Privacy Policy

Data Controller

The data controller is ProfNova SAS. For any questions about your personal data, you may contact our Data Protection Officer (DPO) at: [email protected].

Data Collected

We collect the following categories of data:

• Identity data: surname, first name, email address, phone number
• Profile data: photo, biography, qualifications, subjects taught (tutors)
• Payment data: credit card information (processed by our secure payment provider Stripe)
• Usage data: IP address, browser type, pages viewed, connection timestamps
• Communication data: messages exchanged between students and tutors via the Platform

Purposes of Processing

Your personal data is processed for the following purposes:

• Managing your user account and authentication
• Connecting students with tutors
• Processing payments and invoicing
• Communication related to your bookings and account
• Improving the Platform and our services
• Complying with our legal and regulatory obligations

Legal Basis for Processing

In accordance with Article 6 of the GDPR, our processing is based on the following legal grounds: performance of a contract (service provision), your consent (non-essential cookies, marketing communications), our legitimate interest (security, service improvement), and compliance with our legal obligations (accounting, taxation).

Cookies

The Platform uses cookies to ensure proper functionality and improve your experience. Essential cookies are necessary for the Platform to function (authentication, security). Analytics cookies help us understand how the Platform is used. Preference cookies save your choices (language, theme). You can manage your cookie preferences at any time via the cookie banner or your browser settings.

Data Retention

Your personal data is retained for the duration of your registration on the Platform, then for 3 years after account deletion for dispute management purposes. Billing data is retained for 10 years in accordance with accounting obligations.

Your Rights

Under the GDPR and the French Data Protection Act, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data under the conditions set out in the GDPR
• Right to data portability: receive your data in a structured, machine-readable format
• Right to restriction: request limitation of the processing of your data
• Right to object: object to the processing of your data on legitimate grounds
• Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise your rights, contact our DPO at [email protected] or by post to our registered office. We will respond to your request within one month. In the event of disagreement, you may lodge a complaint with the CNIL (French Data Protection Authority).

Data Sharing

Your personal data may be shared with our payment providers (Stripe), our hosting and technical infrastructure providers, tutors or students as part of the matching process, and competent authorities where required by law. We never sell your personal data to third parties. Data transfers outside the European Union are governed by appropriate safeguards (standard contractual clauses).

Data Security

ProfNova implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration. These measures include encryption of data in transit (TLS) and at rest, strict access controls, and regular security audits.

Minors

The Platform may be used by minors under the responsibility and with the consent of their legal guardian. Minors' data benefits from enhanced protection in accordance with the GDPR.

Changes to the Policy

ProfNova reserves the right to modify this Privacy Policy. Any material changes will be notified to users by email or via the Platform.

Contact

For any questions about this Privacy Policy or to exercise your rights, you may contact our DPO: [email protected].