Privacy Policy

Introduction

In this and the following section summaries, we have placed the legal information in a more accessible and abbreviated form. For complete information, please read the text in the section to the right.

This Policy is intended to help you understand:

why we collect your personal data;
how we collect, use and store your personal data;
which rights relating to your personal data you have;
how you can exercise the rights relating to your personal data;
how we use cookies and other tracking technologies;
how we share and disclose your personal data;

Activesecon SL is located in Spain.

This Privacy Policy (“Policy”) describes the different ways Activesecon SL (“we”, “us”, “our”, “Company”, “Let’s Shake Hands”, “LSH”) may collect, use, and share information obtained when you use Let’s Shake Hands mobile application (the “App”), our website https://letshakehands.com/ (the “Website”), interact with us via our social media websites such as Facebook, Instagram, Twitter (“social media”), and messengers such as Telegram (including via chatbots) or WhatsApp (“messengers”), or provide us with information about yourself via any other way. Such treatment may include, but is not limited to, the following:

collection;
recording;
organization;
storage;
structuring;
adaptation;
alteration;
retrieval;
consultation;
use;
disclosure by transmission;
dissemination or otherwise making available;
alignment or combination;
restriction; and
erasure or destruction.

You can be our visitor or user (mentor or student):

You are a visitor when you merely browse our Website and/or submit your personal data via the Website’s online chat or otherwise without having an account in the App;
You are a user (mentor or student) when you have registered an account in the App and share your personal data with us when you use our App or Website or submit your personal data via our social media accounts, email, contact us for assistance, leave us feedback regarding our App or Website while having an account in the App.

When you submit your personal data to us, you may be asked to consent to our processing of the personal data you provide as explained in this Policy to enable us to provide you with the information requested, if no other legal ground can be used.

Definitions

To facilitate your understanding of this Policy, we explain the usage of the definitions listed here in accordance with the GDPR.

We use the following definitions in this Policy:

“data controller” means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data is processed.

“data processor” means the natural or legal person who processes personal data on behalf of the data controller.

“data subject” is any living individual who is using our Website and/or App.

“personal data” means any information relating to you and helping identify you (directly or indirectly) such as your name, last name, email, location data, etc.

“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“joint controllers” means two or more controllers jointly determining the purposes and means of processing.

The definitions of terms used within this Policy are taken from the GDPR.

Data Collection

We collect and process the information about you or obtained from you in accordance with this Policy. In this section, you can learn more about what personal data may be collected when you visit the website, use our application, or interact with us in other ways.

We act as a controller in relation to the different categories of personal data.

We collect the information through our App, Website, our social media accounts, messengers, email and process it as a data controller. In particular, we collect:

(a) Visitor Information. We can collect some personal data when you submit your personal data via the Website’s forms, social media, messengers, chatbots, email to contact and/or provide feedback on our App or Website. Such data may include name, email, and other information you may provide us via available contact options.

(b) Cookies Information. On our Website, we may use cookies and other tracking technologies for a variety of purposes: for analytics, marketing activities, remembering your preferences, and other purposes. Such use may involve the transmission of information from us to you and from you to a third party website or us. To learn more regarding our use of cookies please see the ‘Use of Cookies’ section of this Policy.

(c) Authentication Token Information. When you create an account in the App through the ‘Sign In with Google’, ‘Sign In with Facebook’, ‘Sign In with Apple’, or ‘Sign In with Twitter’ button, we collect encrypted Gmail or Facebook authentication token obtained from Google LLC, Meta Platforms, Inc., Apple Inc., or Twitter Inc. respectively. We can obtain the following information about you via such a token: email address .

(d) Contact Information. When you create an account, we collect certain information about you that allows us to provide you with services requested: name, surname, age, country, grade level, language of education, contacts for communications (WhatsApp, Viber, Telegram, Facebook, or Instagram).

(e) Automatically Collected Information. When you use our App, we collect certain information about you and your device automatically, including, device ID, current time, location, and time zone. The application downloads information about user images, user contact lists, and collects their images for use in the application.

(f) In-App Rating Information. After every class, students are able to rate mentors on a scale from 1 to 5. An average of those ratings is associated with a mentor’s account and can be displayed to other users. Mentors can also be assigned different in-App levels depending on the number of lessons they have conducted.

We use the personal data we collected and the personal data you provided us with or requested us to collect only for the purposes listed in this Policy. We may share your personal data with third parties solely for the purposes listed herein.

We DO NOT sell your data. We DO NOT use automated decision-making and profiling.

