Legal
Privacy Policy
Last updated: 3 July 2026. This policy explains how Expanding Horizons collects, uses, and protects your personal data in line with the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who we are (data controller)
Expanding Horizons ("we", "us") is the data controller for the personal data described here.
2. What data we collect
- Inquiry / sample-request form: your name, email, country, and the course details you choose to provide (topic, field, level, language, notes).
- Institution inquiry form: the contact, institution and requirement details you provide.
- Meeting bookings: if you book a call, your name, email and chosen time — handled by our scheduling provider (Calendly) and added to our Google Calendar.
- Email correspondence you send us.
- Technical/server logs kept by our hosting provider (e.g. IP address, browser type, timestamps) for security and to operate the site.
- Analytics (only if you consent): if you accept analytics via our cookie banner, Google Analytics collects aggregated, anonymised usage data (e.g. pages viewed, approximate region, device/browser type) using cookies.
We use no advertising cookies and we self-host our fonts. With your consent (via the cookie banner) we use Google Analytics for anonymous, aggregated usage statistics; if you decline, it is never loaded. Two features also rely on a trusted third party to work: our forms send your submission to our CRM, HubSpot, and our scheduling page embeds Calendly. These may set their own cookies and process your data when you use them — see sections 3–4 and our Cookie Notice.
3. Why we use it & legal basis
- To respond to your inquiry and prepare a quote/sample — legal basis: your consent (given when you submit the form) and our legitimate interest in responding to prospective customers.
- To deliver a course you commission — legal basis: performance of a contract.
- To secure and operate the website — legal basis: legitimate interest.
- To comply with legal/accounting obligations — legal basis: legal obligation.
- To measure and improve the site (analytics) — legal basis: your consent, given (or refused) via the cookie banner and withdrawable at any time.
4. Who we share it with
We do not sell your data. We share it only with processors that help us operate, each under a data-processing agreement:
- HubSpot — our CRM. Form submissions are stored here so we can respond to and manage your inquiry. Your data is held in HubSpot's EU data centre.
- Calendly — our meeting-scheduling tool. If you book a call, Calendly processes your name, email and chosen time.
- Google — bookings are added to our Google Calendar and calls take place over Google Meet; Google Workspace also hosts our email.
- Google Analytics — if you accept analytics cookies, Google processes anonymised usage data to produce our site statistics. You can opt out anytime by declining the banner or clearing site data.
- Our website host (server logs), and — if you become a customer — payment and accounting providers.
Some providers may process data outside the EEA under appropriate safeguards (e.g. EU Standard Contractual Clauses).
5. How long we keep it
Inquiry data: up to 24 months after our last contact, then deleted, unless you become a customer (in which case contractual/accounting records are kept as required by law). You can ask us to delete your data sooner.
6. Your rights
Under the GDPR you have the right to: access your data; rectify it; erase it ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time. To exercise any of these, email davidmas@expanding-hz.com. You also have the right to lodge a complaint with your local data-protection supervisory authority.
7. Security
The site is served over encrypted HTTPS/TLS (SSL). We apply reasonable technical and organisational measures to protect your data.
8. Changes
We may update this policy; the "last updated" date above reflects the current version.
← Back to home