Privacy Policy
Last updated: 28/04/2026 · GRC FORGE is committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR) and applicable data protection law.
1. Data Controller
The data controller for your personal data is:
| Company | GRC FORGE |
|---|---|
| contact@grcforge.pro | |
| DPO contact | contact@grcforge.pro |
| Website | https://grcforge.pro |
2. Data Collected
| Category | Data | Legal basis |
|---|---|---|
| Account | First name, last name, email, hashed password, role, plan | Contract execution |
| Progression | Quiz scores, completed modules, certificates, exam history | Legitimate interest |
| AI Interactions | Questions asked to the AI, session identifiers | Contract execution |
| Payment | Transaction reference, plan, amount, currency (no card data stored) | Legal obligation |
| Technical | Connection logs, IP address, browser/OS | Legitimate interest (security) |
| Preferences | Interface language, notification settings | Legitimate interest |
3. Purposes of Processing
- Account management: Authentication, profile, subscription access
- Service delivery: Access to courses, quizzes, AI tools, certificates
- Progression tracking: Storing scores, module completions, learning analytics
- Billing: Payment processing, invoice management
- Communications: Transactional emails, important service notifications
- Security: Fraud detection, access logs, platform integrity
- Product improvement: Anonymous usage analytics
GRC FORGE does not use your personal data for commercial prospecting without your explicit consent.
4. Data Retention
| Category | Retention period |
|---|---|
| Account data | For the duration of the account, then 3 years after deletion request |
| Learning progression | Duration of account + 2 years |
| AI conversations | 12 months rolling (then anonymized) |
| Billing records | 10 years (legal obligation) |
| Connection logs | 12 months |
5. Data Sharing
GRC FORGE does not sell your personal data. Data may be shared with the following categories of recipients:
- Payment partners: Payment processing (secure environment)
- Anthropic: AI query processing (Claude API) — anonymized where possible
- Hosting provider: Technical infrastructure
- Email service: Transactional email delivery
All processors are subject to contractual obligations ensuring GDPR compliance. Data transfers outside the EU are governed by appropriate safeguards (Standard Contractual Clauses or adequacy decisions).
6. Your Rights
Under GDPR, you have the following rights regarding your personal data:
To exercise these rights, contact: contact@grcforge.pro
We will respond within 30 days of receiving your request. If you believe your rights have not been respected, you have the right to lodge a complaint with your national supervisory authority (e.g., CNIL in France).
7. Cookies and Trackers
| Cookie | Purpose | Duration |
|---|---|---|
PHPSESSID | Authentication session | Session |
grc_lang | Language preference | 1 year |
csrf_token | Security (CSRF protection) | Session |
| Analytics | Anonymous usage statistics | Up to 13 months |
You can configure or disable cookies in your browser settings. Disabling essential cookies may prevent access to certain platform features.
8. Security
GRC FORGE implements technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure or destruction:
- HTTPS encryption for all data in transit
- Bcrypt hashing of passwords
- CSRF protection on all sensitive forms
- Regular security audits
- Restricted access to personal data (need-to-know principle)
In the event of a personal data breach likely to result in a high risk for your rights, you will be notified without undue delay in accordance with GDPR Article 34.
9. Policy Updates
This Privacy Policy may be updated at any time. Any significant changes will be communicated by email or via a notice on the platform. We encourage you to review this policy periodically.
The date at the top of this page indicates when the policy was last revised.
10. Contact
For any questions regarding this Privacy Policy or to exercise your rights:
- DPO email: contact@grcforge.pro
- General contact: grcforge.pro/en/contact.php