We DO NOT intentionally collect and process any sensitive personal data. Please, refrain from sharing your or third-party sensitive personal data with us.

Grounds for processing

Our grounds for processing your personal data are:

your consent;
our legitimate interests;
performance of a contract;
our legal obligations.

We do NOT intentionally collect and process sensitive personal information. Please, refrain from sharing your sensitive personal data when you provide information to us through Website, App, or our social media accounts.

We collect and process your personal data in accordance with the provisions of the GDPR.

GDPR provides an exclusive list of lawful bases allowing us to process your personal data. During personal data processing we rely only on four of them, namely:

Article 6.1(a): consent

We collect the information you choose to give us, and we process it under your consent. You may withdraw your consent to the processing of your personal data at any time.

Please remember that the withdrawal of consent does NOT automatically mean that the processing before the withdrawal is considered unlawful. You may withdraw the consent to the processing of your personal data by sending us an email at [email protected], or by contacting us in any other way convenient for you.

Article 6.1(f): legitimate interests

As a data controller, we process your personal data to prevent any fraudulent actions and to provide you with the desired services. Also, we need some data to enable our Website to run smoothly and give you a pleasant user experience. We use only strictly necessary data under this legal ground.

Article 6.1(b): performance of a contract

When you provide us with the personal data during the registration of the account on the Platform; this can be deemed as your request to form a contract or to perform a contract between you and us. However, we may ask you to give us clear consent in case of doubt.

Article 6.1(c): legal obligation

We process your personal data to fulfil the applicable legal obligations arising mainly from the GDPR. In the event of you sending us the request to fulfil the rights granted by the GDPR, we may ask you for some personal data we already have to identify you and achieve compliance with the applicable law.

We DO NOT sell your data. We DO NOT use automated decision-making and profiling.

We DO NOT intentionally collect and process any sensitive personal data. Please, refrain from sharing your or third-party sensitive personal data with us.

Use of Your Personal Data

As a data controller, we use your personal data for the purposes listed in the table below where we also detail the type of personal data processed, legal bases we rely on to do so, third parties with whom we may share your personal data:

Purposes	Type of personal data	Legal grounds	Third Parties recipients
Creating an account in the App	(c) Authentication Token Information (d) Contact Information	Performance of a contract (Article 6(1)(b))	Contractors, Google Cloud
Maintenance of the account in the App	(c) Authentication Token Information (d) Contact Information (f) In-App Rating Information (for mentors only)	Performance of a contract (Article 6(1)(b))	Contractors, Google Cloud
Providing access to App features	(c) Authentication Token Information (d) Contact Information (f) In-App Rating Information (for mentors only)	Performance of a contract (Article 6(1)(b))	Contractors, Google Cloud
Communication with visitors and customers	(a) Visitor Information (c) Authentication Token Information (d) Contact Information	Your consent (Article 6(1)(a))	Contractors, Google Cloud
Marketing (to suggest and notify you about news of our platform (Website and App) and conduct other marketing activities, such as personalised advertising	(b) Cookies Information (c) Authentication Token Information (d) Contact Information	Your consent (Article 6(1)(a))	Meta Platforms, Inc., Google Ads, Google Cloud, Contractors
Analytics and developing (for optimising and improving our Website)	(b) Cookies Information (d) Contact Information (e) Automatically Collected Information	Your consent (Article 6(1)(a)) Our legitimate interest (Article 6(1)(f))	Microsoft Corporation, Google Analytics, Google Cloud, Contractors
Complying with the law or legal process	(a) Visitor Information (b) Cookies Information (c) Authentication Token Information (d) Contact Information (e) Automatically Collected Information (f) In-App Rating Information (for mentors only)	Legal obligation (Article 6(1)(c)) Our legitimate interest (Article 6(1)(f))	Meta Platforms, Inc., Google LLC (Google Analytics, Google Ads, Google Cloud), Microsoft Corporation, Contractors

Use of Cookies

Cookies are small text files containing information that websites send to your browser. They are stored on your device, which might be a personal computer, a mobile phone, a tablet or any other device.

We use them for various purposes, as you can read more about in this section.

We use cookies and other tracking technologies on our Website for a number of purposes, including enabling the functionality of the Website, enhancing user experience, understanding the online behaviour of people who interact with our Website, and delivering relevant interest-based advertising to you on third-party websites.

We do not use cookies to directly identify you. We only use cookies for the following purposes:

Necessary: these cookies and other tracking technologies are essential for your use of the Website and our compliance with applicable data protection laws. We can use them to provide the basic functions of the website.

