Privacy Policy

Last Updated: March 12, 2026

1 — Introduction & Controller Identity

This Privacy Policy explains how V&S WORLD S.C.P. (“V&S WORLD,” “we,” “us,” or “our”) collects, uses, and protects personal data when you visit this website, submit a form, or otherwise interact with our educational and consulting services offered throughout Canada. We are the Data Controller for personal data processed in connection with this website and our service delivery.

Legal entity: V&S WORLD S.C.P. Registered address: Rambla de Prat, 25, Gràcia, 08012 Barcelona, Spain. Primary contact email for privacy requests: [email protected]. If you contact us, please include enough information for us to identify your records and respond securely.

This Policy applies to site visitors, prospective clients, course participants, and organizational contacts in Canada and elsewhere. If you are located in the European Economic Area or the UK, this Policy describes our processing under GDPR/UK GDPR. Canadian visitors should also review the sections addressing PIPEDA and provincial privacy frameworks.

2 — Personal Data We Collect

We collect only the data necessary for clear communication, program delivery, and lawful business operations. Categories include:

• Identity and contact information: name, email address, phone number, organization, role, and region.
• Form content: your message, service/course selection, objectives, timelines, and other details you choose to provide.
• Technical data: IP address, device and browser type, operating system, language settings, and basic diagnostics collected by our servers for security and performance.
• Usage data: pages viewed, referral source, time on page, and click paths when analytics cookies are enabled by consent.
• Cookies and identifiers: essential session cookies, consent settings, and—if you opt in—analytics and marketing identifiers described in our Cookie Policy.
• Conversion data: whether a form submission or enrolment occurred, for internal reporting and capacity planning.

We do not intentionally collect special-category data (such as health status, political opinions, religious beliefs), financial account numbers, or government-issued IDs through this website. Do not include sensitive information in free‑text fields.

3 — Why We Process Data & Legal Bases

We process personal data for specific, explicit purposes and rely on the following legal bases under GDPR/UK GDPR:

• Contact and enrolment (Art. 6(1)(b) contract; and Art. 6(1)(a) consent for optional details): to respond to inquiries, provide proposals, and deliver requested programs.
• Analytics (Art. 6(1)(a) consent): to understand aggregate website usage and improve content when you allow analytics cookies.
• Marketing/remarketing (Art. 6(1)(a) consent): to measure advertising effectiveness and reach similar audiences where consent is given.
• Security and fraud prevention (Art. 6(1)(f) legitimate interests): to protect our systems, investigate abuse, and maintain service integrity.
• Legal compliance (Art. 6(1)(c)): to meet record‑keeping, tax, and regulatory obligations.

Automated decision-making: We do not engage in automated decisions or profiling that produce legal or similarly significant effects about you.

4 — Cookies & Similar Technologies

We use cookies and similar technologies to operate the site, remember preferences, and—when you consent—measure usage and advertising performance. Categories align with our Cookie Policy at /cookie-policy/:

• Essential (no consent required): _site_session (session continuity), cookie_consent (stores your selection), and security tokens. Retention ranges from session to 12 months.
• Analytics (consent): Google Analytics 4 with IP anonymization, e.g., _ga (2 years) and _ga_XXXXXXXXXX (2 years). Aggregate usage is retained for 14 months.
• Marketing (consent): identifiers supporting measurement and remarketing, such as _gcl_au (90 days), _fbp (90 days), and _fbc (90 days when a click ID is present).

You can manage consent at any time using the “Manage cookie preferences” link in the footer. Withdrawing consent will not affect the lawfulness of processing before withdrawal. For detailed information, see our Cookie Policy.

5 — Consent for EEA/UK & Canada

Users in the EEA and UK receive a consent prompt for analytics and marketing cookies. We record your choice in the cookie_consent cookie for 12 months. Canadian visitors may be asked for express consent where required by PIPEDA and applicable provincial laws. You may withdraw consent at any time via our preferences panel or by clearing cookies in your browser.

6 — Sharing with Service and Advertising Partners

We do not sell personal data. We disclose limited data to service providers that help us operate this website and measure interest in our programs, subject to contracts that restrict independent use:

• Google LLC: analytics, advertising measurement, and tag management. Data types may include cookie IDs, page paths, and conversions.
• Meta Platforms, Inc.: advertising measurement and audience tools where enabled by consent. Data types may include page events and hashed identifiers.
• Infrastructure providers: content delivery and security services that process IP addresses for threat detection and performance.

These providers act as processors or service providers, and they are not permitted to use site data for their own independent commercial purposes. Where required, we sign standard contractual terms and implement appropriate safeguards.

7 — International Data Transfers

When personal data is transferred outside the EEA/UK (for example, to the United States), we rely on lawful mechanisms such as the EU‑US Data Privacy Framework, the UK Extension to the Data Privacy Framework, the Swiss‑US framework where applicable, or Standard Contractual Clauses (EU 2021/914). If required, we use the UK International Data Transfer Addendum. We continuously review transfer tools to reflect regulatory guidance.

