PRIVACY POLICY

Last Updated: July 2026

Lean 6 Sigma Factory ("we", "our", or "us") is committed to protecting your privacy and handling your personal data transparently. This Privacy Policy outlines how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and the UK GDPR.

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect and Why We Process It

We only collect data that is strictly necessary to deliver our training services, process payments, and maintain our website. Below are the specific categories of processing and our legal bases under GDPR:

A. Contact Form Inquiries

• Data collected: Name, email address, and any information you provide in your message.
• Purpose: To respond to your questions, support requests, or course inquiries.
• Legal Basis: Our legitimate interest in answering your inquiries, or taking pre-contractual steps at your request.

B. Course Registrations & Certification Records

• Data collected: Full name, email address, phone number, billing address, company name (if applicable), course enrollment details, course progress and completion status, exam attempts and results, project submissions and assessment outcomes, and certification records. The learning platform may also process account access records and technical logs.
• Purpose: To manage course enrollment and access, deliver training through our website and learning management system (Moodle), track learning progress, administer exams, assess required improvement projects, issue completion letters and certificates, and maintain certification verification records.
• Legal Basis: Performance of a contract to deliver your training, and our legitimate interest in maintaining verification records.

Order and Certification Status: We process order payment status, account access status, and certification records to administer course access and maintain accurate training and certification records. Where an order remains unpaid, is cancelled, or is refunded, we use this information to suspend access to the associated training and update the status of any Letter of Completion or Certificate issued in connection with that order.

C. Payment Processing (Stripe)

• Data collected: Payment and billing details.
• Purpose: To process secure payments for course registrations.
• Payment Security: Payment card information is transmitted directly to Stripe over encrypted connections. Lean 6 Sigma Factory does not store, process, or have access to complete payment card numbers or card verification values (CVV).
• Legal Basis: Performance of a contract.

D. Email Communications

• Data collected: Name and email address.
• Purpose: Sending transactional updates, course schedules, exam links, and administrative communications.
• Legal Basis: Performance of a contract. We do not track your email opens, link clicks, or interaction history.

E. Self-Hosted Matomo Analytics

• Data collected: Anonymized IP addresses (e.g., 2-byte masking), pages visited, referral sources, and device specifications.
• Purpose: Analytics collected through Matomo are used solely to measure website performance, understand aggregate visitor behavior, improve content, diagnose technical issues, and evaluate the effectiveness of our educational resources. Analytics are not used to build advertising profiles, target individuals with advertising, or sell personal information.
• Privacy Settings: Our Matomo installation is entirely self-hosted on our own secure servers. Your analytical data never leaves our infrastructure. Analytics are configured using privacy-focused settings designed to minimize the processing of personal data.
• Legal Basis: Legitimate interest in maintaining and optimizing website performance using non-identifying aggregate data.

3. Cookies

We do not use any marketing, targeting, profiling, or non-essential tracking cookies on our website. Furthermore, our self-hosted Matomo analytics platform is configured to operate entirely cookieless.

Our website and learning platform may use strictly necessary cookies to support essential functions, such as secure checkout, maintaining authenticated sessions, and allowing students to access the Moodle training portal. We do not use non-essential cookies for advertising or behavioral tracking. Because we do not use non-essential cookies, a cookie consent banner is not required for the cookies described in this policy. If our use of cookies changes, we will reassess our consent requirements.

4. Third-Party Processors and Data Transfers

We do not sell, rent, or trade your personal data. We only share information with trusted service providers who act as our data processors to deliver our services:

• Web Hosting Providers (to keep our website online and secure).
• Stripe (to securely process checkout payments).
• Transactional Email Providers (to deliver receipts and registration instructions).

International Transfers: Where third-party service providers (such as Stripe) process data outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or another lawful transfer mechanism recognized under applicable data protection law.

Self-Hosted Learning Platform: Our Moodle learning management system is operated by Lean 6 Sigma Factory on our own server infrastructure. Student accounts, course progress, exam results, and project submissions are managed within this platform. Moodle is self-hosted and is not an external hosting provider engaged by us to store student data.

5. Data Retention Periods

We store your data only as long as necessary for the purpose it was collected, or to meet statutory obligations:

• Contact Form Inquiries: Retained for 12 months after resolution to ensure continuity of service, unless you request deletion earlier.
• Course Registrations & Billing Data: Retained for 10 years to comply with statutory Portuguese tax and accounting laws.
• Certification Records: Certification records are retained for as long as necessary to maintain certificate verification services. If a certificate holder requests deletion, we will explain the effect this may have on future verification.
• Anonymized Matomo Analytics: Aggregated analytical data is retained to help us understand long-term website performance. Where analytics data contains personal data, it is processed using privacy-focused settings designed to minimize personal data.

6. Security Measures

We implement appropriate technical and organizational security measures to protect your data. This includes secure HTTPS encryption (SSL/TLS) for all website traffic, restricted internal access to systems holding personal data, secure self-hosting environments, and regular software updates to prevent security vulnerabilities.

We regularly review and update our technical and organizational security measures to help protect personal data against unauthorized access, alteration, disclosure, or destruction.

We employ modern cryptographic protections and layered security controls to help protect data in transit, secure access to our infrastructure, and reduce exposure to emerging security threats.

7. Your GDPR & UK GDPR Rights

Under European and UK data protection law, you have the following legal rights regarding your data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data (subject to statutory retention requirements).
• Right to Restrict or Object to Processing: You can object to us processing your data under certain conditions.
• Right to Data Portability: You can request your data in a structured, commonly used, machine-readable format.

To exercise any of these rights, please contact us at info@lean6sigmafactory.com. We will respond within 30 days.

8. Right to File a Complaint

If you believe we are processing your personal data unlawfully, you have the right to file a complaint with a supervisory authority. In Portugal, the lead authority is:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 - 1.º
1200-651 Lisboa, Portugal
Website: www.cnpd.pt

If you are based in the UK, you may file a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.