Preferential: these cookies enable our Website to remember choices that you make, i.e. to optimise the chatbot functionality or language choices.

Analytics: these cookies help us to understand how users interact with our website (e.g., page visits and page load speed) by collecting information anonymously to avoid your identification. Their sole purpose is to improve website functions.

Marketing: these cookies and other tracking technologies are used to deliver relevant online advertising to you on other websites. These cookies are placed by us and selected third parties and enable adverts to be presented to you on third party websites.

Data Security, Integrity and Retention

We will store and process your personal data for as long as needed to provide you or other customers with the services.

Also, you may request erasing of your personal data by contacting us in any way convenient for you.

As a data controller, we store and process your personal data until we do not need it for any of the purposes defined in this Policy unless longer storage is required or expressly permitted by law. Usually, we retain your data while your account is actively used, but we will delete your personal data if we notice that you have not used your account for a long time or if you ask us to delete your personal data. Some categories of data can be stored for a shorter time: for example, cookies expire in a few days, weeks or months as they are programmed to (or earlier if you clean your browser’s cache).

We may not delete or anonymize your data if we are compelled to keep it to comply with the law or legal process.

Despite any of the aforementioned periods of data storage, you may request to delete your personal data by sending us an email at [email protected] or contacting us via another way convenient for you.

We have implemented appropriate organisational, technical, administrative, and physical security measures that are designed to protect your personal data from unauthorised access, disclosure, use, and modification. We regularly review our security procedures and policies to consider appropriate new technology and methods.

Data Sharing and Disclosure

We only transfer your personal data to third parties according to the requirements of GDPR.

Where possible and necessary, we always enter into data processing agreements (DPAs) and Non-Disclosure Agreements (NDAs) with our third parties.

We may disclose the personal data to third parties, including those located outside the EU and EEA, provided that proper safeguards are put in place and the applicable local laws do not put your rights at risk.

We may share your personal data as a data controller to joint controllers and data processors in accordance with provisions specified hereafter.

Sharing

In some cases we may act as a joint controller jointly with other joint controllers, for example, while using Facebook pixel. In respect to this case of personal data processing, we are the party to the Facebook Joint Controllership Addendum. In such a case, a data subject may exercise their rights under the GDPR in respect of and against both other joint controllers and us.

Google LLC and we act as independent controllers of personal data across Google LLC’s digital marketing services such as Google Ads.

Sharing data with data processors

There are many features necessary to provide you with access to our Website and App that we cannot complete ourselves, thus we seek help from third parties. We may grant some service providers access to your personal data, in whole or in part, to provide the necessary services.

Therefore, we may share and disclose your personal data to other data processors:

Microsoft Clarity (Microsoft Corporation, USA) to collect data on the user’s navigation and behaviour on the Website. You may read its Privacy Policy here;
Google Analytics (Google LLC, USA): to analyse statistical data on how the visitor uses the Website in order to improve our Website’s functionality, to improve advertisement campaigns. You may read Google LLC’s Privacy Policy here.
Google Cloud (Google LLC, USA): to provide secure transfer and storage of personal data on the servers. You may read Google LLC’s Privacy Policy here.

During our business activities we may engage different specialists which may receive your personal data, including technical, sales and marketing specialists, to provide you with better customer service. Also, we may disclose some of your personal data to our outsource legal and accounting professionals to make our business accurate and transparent. The abovementioned specialists are collectively referred to as Contractors .

We may transfer your personal data to countries outside the EU and EEA (for example, the USA) that are not determined to offer an adequate level of data protection on the basis of article 45 of GDPR (adequacy decision) with appropriate safeguards as determined under the GDPR.

We only transfer your personal data to third parties within requirements under the GDPR. Where possible and necessary, we always enter into Data Processing Agreements (DPAs) and Non-Disclosure Agreements (NDAs) with them and treat personal data transfer seriously. Where the Contractor has an appropriate data processing agreement in place, Company may adjoin such data processing agreement. If so, Company and the Contractor may regulate the transfer of the personal data to such Contractor by means of this data processing agreement.

Transferring your personal data outside of the European Economic Area

We may transfer your personal data to third countries outside the EU and the EEA under Article 46 of the GDPR on the appropriate safeguards, including the standard contractual clauses (SCC).

