Legal
Privacy Policy
Intro
This statement comprises the Privacy Policy (the “Policy”) of BestDPO (the “BestDPO”; “we”; “us”), a privacy and AI governance school. We are a “Data Controller” and are required to comply with data protection law when handling your personal data.
This Policy explains how we collect and process information that personally identifies you or enables us to contact you (“Personal Data”). It covers the personal data of prospective students, students and mentees in connection with the educational services we provide.
This Policy does not cover the BestDPO presence on social media platforms, such as LinkedIn or Facebook. In the context of those platforms we are merely another user, and the privacy policies and terms and conditions of those platforms apply.
If you have any questions about this Policy, please contact us at bestdpo.edu@gmail.com.
What personal data do we hold about you, and why?
We only collect the personal data we need for the purposes set out below.
1. Enquiries and contact through our forms
When you complete a form on our website to express interest in our trainings, we collect your name, surname, email address and phone number.
We use this data to get in touch with you, to answer your questions about our courses, to discuss whether a programme is right for you, and to take the steps needed to enrol you as a student or mentee.
2. Delivery of the learning experience
When you enrol on one of our programmes, we use your name and email address to deliver the training itself: to send you course materials and joining details, to give you access to sessions and learning platforms, to communicate with you about your progress during the programme, and to issue any certificate of completion.
3. Marketing communications
Where you have given us your consent, we use your name and email address to send you information about our upcoming trainings, mentoring programmes, events and news.
You can withdraw your consent at any time (see Changing your preferences below). Withdrawing consent does not affect the lawfulness of the processing carried out before you withdrew it.
4. Analytics and improvement of our services
We analyse how our courses are used, so that we can understand which programmes are of interest, improve the content and structure of our trainings, and run our school effectively. Wherever possible we do this using aggregated or statistical information rather than data that identifies you.
We do not run website analytics, tracking pixels or advertising technologies. Our website sets no cookies on your device and loads no content from third parties, as explained in our Cookie Notice.
What is our legal basis for processing your personal data?
We can only process personal data if we have a legal basis for doing so.
| Purpose | Personal data | Legal basis |
|---|---|---|
| Responding to your enquiry and contacting you about our programmes | Name, surname, email, phone number | Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) |
| Delivering the training and mentoring you have signed up for | Name, email | Performance of our contract with you (Art. 6(1)(b) GDPR) |
| Sending you marketing communications | Name, email | Your consent (Art. 6(1)(a) GDPR) |
| Analytics and improving our services | Usage data | Our legitimate interests in understanding and improving our educational offering (Art. 6(1)(f) GDPR) |
Where we rely on our legitimate interests, we have considered whether those interests are overridden by your interests, rights and freedoms, and you have the right to object to this processing at any time (see What rights do you have).
We do not collect special categories of personal data, and we do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
Children
Our trainings are aimed at professionals and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18.
Who do we share your personal data with?
We do not sell your personal data. We share it only with service providers who help us run our school — for example our website and form provider, our email distribution provider, and the platforms we use to deliver online sessions. These providers act as our processors and may only use your data on our instructions.
We may also disclose personal data where we are required to do so by law.
Will personal data be shared outside the European Economic Area (EEA)?
In most circumstances personal data will not be transferred to countries outside the European Economic Area. Where a transfer does take place — for example because one of our service providers is established outside the EEA, or because our personnel access data while travelling on company-issued or company-approved devices with appropriate and adequate security — we ensure that an appropriate safeguard under Chapter V of the GDPR is in place, such as an adequacy decision or Standard Contractual Clauses.
You can request further information about these safeguards by writing to us at bestdpo.edu@gmail.com.
How do we protect your personal data?
We take the security of your personal data very seriously and have measures in place to protect it and to limit access to it. Access is restricted to those who need it to deliver our educational services. Where we share your personal data externally, we require the recipient to comply with applicable data protection requirements.
How long will we keep your personal data?
- Enquiries that do not lead to enrolment: we keep your contact details for up to 12 months from our last contact with you, unless you ask us to delete them sooner.
- Students and mentees: we keep your data for the duration of the programme and for 5 years afterwards, so that we can confirm your participation and reissue certificates if needed, and to meet our legal, regulatory and accounting obligations.
- Marketing: we keep your data until you withdraw your consent or unsubscribe. We will ask you periodically whether you still wish to hear from us.
- Analytics: we keep usage data in aggregated form only.
If you unsubscribe, we will remove you from our mailing lists but may retain a minimal record of your objection so that we do not contact you again by mistake.
Updating, correcting and accessing your personal details
We want to make sure the information we hold about you is correct and up to date. You can correct or update your information at any time by emailing bestdpo.edu@gmail.com. You can also request a copy of the information we hold about you.
Changing your preferences
You can change your preferences or stop receiving our mailings at any time by clicking the unsubscribe link in any of our emails, or by emailing bestdpo.edu@gmail.com.
What rights do you have in relation to your personal data?
Subject to the conditions set out in the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy of it;
- rectify your data if it is incorrect, incomplete or out of date;
- erase your data;
- restrict our processing of your data;
- data portability — to receive the data you provided to us in a structured, commonly used, machine-readable format;
- object to processing based on our legitimate interests, and to object at any time to processing for direct marketing purposes;
- withdraw your consent at any time, where our processing is based on consent.
To exercise any of these rights, please email bestdpo.edu@gmail.com. We will respond within one month. Information will generally be provided free of charge, although we may charge a reasonable fee where a request is manifestly unfounded or excessive.
Please note that in some circumstances we may have legitimate grounds for continuing to process or retain your personal data, and that exercising some of these rights may affect our ability to deliver our educational services to you.
Who can you contact if you have any questions, concerns or complaints?
If you have any questions, concerns or complaints about how we handle your personal data, please email bestdpo.edu@gmail.com.
You also have the right to lodge a complaint with the supervisory authority in your country if you feel that your rights have been breached.
BestDPO
Iuliia Shapakova
Sole trader (ditta individuale) operating under the BestDPO brand
Fiscal address: Località Tubo 6, San Pietro in Campo, Barga (LU), Italy
VAT number: IT02721670467
© BestDPO, 2026.