8 — Data Retention

We keep personal data only as long as necessary for the purposes described:

• Contact and enrolment records: 2 years from your last interaction, unless a longer period is legally required.
• Analytics data: 14 months in aggregated form when enabled by consent.
• Marketing identifiers: limited to cookie lifetimes listed above.
• Server logs: typically 90 days for security and diagnostics.
• Cookie consent record: up to 3 years for audit purposes.
• Legal and tax records: retained per applicable law (commonly 6–10 years).

9 — Your Rights (GDPR/UK GDPR)

If you are in the EEA or UK, you may exercise the following rights subject to conditions under law: access; rectification; erasure; restriction; portability; objection to processing based on legitimate interests; and withdrawal of consent at any time. You may also lodge a complaint with your local supervisory authority. To exercise rights, email [email protected]. We will respond within 30 days, extendable for complex requests.

10 — Children’s Privacy

Our website and programs are intended for adults. We do not knowingly collect personal data from individuals under 16 years of age. If we learn that we have inadvertently processed data relating to a child under 16 without verifiable parental consent, we will delete it promptly.

11 — Do Not Track

Some browsers offer a “Do Not Track” signal. Our website does not currently respond to DNT signals. Consent choices presented through our cookie controls remain the primary mechanism for managing analytics and marketing cookies on this site.

12 — Account & Data Deletion

We do not operate user accounts on this website. You may request deletion of contact records and form submissions by emailing [email protected] with the subject line “Data Deletion Request.” We will verify identity and complete validated requests within 30 days, except where retention is required by law.

13 — Business Transfers

If V&S WORLD S.C.P. undergoes a merger, acquisition, reorganization, or asset transfer, personal data may be transferred to the successor entity as part of the transaction. We will provide a notice on this site if such changes materially affect how your personal data is used.

14 — California (CCPA/CPRA) Disclosures

While our primary service area is Canada, US visitors may exercise the following rights under California law where applicable: right to know, delete, correct, and to opt out of sale or sharing of personal information for cross‑context behavioral advertising. We do not sell personal information as defined by CCPA. We may “share” limited identifiers with advertising partners when you consent to marketing cookies. To exercise rights, email [email protected] with the subject “California Privacy Request.” We may request additional information to verify your identity and authority (including for authorized agents). We will not discriminate against you for exercising your rights.

15 — Virginia (VCDPA) Notice

For Virginia residents, subject to VCDPA applicability, you may request access, correction, deletion, portability, and opt‑out of targeted advertising. Submit your request via [email protected] with the subject “Virginia Privacy Request.” If we decline, you may appeal by emailing the subject “Appeal of Refusal — Privacy Request.” We will respond within 60 days to appeals. We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

16 — Nevada Notice

Nevada residents may submit a verified request to opt out of the sale of personal information by emailing [email protected] with the subject “Nevada Do Not Sell Request.” We do not currently sell personal information under Nevada law (NRS 603A).

17 — Security Measures

We apply administrative, technical, and organizational safeguards appropriate to the risks, including HTTPS transport, access controls, least‑privilege internal access, and periodic review of processor practices. Despite these measures, no method of transmission or storage is completely secure, and residual risk remains. If we identify a breach impacting your data, we will assess notification obligations and act in line with applicable laws.

18 — Changes to This Policy

We may update this Privacy Policy to reflect changes in our services or law. Material changes will be highlighted on this page, and where appropriate, we will provide a banner notice at least 14 days before the effective date. The “Last Updated” date will change with each revision.

19 — Canadian Privacy Considerations (PIPEDA)

For Canadian visitors and clients, we describe our practices with reference to the principles in PIPEDA: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure, and retention; accuracy; safeguards; openness; individual access; and challenging compliance. We collect only what is necessary for identified purposes, obtain consent where required, maintain safeguards proportional to sensitivity, and support access and correction on request. Some provinces have substantially similar legislation; where applicable, we align practices accordingly.

You may contact us to request access to, or correction of, your personal information, or to withdraw consent subject to legal or contractual restrictions. We will provide reasons if a request is refused as permitted by law and explain available recourse.

20 — Contact

Controller: V&S WORLD S.C.P.

Address: Rambla de Prat, 25, Gràcia, 08012 Barcelona, Spain

Email: [email protected]

When contacting us about privacy, please specify the nature of your request (for example: access, correction, deletion, objection, or consent withdrawal) and provide contact details so we can verify your identity and respond securely.

21 — Summary of Cookies Used

22 — How to Manage Cookies

Use the “Manage cookie preferences” link in the footer to adjust analytics and marketing settings. You can also block or delete cookies via your browser settings. If you block essential cookies, some site functionality may not work.