For transfers to countries that do not fall under requirements of Article 45 of the GDPR on the adequacy of the level of protection, we may transfer your personal data to the third countries outside the EU and the EEA, including the onward transfers of the personal data from the third countries to another third countries, under Article 46 of the GDPR with the appropriate safeguards, including the SCC.

We disclose your personal data to the countries outside the EU and the EEA, in compliance with our internal procedures regarding international transfers in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of natural and legal persons.

We put supplementary technical and organisational measures in place when transferring data outside the EU and the EEA. e.g. prior assessment of the service supplier’s reliability and personal data protection practices, encryption of the transferred personal data, prompt reacting to any threats to confidentiality, integrity and availability of the personal data, conducting transfer impact assessments (TIA) when necessary, etc.

Your Rights under the GDPR

You may exercise the following rights under the General Data Protection Act (GDPR):

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to object to processing;
right to data portability;
right to lodge a complaint;
right to consent withdrawal.

You may exercise the following rights by submitting your request at [email protected]

When we act as a joint controller with regard to particular processing of personal data, you may exercise your rights under the GDPR in respect of and against both other joint controller(s) and us.

Rights under the GDPR

right of access means that you may ask us to send you the copy of your personal data collected together with information regarding the nature, processing and disclosure of that personal data;
right to rectification means that you may ask us to update and correct the false data, missing or incomplete personal d
right to erasure (to be “forgotten”) means that you may ask us to delete your personal data collected, except insofar it is prohibited by appropriate laws.
right to restriction of processing means that you may ask us to restrict processing where:

your personal data is not correct or outdated;
the processing is unlawful.

right to object to the processing means that you may raise objections on grounds relating to your particular situation;
right to data portability means that you may ask us to transfer a copy of your personal data to another organisation or to you;
right to withdraw the consent when your personal data processed on a basis of your consent;
right to lodge a complaint with the supervisory data protection authority pertaining to the processing of your personal data.

You may submit the complaint to the supervisory authority of your place of residence within the EU or to the data protection authority stated in this Policy.

Please, note that we may need to confirm your identity to process your requests to exercise your rights under the GDPR. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.

Data Protection Authority under the GDPR

We kindly ask you to contact us directly so that we can quickly answer your question.

We kindly invite you to share your concerns with us in the first place regarding any issue related to your personal data processing. You may contact us to address your inquiries: [email protected].

Supervisory Authorities under GDPR:

In case of any questions regarding data protection, you can apply to the supervisory authority in your place of residence or domicile. We will cooperate with the appropriate governmental authorities to resolve any privacy-related complaints that cannot be amicably resolved between you and us. You can find the full list of EU supervisory authorities through the link.

Children’s Privacy

Where you are a child under 16 in the EU, we need the consent of your parent (or another holder of parental responsibility, legal guardian) to allow you to use our App.

We undertake the best possible efforts to secure the processing of personal data belonging to the underage.

Children can use our App and we may ask their parents or other responsible adults who have responsibility for their wellbeing and best interests under the law (legal guardians) for consent to processing personal data of a minor (age, name, grade level, language of education) within the App.

Please note that if you are registering an account in the App for a child, please make sure to register an account using your own accounts (for signing up) and your contact details for communication .

Accordingly, we strongly advise you, if you are a child under the EU law, never to provide any personal data to our Company without your legal guardian’s consent.

At the same time , we ask that you provide a valid account and contact details when registering, as we may at any time ask for confirmation of your age or request a new parental consent in case of doubt.

In case of doubt about the validity of consent given, our support team may suspend the relevant user account until the circumstances have been clarified.

If you believe your child is participating in any activity that collects personal data without your consent, please feel free to contact us at [email protected] or via other available contact options.

At any time, you or your parents can refuse to permit us to collect further personal data from the child and can request to delete from our records the personal data we have collected in connection with children’s accounts in the App.

Changes to the Privacy Policy

We may change this policy from time to time due to the different purposes.

We will notify you on such material changes through means available to us.

This Policy may be changed from time to time due to the implementation of new updates, technologies, laws’ requirements or for other purposes. We will send notice to you if these changes are dramatic and where required by applicable laws, we will obtain your consent for the subsequent processing. In any case, we encourage you to regularly review this Policy to check for any changes.

Such notification may be provided via email, announcement published in our Website and by other means, consistent with applicable law.

How to Contact Us

Please contact us if you have any questions about our processing activities, this Privacy Policy, or your rights.

If you have a question related to this Privacy Policy, our processing activities, or your data subject rights under GDPR and other applicable laws, you can contact us directly using the following details :

Our email: [email protected].