Privacy Policy

Effective date: 6.7.2026

 

This Privacy Policy explains how Flagship Impact s.r.o., company ID No. 19306571, with its registered office at Vězeňská 859/9, 110 00 Prague 1, Czech Republic (“Flagship”, “we”, “us” or “our”), collects, uses, stores, shares and protects personal data in connection with the website and online platform available at https://flagship.academy and any related services, content, tools, expert sessions, memberships, recordings, toolkits, customer accounts, communications and features operated under the name Flagship Academy.

You can contact us regarding privacy and data protection matters at:

E-mail: academy@flagshipimpact.com
GDPR / privacy contact: academy@flagshipimpact.com

This Privacy Policy applies to visitors, registered users, customers, members, purchasers, expert session participants, persons using our tools, persons communicating with us, business representatives, company users, and other individuals whose personal data we process in connection with Flagship Academy.

Flagship Academy is intended for both business customers and individual customers, including users located in the Czech Republic, elsewhere in the European Economic Area, the United Kingdom, Switzerland and other countries. Where local privacy laws apply to you, we will respect your rights to the extent required by applicable law.

 

1. Who is responsible for your personal data?

For most processing described in this Privacy Policy, Flagship Impact s.r.o. acts as the data controller, meaning that we determine why and how your personal data is processed.

In certain limited situations, especially where a business customer provides access to its employees, contractors or other authorised users, the business customer may also be responsible for ensuring that it has the appropriate legal basis to provide us with such personal data. Depending on the specific arrangement, Flagship may act as an independent controller, processor or another relevant party under applicable data protection laws.

If a separate data processing agreement, service agreement, order form or other contractual document applies, that document may further define the privacy roles and obligations between Flagship and the relevant business customer.

 

2. What is Flagship Academy?

Flagship Academy is an online expert platform focused on ESG and sustainability. Through the platform, users may create an account, purchase access to content, register for Expert Sessions, watch recordings, access Toolkits, use expert tools and interact with the Ask ESG Expert chatbot.

The /account/ section is used for login, profile and password management, basic account information and access to billing or order-related links.

The /my-academy/ section is the logged-in member area where users may access available content, Expert Sessions, recordings, Toolkits, tools and membership benefits.

Depending on the products and features you use, your personal data may be processed in connection with account management, access control, ecommerce, payments, subscriptions, expert sessions, recordings, protected downloads, marketing, CRM, analytics, cookies, conversion tracking, AI tools, customer support, technical security and legal compliance.

 

3. What personal data do we process?

We may process the following categories of personal data, depending on how you interact with Flagship Academy.

3.1 Account and profile data

This may include in particular:

• first name and last name, date of birth;
• e-mail address, phone number;
• company or organisation;
• job title or position;
• login credentials and password-related data processed through WordPress;
• account status;
• profile settings;
• basic account events, such as password setup, password reset, password change or profile update;
• recordings of image and voice;
• information about whether you accepted this Privacy Policy or other legal documents and the date of such acceptance.

Users may not always be able to change all account details directly through the platform. For example, if e-mail address changes are not available in the user interface, you may contact us.

3.2 Purchase, order, payment and subscription data

If you purchase the membership, Expert Session access, recording access or another product, we may process data such as:

• purchased products;
• order details;
• invoice or receipt data;
• billing information;
• payment status;
• subscription status;
• VAT / tax-related information;
• customer dashboard data;
• refund status;
• access rights connected with a purchase;
• information needed to activate, maintain, cancel or remove access.

Payments are processed through third-party payment and ecommerce providers. We do not intentionally store full payment card details on our own systems.

3.3 Membership and access data

We may process data about:

• your active or expired membership;
• your access rights to Expert Sessions, recordings, Toolkits, Expert Tools and other member benefits;
• access rights for individual sessions or recordings;
• whether access should continue until the end of a paid period;
• whether access should be removed after a refund;
• use of Dedicated Expert Guidance, including monthly usage status where applicable.

3.4 Expert Session registration and participation data

When you register for or participate in Expert Sessions, including free sessions, we may process:

• first name and last name;
• e-mail address;
• company;
• job title or position;
• selected Expert Session;
• registration status;
• attendance and participation information;
• Privacy Policy acceptance;
• marketing consent, if provided;
• communications related to the session.

Live Expert Sessions may take place through Microsoft Teams or another online meeting provider. Depending on how you participate, the relevant provider may process your name, e-mail address, meeting metadata, device data, IP address, chat content, audio, video or other information connected with the meeting.

Where sessions are recorded, participants may be informed in the meeting or through related communications. If you speak, share your screen, use video, write in chat or otherwise actively participate in a recorded session, your contribution may be included in the recording.

3.5 Recording and content usage data

Recordings may be hosted through Vimeo and embedded on the platform. When you access recordings or other protected content, we or our providers may process:

• account and access data;
• viewing or interaction data;
• device and browser data;
• IP address;
• cookies or similar identifiers;
• technical logs;
• information needed to verify that you are authorised to access the content.

3.6 Toolkit and protected file access data

Toolkits and other protected files are not ordinary public media files. Access may be controlled server-side before a file is made available. For this purpose, we may process:

• your account ID or user identifier;
• product or membership access rights;
• requested file or resource;
• date and time of request;
• IP address;
• technical logs;
• security and anti-abuse information.

