Skip to main content

Privacy Policy

Last Updated: March 18, 2026

1. Introduction & Controller Identity

This Privacy Policy explains how Canadian Professional Academy (“we”, “us”, or “our”) collects, uses, and protects personal data when you visit our website, contact us, or request information about our online educational programs. Canadian Professional Academy is operated by VAFCO Beheer B.V. as an independent provider of online professional education for learners across Canada. All educational services are delivered online.

For the purposes of the General Data Protection Regulation (GDPR), the data controller is:

We do not appoint a Data Protection Officer (DPO) as a matter of course because we do not conduct large-scale processing of special-category data. If you have privacy questions, you can contact us using the details above.

2. Personal Data We Collect

We collect only the data needed to operate this site, respond to inquiries, and support registration for educational programs. Depending on how you interact with the site, we may collect:

  • Identity and contact data: full name, email address, phone number.
  • Inquiry and form content: selected program, preferred workshop topic (if provided), and any additional comments you submit.
  • Technical data: IP address, browser type and version, device type, operating system, language settings, and approximate location derived from IP (country/region level).
  • Usage data: pages viewed, time on page, referrer, and click paths (when analytics is enabled by consent).
  • Cookies and identifiers: cookie consent choice and similar identifiers described in Section 4.
  • Conversion events: events such as submitting a contact or registration form (when marketing/analytics is enabled by consent).

We do not intentionally collect special-category data (for example, health data, religious beliefs, political opinions), financial account details, or government identification numbers through this site. Please do not include sensitive information in free-text fields.

3. Why We Process Data & Legal Basis (GDPR Article 6)

We process personal data for the purposes below, using the GDPR legal bases listed. If you are in the European Economic Area (EEA) or the United Kingdom, these legal bases apply.

  • Responding to inquiries and supporting registration: to respond to messages, provide program information, and coordinate next steps. Legal basis: Article 6(1)(b) (steps prior to entering into a contract) and Article 6(1)(a) (consent) where you choose to provide information and request contact.
  • Site functionality and security: to keep the site reliable, prevent abuse, and maintain security. Legal basis: Article 6(1)(f) (legitimate interests), balanced against your rights.
  • Analytics (optional): to understand how the site is used and improve content. Legal basis: Article 6(1)(a) (consent) where required.
  • Marketing and advertising measurement (optional): to measure ad performance, attribute conversions, and build remarketing audiences. Legal basis: Article 6(1)(a) (consent) where required.
  • Legal compliance: to comply with legal obligations, such as record-keeping for tax/accounting where applicable. Legal basis: Article 6(1)(c) (legal obligation).

Automated decision-making (GDPR Article 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.

4. Cookies & Tracking

We use cookies and similar technologies to operate the site and, where you consent, to measure usage and advertising performance. Cookies are small files stored on your device. Some cookies are first-party (set by this site) and some are third-party (set by service providers).

Essential cookies (always active)

These cookies are required for the site to function and do not require consent. Examples include:

  • _site_session (session continuity)
  • cookie_consent (stores your cookie preferences)

Retention for essential cookies ranges from session-based to up to 12 months depending on the cookie.

Analytics cookies (consent required)

If you consent to analytics, we may use Google Analytics 4 (GA4) to understand which pages are visited and how content is used. We use settings intended to reduce identification risk, such as IP anonymization where available. Analytics cookies commonly include _ga and _ga_XXXXXXXXXX. Analytics data retention is typically set to 14 months.

Marketing cookies (consent required)

If you consent to marketing cookies, we may use technologies from advertising partners to measure conversion events, build remarketing audiences, and show relevant messages. Marketing cookies may include _gcl_au (Google Ads) and _fbp/_fbc (Meta). Typical retention for these cookies is around 90 days.

Beyond cookies, advertising and analytics can use pixel tags and server-side event forwarding. Where enabled, event data may include page views, referrer, device identifiers derived from IP address and user-agent strings, and conversion events (for example, a form submission). If server-side matching is used in the future, identifiers may be hashed before transmission where supported by providers.

For additional detail about cookies and how to change your choices, see our Cookie Policy.

5. Consent (EEA/UK)

Users in the EEA and the UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, freely given consent (Article 6(1)(a)). Your consent choice is recorded in the cookie_consent cookie, typically for 12 months.

