Privacy Policy

1. Introduction

CSL SARL ("CSL Brands", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you visit our website or use our services, including our learning platform, certification services, professional email offering, and other applications (collectively, the "Services").

This Policy applies wherever you are located, and is designed to meet, at a minimum, the requirements applicable to visitors and customers in the European Union, the United Kingdom, and the State of California, in addition to Cameroon. Where a right described below is granted by a specific law (for example the EU/UK General Data Protection Regulation, "GDPR", or the California Consumer Privacy Act, "CCPA"), we extend it to the persons that law protects; we also apply the same standards as good practice for all users where reasonably possible.

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read and understood it.

2. Who Is Responsible for Your Data

The data controller responsible for the personal data described in this Policy is CSL SARL.

Controller: CSL SARL
Address: CSL SARL, Douala, Cameroon
General privacy enquiries: privacy@csl-brands.com
Data protection contact point: privacy@csl-brands.com

[TO BE COMPLETED: confirm whether a Data Protection Officer has been formally appointed under Article 37 GDPR and, if so, provide their name and direct contact details]

3. Personal Data We Collect

The table below itemises the categories of personal data we collect, examples of each, why we use them, the legal basis we rely on, and how long we keep them. Where a specific retention period has not yet been finalised, this is flagged for completion rather than stated inaccurately.

4. How We Use Your Information

In addition to the specific purposes listed in Section 3, we use the information we collect to:

• Provide, operate, and maintain our Services
• Improve, personalise, and expand our Services
• Understand and analyse how you use our Services
• Develop new products, features, and functionality
• Send administrative information, updates, and security alerts
• Detect, prevent, and address technical issues, fraud, and abuse
• Comply with our legal and regulatory obligations

5. Cookies and Similar Technologies

We and our analytics and advertising partners (currently Google Analytics and the Meta Pixel / Conversions API) use cookies and similar technologies to operate the Services and to measure and improve our marketing. We do not currently ask for your consent before these cookies are set — see our Cookies Policy for details of this gap. Full details of the categories of cookies we use, why, and how to control them are set out in our Cookies Policy.

6. How We Share Your Information

We do not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary for the purposes described in this Policy:

• Service providers and processors: Companies that host our infrastructure, process payments, deliver emails, or provide customer-support tooling on our behalf, under contractual instructions limiting their use of the data.
• Analytics and advertising partners: Google (Google Analytics) and Meta (Meta Pixel and Conversions API), which receive technical identifiers and usage data to help us measure traffic and advertising performance, as described in our Cookies Policy.
• Other scripts found on our site (not yet confirmed): Our review of the site's code also found a PostHog product-analytics script and a Trustpilot review-invitation widget running on the site. CSL Brands has not yet confirmed whether, or what, personal data these send to PostHog Inc. or Trustpilot A/S, or for what purpose. [TO BE COMPLETED: confirm and document this recipient, or remove the scripts from the site]
• Course and content providers: Where you enrol in a course delivered by a third-party instructor or content provider on our platform, the data necessary to deliver that course (such as your name and progress) is shared with them.
• Professional advisors and authorities: Auditors, lawyers, and regulators or law-enforcement authorities, where we are required to do so by law or to establish, exercise, or defend legal claims.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality safeguards.

[TO BE COMPLETED: list of named sub-processors/service providers]

7. International Data Transfers

CSL Brands is headquartered in Cameroon. Personal data collected through our confirmed analytics and marketing tools leaves Cameroon: data collected via Google Analytics is processed by Google (Google Ireland Limited and/or Google LLC), and data collected via the Meta Pixel and Conversions API is processed by Meta Platforms (Meta Platforms Ireland Limited and/or Meta Platforms, Inc.), including in the United States and the European Union. Other service providers described in Section 6 — including the PostHog and Trustpilot scripts noted there, once their role is confirmed — may also be located in, or process data in, other countries.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or another jurisdiction with equivalent data-localisation requirements, we intend to rely on a recognised safeguard, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, an applicable adequacy decision, or another legally recognised transfer mechanism.

[TO BE COMPLETED: exhaustive list of destination countries, recipients/sub-processors, and the transfer mechanism relied on for each]

8. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes described in this Policy, including to satisfy any applicable legal, accounting, or reporting requirement. The specific retention period for each category of data is set out in the table in Section 3. Where a period has not yet been finalised, we retain the data for no longer than the duration of your relationship with us plus a limited additional period to handle queries, disputes, or legal obligations.

[TO BE COMPLETED: formal data-retention schedule, approved by CSL Brands]

9. Data Security

We implement technical and organisational security measures designed to protect the personal data we process. However, despite our safeguards, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Your Privacy Rights

Depending on your location, you have the following rights regarding your personal data. To exercise any of them, contact us at privacy@csl-brands.com. We will respond within the timeframe required by applicable law, and may ask you to verify your identity before acting on your request.

• Right of access: Obtain confirmation of whether we process your personal data, and a copy of it.
• Right to rectification: Ask us to correct inaccurate or incomplete personal data.
• Right to erasure: Ask us to delete your personal data, subject to certain exceptions (for example, where we must keep it to comply with a legal obligation).
• Right to restriction of processing: Ask us to limit how we use your personal data in certain circumstances.
• Right to data portability: Receive the personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to object: Object to our processing of your personal data based on legitimate interest, including for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint: Lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or where the alleged infringement occurred.

[TO BE COMPLETED: name and contact details of the competent supervisory authority/authorities]

11. Notice to California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you additional rights described below.

Categories of personal information we collect

In the preceding 12 months, we have collected the following categories of personal information, as defined by the CCPA:

• Identifiers (name, email address, IP address, account identifiers)
• Commercial information (purchase and course-enrolment history)
• Internet or other electronic network activity (browsing and usage data, advertising identifiers)
• Professional or employment-related information (job title, employer)
• Education information (course progress, assessment results, certifications)
• Approximate geolocation data derived from your IP address

Sources and purposes

We collect this information directly from you, automatically through cookies and similar technologies, and from the service providers described in Section 6, for the purposes described in Sections 3 and 4 of this Policy.

"Do Not Sell or Share"

We do not sell personal information in exchange for money. Because we use third-party analytics and advertising tools (including Google Analytics and the Meta Pixel), certain technical identifiers may be considered "shared" with those providers for cross-context behavioural advertising purposes under the CCPA/CPRA.

[TO BE COMPLETED: legal review of whether this use constitutes "sharing" under the CCPA/CPRA and, if so, implementation of a "Do Not Sell or Share My Personal Information" mechanism]

Non-discrimination

We will not discriminate against you for exercising any of your CCPA rights, including by denying goods or services, charging different prices, or providing a different level of quality.

How to exercise your CCPA rights

You may submit a request to know, delete, or correct your personal information by emailing us at privacy@csl-brands.com, or by writing to the postal address in Section 14. We may need to verify your identity before processing your request.

12. Children's Privacy

Our Services are not directed to children under the age of 16, or the higher minimum age required by your local law, and we do not knowingly collect personal data from children below that age. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take steps to delete it. If you believe a child has provided us with personal data, please contact us at privacy@csl-brands.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or applicable law. We will post the revised Policy on this page and update the "last updated" date above. Where a change is material, we will provide additional notice, such as a notification on our website or by email, before it takes effect.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, or wish to exercise any of the rights described above, please contact us at:

Email: privacy@csl-brands.com
Address: CSL SARL, Douala, Cameroon