Privacy and cookies
What we collect, why, for how long, and your rights. Compliant with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.
Data controller
CGA FR, sole proprietorship (SIREN 933 469 017), 4 Square Gabriel Fauré, 75017 Paris, France, represented by Cédric Galichon. Contact for any data question: contact@training-360.com.
Data processed and purposes
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Contact form | Name, email, company, message, IP address | Legitimate interest (answering your request) | 12 months after the last exchange |
| Studio access (clients) | Work email, sign-in log | Performance of the contract | Contract duration + 3 years |
| Conversations with Clara (clients) | Messages, Clara’s proposals, choices made | Legitimate interest (improving the service) | 24 months, including after the draft is deleted; erased on request |
| Prospects and clients (commercial relationship) | Name, work e-mail, phone, company, the e-mails exchanged with us, notes and summaries of those exchanges (written with the help of an AI model hosted in the European Union) | Legitimate interest (commercial relationship) | 3 years after the last contact |
| Playing a training (trainees) | Open link of a public training: no personal data, except the name (and address, if requested) typed for a certificate. Personal link, or a private training: the e-mail address and the plays (dates, answers, score) are visible to the client company that ordered the training, which decides who may open it; we process them on its behalf. The feedback you may give at the end (ratings, length, comment) is kept with the play and shown to that company and to Training360, with your name when the play is named. Technical logs (IP, browser) are kept 30 days for security. Requests: contact@training-360.com. | Legitimate interest (security, operation); for named plays, the client company’s basis — we act as its processor | Technical logs: 30 days. Named plays (personal link or private training): 24 months |
| Certificates (trainees) | First and last name, training, date, score, verification code, the certificate’s PDF | The client company’s basis (proof of training) — we act as its processor | Duration of the client company’s contract + 1 year |
| Trainee space (my.training-360.com) | Work e-mail, the trainings and paths assigned to you, your results and certificates. If your company turns the leaderboard on, your name and points are shown to your colleagues; you can hide your name at any time | The client company’s basis — we act as its processor | As for named plays: 24 months |
| Studio notifications (clients, optional) | Your browser’s notification address, the name of the device | Consent (you turn them on) | Until you turn them off |
| Audience measurement (Google Analytics 4), only after consent | Page views, device, browser, anonymised IP | Consent | 14 months (Google) |
| Anti-bot check of the contact form, of the on-site capture link and of the playing of a training (Cloudflare Turnstile) | Technical browser signals, IP | Legitimate interest (spam and abuse prevention) | Per Cloudflare’s policy |
Processors and transfers
Hosting and email sending: Amazon Web Services (Paris region; standard contractual clauses for processing outside the EU). Our mailbox: Google Workspace receives the messages sent to contact@training-360.com and through the contact form. Anti-bot: Cloudflare, Inc. AI content generation: training prompts (never trainee data) are processed by our model providers under our service agreements — by default models hosted in the European Union (Amazon Web Services); a training may use another provider, possibly outside the European Union, when its author chooses it. Studio notifications go through the push service of your browser’s maker (Apple, Google or Mozilla), encrypted end to end. A YouTube video placed in a training by the client is loaded from youtube-nocookie.com only when the trainee taps it. No data is sold.
On-site 360° capture: when someone photographs a place from their phone for a training scene, the photos are stored in the European Union (Amazon Web Services, Paris region); the sphere assembled from those photos is sent to OpenAI for clean-up or for generating the scene’s picture, under our service agreements. The assembled picture of the place is deleted as soon as the capture is refused, and is used in a training only once its author has validated it. The source photos are deleted 30 days after the capture is validated or rejected, and in any case no later than 60 days after they were taken.
Your rights
Access, rectification, erasure, restriction, objection, portability: write to contact@training-360.com. We reply within one month. You may lodge a complaint with the CNIL (cnil.fr).
Cookies and local storage
The public site uses no tracking cookie. Strictly necessary local storage remembers your banner choice. The Studio keeps your sign-in session in the browser’s local storage (strictly necessary for the service). On Clara’s page, a message not yet sent is kept in your browser so you find it again. Audience measurement (Google Analytics 4, IP addresses anonymised) loads only after you choose “Accept” in the banner; with “Decline”, no measurement script or Google cookie is set. You can change your mind by clearing the site’s storage in your browser. The site’s fonts and scripts are served from our own domain: nothing is loaded from another company before you choose.
When you play a training, the player remembers in your browser the language and the reading settings you chose; for a private training, the access granted after your code (30 days) and the e-mail you typed; for a beta reviewer, the name used to sign comments; on a public link, that you already gave your feedback on this version. The trainee space keeps your sign-in in your browser. This storage is strictly necessary for the service and stays on your device.
Last updated: 17 October 2026.