Privacy Policy

Effective date: 23 March 2026 Last updated: 23 March 2026

1. Who We Are

Future Prep Ltd. (“we”, “us”, or “our”) is the data controller responsible for your personal data collected through futureprep.eu. We are a company registered in Bulgaria. Company name: Future Prep Ltd. Registration number: 208497759 VAT number: BG208497759 Registered address: 25 Chayka Residential Complex, Entrance A, Apartment 2, Varna 9000, Bulgaria Contact email: info@futureprep.eu For all data protection enquiries, please contact us at info@futureprep.eu. We do not have a separate Data Protection Officer. All data protection requests are handled directly by management.

2. What Data We Collect

We collect and process different types of personal data depending on how you interact with our website:

2.1 When you visit the website

• Technical data: IP address, browser type, operating system, device information, pages visited, referring URL, time and date of access.
• Cookie data: As described in our Cookie Policy. Non-essential cookies are only set with your consent.

2.2 When you submit a form

• Contact and quote request forms: Name, email address, organisation name, job title, and the content of your message.
• Newsletter signup: Email address and, optionally, name and organisation.

2.3 When you create an account

• Account data: Name, email address, organisation name, job title, login credentials (password is stored in hashed form only).
• Subscription and purchase data: Products or subscriptions purchased, payment status, invoice records, access history.
• Learning data: Course progress, completion status, assessment results (where applicable).

2.4 When your employer registers you

If your employer (one of our B2B clients) registers you for access to our platform, we receive your name, email address, and organisation details from your employer. In this case, your employer is the data controller for the decision to share your data with us, and we process your data to deliver the agreed services. Your employer should inform you about this data sharing as part of their own privacy practices.

3. Legal Bases for Processing

We process your personal data on the following legal bases under Article 6(1) of the GDPR:

Processing Activity	Legal Basis	Details
Delivering purchased products, courses, and subscriptions	Contract performance (Art. 6(1)(b))	Necessary to fulfil the agreement between you (or your employer) and us
Account management and access control	Contract performance (Art. 6(1)(b))	Necessary to provide logged-in services
Responding to contact and quote requests	Legitimate interest (Art. 6(1)(f))	Our interest in responding to business enquiries
Sending newsletters and marketing emails	Consent (Art. 6(1)(a))	Only with your explicit opt-in; you can withdraw at any time
Website analytics and improvement	Consent (Art. 6(1)(a))	Only with your cookie consent for analytics
Tax and invoice record-keeping	Legal obligation (Art. 6(1)(c))	Bulgarian and EU tax law require retention of financial records
Website security and fraud prevention	Legitimate interest (Art. 6(1)(f))	Our interest in maintaining a secure platform

4. Who We Share Data With

We do not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary:

• Hosting provider: Upbit Web Design S.R.L. (servers located in Germany) (EU-based servers). Provides the infrastructure on which the website runs.
• Email marketing: Brevo (Brevo SAS, France). All data processed within the EU.. Used to send newsletters. Data transfer to the USA is covered by appropriate safeguards. You can unsubscribe at any time.
• Transactional email: Google (Google Workspace, USA). Used to deliver account-related emails such as order confirmations, password resets, and form notifications. Data transfer to the USA is covered by Google’s Data Processing Amendment and Standard Contractual Clauses.
• Cookie consent: CookieYes. Used to manage your cookie preferences on the website.
• Payment processing: Payments for B2B services are handled via invoice and bank transfer. No third-party payment processor collects card data on futureprep.eu.
• 22Academy: Selected training courses and assessments are delivered through 22Academy (22academy.com), an established European learning platform operated as a delivery label of Future Prep Ltd. If you enrol in a course delivered through 22Academy, a separate user account will be created there. 22Academy’s own privacy policy applies to data processed on that platform.
• Authorities: We may disclose personal data if required by law or in response to a valid legal request from a public authority.

5. International Data Transfers

Your data is primarily stored and processed within the European Union. Where we use service providers based outside the EU/EEA (such as Mailchimp in the USA), we ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission, or an adequacy decision where applicable.

6. How Long We Keep Your Data

• Account data: For as long as your account is active, plus 30 days after deletion request to allow for processing.
• Purchase and invoice records: 10 years from the date of the transaction, as required by Bulgarian tax law.
• Contact form submissions: 12 months after the enquiry has been resolved, unless it leads to a business relationship.
• Newsletter subscriber data: Until you unsubscribe. We will delete your data within 30 days of your unsubscribe request.
• Website analytics data: Anonymised and aggregated data may be retained indefinitely. Identifiable analytics data is deleted after 26 months.
• Learning data: For as long as your account is active. Course completions and certifications may be retained for verification purposes for up to 5 years after account closure.

7. Your Rights

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@futureprep.eu. We will respond within 30 days. If your request is complex, we may extend this period by an additional 60 days and will inform you accordingly. Your account profile page includes options to request a data export and to request account deletion. These requests are reviewed and processed manually to ensure compliance with legal retention obligations.

8. Data Processing Agreements

Where we act as a data processor on behalf of our B2B clients (for example, when a client registers their employees on our platform), we enter into a Data Processing Agreement (DPA) with the client. This agreement governs the processing of personal data in accordance with Article 28 of the GDPR. If you are a B2B client and require a DPA, please contact us at info@futureprep.eu.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted connections (TLS/SSL), secure password hashing, access controls, and regular security monitoring.

10. Children

Our services are intended for business professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

11. Supervisory Authority

Our lead supervisory authority is the Commission for Personal Data Protection (CPDP) in Bulgaria: Commission for Personal Data Protection 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria Website: www.cpdp.bg You also have the right to lodge a complaint with the supervisory authority in the EU member state where you live or work, or where you believe a breach has occurred.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or for legal reasons. The “Last updated” date at the top indicates when it was last revised. Material changes will be communicated through our website or by email where appropriate.

13. Contact

Future Prep Ltd. Email: info@futureprep.eu 25 Chayka Residential Complex, Entrance A, Apartment 2, Varna 9000, Bulgaria