You may withdraw consent at any time by using the “Manage cookie preferences” link in the footer or by clearing cookies in your browser. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

6. Sharing With Advertising & Service Partners

We share personal data only when necessary to operate the site, deliver requested information, or (where you consent) measure marketing/analytics. We do not sell personal data. Depending on your cookie choices and how you interact with the site, the following partners may process data:

  • Google LLC (Google Analytics 4, Google Ads measurement/remarketing, Google Tag Manager): cookie identifiers, usage data, and conversion events. policies.google.com/privacy
  • Meta Platforms, Inc. (Meta Pixel, Custom/Lookalike Audiences, Conversion API where enabled): page views, conversions, audience membership, and identifiers (which may be hashed where applicable). facebook.com/privacy/policy
  • Cloudflare, Inc. (content delivery and security): IP-based threat detection and performance optimization. cloudflare.com/privacypolicy

We do not permit these providers to use site data for their own independent commercial purposes beyond providing services to us, subject to their contractual terms and applicable policies.

7. International Transfers

VAFCO Beheer B.V. is established in the Netherlands. Some of our service providers may process data outside the EEA/UK, including in the United States. Where international transfers occur, we rely on appropriate safeguards, which may include:

  • EU–US Data Privacy Framework (where applicable)
  • UK Extension to the EU–US Data Privacy Framework (where applicable)
  • Swiss–US Data Privacy Framework (where applicable)
  • Standard Contractual Clauses (EU 2021/914) as a fallback
  • UK International Data Transfer Addendum/IDTA as a fallback

You can request more information about the safeguards we use by contacting us at [email protected].

8. Data Retention

We keep personal data only as long as needed for the purposes described in this policy:

  • Contact and registration inquiries: typically up to 2 years from the last interaction to support follow-up and learner support queries.
  • Email correspondence: duration of the relationship plus 1 year, unless a longer period is needed for dispute handling.
  • Analytics data: typically 14 months (where enabled by consent).
  • Marketing cookies: per cookie lifetime (commonly up to 90 days), where enabled by consent.
  • Server logs: generally up to 90 days for security and troubleshooting.
  • Cookie consent record: up to 3 years for audit and compliance evidence.
  • Legal and tax records: retained as required by law (often 6–10 years for invoices or accounting records when applicable).

9. Your Rights (GDPR & UK GDPR)

If GDPR or UK GDPR applies, you have rights regarding your personal data, including:

  • Right of access (Article 15)
  • Right to rectification (Article 16)
  • Right to erasure (Article 17)
  • Right to restriction of processing (Article 18)
  • Right to data portability (Article 20)
  • Right to object (Article 21)
  • Right to withdraw consent at any time (Article 7(3))
  • Right to lodge a complaint with a supervisory authority (Article 77)

To exercise your rights, email [email protected]. We aim to respond within 30 days. For complex requests, we may extend by up to 60 days, and we will explain the reason for the extension.

If you are located in the Netherlands, you can also contact the Dutch supervisory authority: Autoriteit Persoonsgegevens. More information is available via edpb.europa.eu which lists EU supervisory authorities.

10. Children

This site is not directed at individuals under 16. We do not knowingly collect personal data from minors. If you believe a child under 16 has provided personal data without verifiable parental consent, contact us and we will delete the information promptly.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Some third-party services may have their own DNT handling policies.

12. Data Deletion Requests

You can request deletion of your personal data by emailing [email protected] with the subject line “Data Deletion Request”. We may ask for additional information to verify your identity before completing the request. Deletion is typically completed within 30 days after identity verification, except where we must retain limited information to comply with legal obligations.

13. Business Transfers

If VAFCO Beheer B.V. is involved in a merger, acquisition, financing, reorganization, asset sale, or insolvency event, personal data may be transferred as part of that transaction. If such a transfer materially changes how personal data is used, we will provide notice on the website.

14. California (CCPA/CPRA)

This section applies only to California residents when the California Consumer Privacy Act (CCPA) as amended by the CPRA applies. In the past 12 months, we may have disclosed the following categories of personal information to service providers and, where you consent, advertising partners:

  • Identifiers: name, email, IP address, device identifiers.
  • Internet/network activity: browsing interactions on this site (when analytics/marketing is enabled).
  • Inferences: interests or preferences inferred from site usage for advertising (when marketing is enabled).

We do not sell personal information as defined by CCPA. We may share data for cross-context behavioral advertising when you opt in to marketing cookies. You can opt out by using the cookie preferences panel.

California residents may request to know, delete, or correct personal information, and to opt out of sale/sharing where applicable. Submit requests by emailing [email protected] with the subject “California Privacy Request”. We will verify your identity before processing. Authorized agents must provide proof of authorization.

15. Virginia (VCDPA)

If the Virginia Consumer Data Protection Act (VCDPA) applies, Virginia residents may have the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising. We do not sell personal data and we do not engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject “Virginia Privacy Request”. If we decline a request, you can appeal by emailing with the subject “Appeal of Refusal — Privacy Request”. We will respond to appeals within 60 days. If an appeal is denied, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will provide notice on the website at least 14 days before the changes take effect. The “Last Updated” date at the top indicates the most recent revision.

18. Contact

If you have questions about this Privacy Policy or how we handle personal data, contact: