PRIVACY POLICY

Last Updated: July 2026

Lean Six Sigma Factory ("we", "our", or "us") is committed to protecting your privacy and handling your personal data transparently. This Privacy Policy outlines how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and the UK GDPR.

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect and Why We Process It

We only collect data that is strictly necessary to deliver our training services, process payments, and maintain our website. Below are the specific categories of processing and our legal bases under GDPR:

A. Contact Form Inquiries

• Data collected: Name, email address, and any information you provide in your message.
• Purpose: To respond to your questions, support requests, or course inquiries.
• Legal Basis: Our legitimate interest in answering your inquiries, or taking pre-contractual steps at your request.

B. Course Registrations & Certification Records

• Data collected: Full name, email address, phone number, billing address, company name (if applicable), and your course progress/completion status.
• Purpose: To deliver training, administer certification exams, and maintain official certification registries.
• Legal Basis: Performance of a contract to deliver your training, and our legitimate interest in maintaining verification records.

C. Payment Processing (Stripe)

• Data collected: Payment and billing details.
• Purpose: To process secure payments for course registrations.
• Payment Security: Payment card information is transmitted directly to Stripe over encrypted connections. Lean Six Sigma Factory does not store, process, or have access to complete payment card numbers or card verification values (CVV).
• Legal Basis: Performance of a contract.

D. Email Communications

• Data collected: Name and email address.
• Purpose: Sending transactional updates, course schedules, exam links, and administrative communications.
• Legal Basis: Performance of a contract. We do not track your email opens, link clicks, or interaction history.

E. Self-Hosted Matomo Analytics

• Data collected: Anonymized IP addresses (e.g., 2-byte masking), pages visited, referral sources, and device specifications.
• Purpose: Analytics collected through Matomo are used solely to measure website performance, understand aggregate visitor behavior, improve content, diagnose technical issues, and evaluate the effectiveness of our educational resources. Analytics are not used to build advertising profiles, target individuals with advertising, or sell personal information.
• Privacy Settings: Our Matomo installation is entirely self-hosted on our own secure servers. Your analytical data never leaves our infrastructure. Analytics are configured using privacy-focused settings designed to minimize the processing of personal data.
• Legal Basis: Legitimate interest in maintaining and optimizing website performance using non-identifying aggregate data.

3. Cookies

We do not use any marketing, targeting, profiling, or non-essential tracking cookies on our website. Furthermore, our self-hosted Matomo analytics platform is configured to operate entirely cookieless.

The only cookies utilized on our site are strictly necessary cookies required for vital functions, such as processing secure transactions through our checkout partner, Stripe. Because we do not use non-essential or tracking cookies, a cookie consent banner is not required to visit or use our website.

4. Third-Party Processors and Data Transfers

We do not sell, rent, or trade your personal data. We only share information with trusted service providers who act as our data processors to deliver our services:

• Web Hosting Providers (to keep our website online and secure).
• Stripe (to securely process checkout payments).
• Transactional Email Providers (to deliver receipts and registration instructions).

International Transfers: Where third-party service providers (such as Stripe) process data outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or another lawful transfer mechanism recognized under applicable data protection law.

5. Data Retention Periods

We store your data only as long as necessary for the purpose it was collected, or to meet statutory obligations:

• Contact Form Inquiries: Retained for 12 months after resolution to ensure continuity of service, unless you request deletion earlier.
• Course Registrations & Billing Data: Retained for 10 years to comply with statutory Portuguese tax and accounting laws.
• Certification Records: Certification records are retained for as long as necessary to maintain certificate verification services. If a certificate holder requests deletion, we will explain the effect this may have on future verification.
• Anonymized Matomo Analytics: Aggregated analytical data is retained to help us understand long-term website performance. Where analytics data contains personal data, it is processed using privacy-focused settings designed to minimize personal data.

6. Security Measures

We implement appropriate technical and organizational security measures to protect your data. This includes secure HTTPS encryption (SSL/TLS) for all website traffic, restricted internal access to systems holding personal data, secure self-hosting environments, and regular software updates to prevent security vulnerabilities.

We regularly review and update our technical and organizational security measures to help protect personal data against unauthorized access, alteration, disclosure, or destruction.

7. Your GDPR & UK GDPR Rights

Under European and UK data protection law, you have the following legal rights regarding your data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data (subject to statutory retention requirements).
• Right to Restrict or Object to Processing: You can object to us processing your data under certain conditions.
• Right to Data Portability: You can request your data in a structured, commonly used, machine-readable format.

To exercise any of these rights, please contact us at info@lean6sigmafactory.com. We will respond within 30 days.

8. Right to File a Complaint

If you believe we are processing your personal data unlawfully, you have the right to file a complaint with a supervisory authority. In Portugal, the lead authority is:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 - 1.º
1200-651 Lisboa, Portugal
Website: www.cnpd.pt

If you are based in the UK, you may file a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.