Privacy policy

This policy explains what personal data Gesthos processes when you take one of its online courses, and what rights you have.

Who is responsible

Gesthos (gesthos.com). For any question about your data: info@gesthos.com.

What data we process

Your name, your email address and, if you give it, your phone number; your progress in the course, your exam result and your rating of the course, if you leave one; the payment details for the certificate, which are handled by Stripe (Gesthos never sees or stores your card); and the page or campaign that brought you to the website.

What for

To give you access to the course, mark the exam, issue your certificate and allow its authenticity to be checked; to charge for the certificate and meet accounting obligations; and to answer your questions. If you agree, also to remind you by email or WhatsApp that your certificate is about to expire and to send you course offers; you can unsubscribe at any time.

Legal basis

Performance of the course contract you request (Art. 6(1)(b) GDPR), compliance with legal invoicing obligations (Art. 6(1)(c)) and your consent for reminders, offers and measurement cookies (Art. 6(1)(a)).

Certificate verification

Your certificate has a QR code. Anyone who scans it sees your name, the course, the dates, the result and, if you gave an ID document, only its last four characters. Nothing else.

Who else processes your data

Only the providers that deliver the service for us and process data on our behalf: website hosting (Railway, Cloudflare), payments (Stripe), email (Zoho), WhatsApp reminders (Meta) and, only if you accept measurement cookies, analytics (Google, Meta). Railway, Cloudflare, Stripe, Meta and Google are US companies: those transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We do not sell your data.

How long we keep it

Course and certificate data are kept for as long as the certificate may need to be verified. If you enrol but never pay, your data are deleted 12 months after your last activity. You can ask us to delete them at any time; after that, the certificate can no longer be verified. Data for reminders and offers, until you withdraw your consent. Payment and invoicing data, for the periods required by law.

Your rights

You can ask for access to, correction, erasure, restriction and portability of your data, object to its processing and withdraw your consent at any time by writing to info@gesthos.com. If you think we have not handled your data properly, you can complain to the data protection authority in your country (in the UK, the ICO; in Ireland, the Data Protection Commission).

Cookie policy · info@gesthos.com

Last updated: 26 October 2026.