limit. Two further months only if it is genuinely complex, and we must tell you why inside the first month. There is no charge; in the rare case where a request is manifestly unfounded or excessive, Article 12(5) lets us charge a reasonable fee or refuse, and if we ever do we will say which and why. We will not ask for a passport or an identity document as a matter of routine — if you write from the address on your account we will normally act on it.

07 — if telling us something could put you at risk

Leave these out of your message

Some of the people this work is for are displaced, are organising under pressure, or are being targeted for what they say. We do not need any of the following to answer you or to enrol you on a course — so keep them out, and watch them go.

  • your health
  • your religion or beliefs
  • your ethnic origin
  • your political opinions
  • your sexual orientation
  • your legal or immigration status
  • any criminal matter

Those are the categories the law treats as special. Everything below is what happens if one of them reaches us anyway.

If you already did

We won't pretend we didn't read it

We use it only for the matter you contacted us about, keep it to the smallest number of people who need to see it, and delete it as soon as that matter is closed — and in no case longer than 24 months from our last contact about it. It is not added to your course record and not counted in any statistic. The Article 9(2) condition we rely on is with counsel and will be named here.

The safer route

There is a quieter door

If you need to tell us something sensitive — because you need an adjustment to take part, or because being named would be a problem — write to the privacy contact directly rather than posting it, and say so at the top. You can take our courses under a name that is not your legal name.

The honest limit

We are not an advice service

Agora is an education and research project. We are not a legal-aid organisation, not a medical service and not an emergency service, and we cannot advise on asylum, immigration or legal status. If that is what you need, go to an organisation that does it — and do not send us your case file.

Photographs and quotes. We ask separately, in writing, before using anyone’s picture, name or words in our own materials — and you can withdraw that afterwards. Children. The Academy is built for adults and organisations. In Belgium a child can consent to an online service from the age of 13; below that we need the consent of whoever holds parental responsibility.

08 — the ledger of negatives

What we do not do

A specific negative you can check is worth more than a general promise you cannot. These describe the configuration today — if one changes, it changes here first, dated, in the record below.

  1. Sell personal data, or hand it to brokers.

    Not now, and there is no arrangement under which we could.

  2. Fingerprint your device or record your screen.

    No session-replay tool, no canvas or font fingerprinting. The cookie page scans your own device and reports anything it cannot account for — including against us.

  3. Make decisions about you by machine alone.

    No automated decision producing legal or similarly significant effects, as Article 22 means it. Quiz marking compares your answer to a stored answer; that is arithmetic.

  4. Load anything that tracks you before you say yes.

    Configured that way, and testable. In August 2026 we found trackers loading before consent and switched them off; the cookie register records it. What happened to the data collected in that window is being confirmed and will be stated here.

  5. Claim to be certified, audited or "fully GDPR compliant".

    We hold no Article 42 certification and have commissioned no independent audit. If we ever do, we will name who did it and when.

  6. Use your messages or course work to train AI models.

    Pending confirmation before publication — this line ships only if it is true of every tool in the stack, and is deleted rather than softened if it is not. Where you interact with an AI assistant on this site we tell you at the point of interaction, as Article 50 of the AI Act requires; that disclosure belongs there, not here.

No system connected to the internet can be made completely secure, and we do not claim otherwise. What we can describe is the configuration: traffic encrypted in transit, access limited by role, a web application firewall, and a commitment that if a breach is likely to result in a high risk to you we will tell you without undue delay, as Article 34 requires.

09 — the record

Every edition stays on file

Almost no organisation lets you see what its privacy policy used to say. Each version of this one keeps its own permanent address, with a line saying what actually changed.

  • v2.0 · 05-08-2026Current. New surface and card system; the objection right given its own block; the at-risk section rewritten; per-holding legal bases and terms replacing category lists; every processor named or marked pending; the registered seat corrected from the superseded Asse address; the enterprise number published.
  • v0.9 · 11-07-2026First published notice. Superseded — an out-of-date registered office and no retention period per category. Permanent archive URL pending.

How we tell you about changes

When something material changes, we tell registered users by email and everyone else by a dated notice at the top of this page, before it takes effect. We do not apply a new purpose to data we already hold without a lawful basis. Continuing to use the site is not treated as agreement to anything — a privacy notice is information we owe you, not a contract you sign.

This is the information Articles 13 and 14 GDPR require us to give you. It is not legal advice and not a warranty. Nothing here limits our obligations under data protection law or your rights under it; where this page and those rules disagree, those rules win. This notice has not yet been reviewed by an external lawyer — we would rather say so than imply a review that has not happened.

Promote Freedom Foundation · KBO 0762.524.324Terms · Cookies · Legal noticekept in the open