Privacy Policy — Politique de confidentialité (RGPD)
Last updated: 7 October 2026
This Privacy Policy explains how NPDS (trading as Gate 33) collects, uses and protects personal data of visitors and clients of gate33.co, in compliance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).
1. Data controller
NPDS. SIREN 534 221 387. Contact for privacy matters: nicolas@gate33.co.
2. Categories of personal data collected
- Identification data: first name, last name, email, position/job title, company (Newsletter, Discovery Call, Enrollment); postal address (training contract).
- Application data: CV, LinkedIn profile URL, professional background (Mentorship intake, Operational Assessment).
- Payment data: processed exclusively by Stripe/PayPal. NPDS never stores card details.
- Technical data: IP address, browser, device, pages visited, time spent (via analytics — only with consent).
- Communications: content of your emails, messages via HubSpot Chat, notes taken during discovery calls.
- Call recordings and notes: Mentorship sessions, unless refused by the Client.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|
| Managing enrollment, delivering the training, invoicing | Performance of a contract (Art. 6.1.b) | 10 years (accounting obligations) |
| Mentorship delivery: CV rebuild, applications sent on the Client's behalf, call recordings | Performance of a contract (Art. 6.1.b) | CVs and application data: 3 years after the end of the Mentorship; call recordings: until the end of the programme plus 3 months |
| Discovery call and application data of non-clients (CV, LinkedIn) | Pre-contractual measures (Art. 6.1.b) | 3 years from last contact |
| Sending the newsletter and marketing communications | Consent (Art. 6.1.a) | Until unsubscription, then 3 years max |
| Responding to enquiries and discovery calls | Pre-contractual measures (Art. 6.1.b) | 3 years from last contact |
| Website analytics (audience measurement) | Consent (Art. 6.1.a) — via cookie banner | 13 months |
| Fraud prevention, security, legal obligations | Legitimate interest / legal obligation (Art. 6.1.f, 6.1.c) | As required by law |
4. Data recipients (subprocessors)
Personal data is processed by the following subprocessors, each bound by data processing agreements:
- HubSpot, Inc. (USA) — CRM, contact management, newsletter list, chat widget. Transfers based on EU Standard Contractual Clauses.
- Stripe Payments Europe, Ltd. (Ireland/USA) — payment processing.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — instalment payments (up to 24×).
- Resend, Inc. (USA) — transactional email delivery.
- Google (Google Analytics 4) (USA) — anonymised audience analytics, only if consent given.
- LinkedIn Corporation (USA) — LinkedIn Insight Tag, only if consent given.
- Meta Platforms, Inc. (USA) — Meta Pixel advertising conversion tracking, only if consent given.
- Calendly, Inc. (USA) — discovery call scheduling.
- Fathom Video, Inc. (USA) — recording and transcription of calls.
- Google LLC / Google Ireland Ltd — Google Meet video calls and Gmail accounts used for applications.
- WhatsApp Ireland Ltd (Meta) — client messaging support.
- Klarna Bank AB (Sweden) — instalment payments.
- Anthropic PBC (USA) — AI assistance used to analyse CVs and draft documents.
- Emergent Labs Inc. (255 California Street, Suite 550, San Francisco, CA 94111, United States) — website hosting.
5. Data transfers outside the EEA
Certain subprocessors (Stripe, HubSpot, Google, LinkedIn, Calendly, Fathom, Anthropic, Meta (WhatsApp)) may process data outside the European Economic Area, in particular in the United States. Such transfers are secured by the EU Standard Contractual Clauses adopted by the European Commission and, where applicable, by adherence to the EU-US Data Privacy Framework.
6. Your rights under GDPR
You have the following rights regarding your personal data:
- Right of access (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure / to be forgotten (Art. 17)
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20)
- Right to object to processing (Art. 21), including for direct marketing purposes at any time
- Right to withdraw consent at any time where processing is based on consent
- Right to define post-mortem directives regarding your personal data (French Data Protection Act, Article 85)
To exercise any of these rights, please contact us at nicolas@gate33.co. We will respond within one month.
7. Right to lodge a complaint
If you believe your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (CNIL — Commission Nationale de l'Informatique et des Libertés):
8. Cookies
Cookies are governed by our Cookie Policy. Non-essential cookies (analytics, marketing) are disabled by default and only loaded after your explicit consent through the cookie banner.
9. Security
NPDS implements appropriate technical and organisational measures to protect personal data, including HTTPS encryption, access controls, and contractual safeguards with subprocessors. However, no method of transmission over the internet is 100% secure.
10. Changes to this policy
This Privacy Policy may be updated to reflect changes in the law or in our practices. The most recent version is always available at gate33.co/legal/privacy.