3.7 Marketing and communication data

If you subscribe to marketing communications, register for content, attend sessions, become a customer or otherwise communicate with us, we may process:

• contact details;
• company and role;
• marketing consent and the date of consent;
• e-mail preferences;
• communication history;
• newsletter subscription status;
• campaign, segment or group membership;
• information about whether you opened or interacted with our communications;
• opt-out or unsubscribe information.

3.8 CRM and lead data

We may process personal data in our CRM systems for business development, customer relationship management and lead management purposes. This may include:

• name;
• e-mail address;
• company;
• position;
• phone number, if provided;
• business relationship notes;
• communication history;
• customer or lead status;
• interests in Flagship Academy products or services.

3.9 Analytics, cookies and online identifiers

When you visit or use the website, we and our analytics, advertising and cookie consent providers may process:

• IP address;
• browser type and version;
• device information;
• operating system;
• approximate location derived from IP address;
• pages visited;
• referring pages;
• click and interaction data;
• session data;
• cookie identifiers;
• consent choices;
• conversion and campaign data;
• aggregated analytics and reporting data.

Further information is provided in the cookie banner, cookie settings or separate cookie documentation available on the website, where applicable.

3.10 AI chatbot and expert tool data

When you use Ask ESG Expert or other expert tools, we may process:

• your prompts, questions and instructions;
• generated responses;
• relevant context needed to provide the response;
• account, membership or access status;
• usage logs;
• technical metadata;
• content you voluntarily submit;
• security and abuse-prevention information.

Ask ESG Expert uses OpenAI through an API. Your prompts and relevant context may be transmitted through our backend to the AI system to generate a response. The chatbot may behave differently depending on whether you are logged in and what content or access rights are available to your account.

Other tools may use additional providers. For example, Greenwashing Check may operate through a Lovable app. Legislation Check may use an external provider or hosting environment that may be confirmed or changed over time.

You should not submit sensitive personal data, confidential business information, trade secrets, special-category personal data or data about third parties into AI tools unless this is necessary, lawful and authorised.

3.11 Support, feedback and other voluntary data

If you contact us, request support, submit feedback, participate in surveys or otherwise communicate with us, we may process the information you provide, including your contact details, the content of your message and related communication history.

3.12 Sensitive data

We do not intentionally request or require special categories of personal data, such as health data, biometric data, political opinions, religious beliefs or similar sensitive information, unless explicitly stated for a specific purpose.

If you voluntarily provide such data, including in free-text fields, chatbot prompts, meeting chats, support messages or other communications, we may process it to the extent necessary to handle your request, provide the relevant service, protect our rights or comply with legal obligations.

 

4. How do we collect personal data?

We may collect personal data:

• directly from you when you create an account, register, purchase, communicate with us or use the platform;
• from your employer or organisation if they arrange access for you;
• automatically when you use the website, content, cookies, analytics or tools;
• from payment, ecommerce, marketing, CRM, analytics, hosting, communication and AI providers;
• from public or business sources where relevant for B2B communication and customer relationship management;
• from your interactions with Expert Sessions, recordings, Toolkits, tools and communications.

 

5. Why do we process personal data and on what legal basis?

We process personal data only where we have a lawful basis under applicable data protection laws.

5.1 To provide the platform and services

We process personal data to create and manage accounts, authenticate users, provide purchased access, manage memberships, operate /account/ and /my-academy/, provide Expert Sessions, recordings, Toolkits, expert tools, chatbot features, customer dashboards, protected downloads and related services.

Legal basis: performance of a contract or steps prior to entering into a contract; legitimate interest in operating the platform and providing access to authorised users.

5.2 To process orders, payments, subscriptions and refunds

We process personal data to manage checkout, orders, payments, subscriptions, invoices, receipts, VAT / tax obligations, customer dashboards, refunds and access changes.

Legal basis: performance of a contract; compliance with legal obligations; legitimate interest in keeping proper business and accounting records.

5.3 To manage access rights and protected content

We process personal data to determine whether you have access to Expert Sessions, recordings, Toolkits, Expert Tools and other content, and to prevent unauthorised access or misuse.

Legal basis: performance of a contract; legitimate interest in protecting paid content, platform security and our business.

5.4 To organise Expert Sessions and related communications

We process personal data to register participants, send confirmations and reminders, provide access links, manage attendance, host live sessions, make recordings available and follow up with relevant materials.

Legal basis: performance of a contract or requested service; legitimate interest in organising events and communicating with participants; consent where required for specific communications or recordings.

5.5 To provide AI tools and expert tools

We process personal data and user-submitted content to provide Ask ESG Expert, Greenwashing Check, Legislation Check and other tools, generate responses, maintain functionality, ensure security, prevent abuse and improve the user experience.

Legal basis: performance of a contract or requested service; legitimate interest in operating, securing and improving the tools; consent where required by applicable law.

5.6 To communicate with you

We process personal data to respond to inquiries, provide support, send operational and transactional e-mails, notify you about account, password, access, registration, payment, membership and Expert Session matters, and manage our relationship with you.

Legal basis: performance of a contract; legitimate interest in communicating with users and customers; compliance with legal obligations where applicable.

5.7 To send marketing communications

We may process personal data to send newsletters, updates, invitations, offers, educational content or other marketing communications related to Flagship Academy, ESG, sustainability, Expert Sessions, memberships or related services.

Where required, we will send such communications based on your consent. In certain B2B or existing-customer contexts, we may rely on legitimate interest where permitted by law, always subject to your right to opt out.

Legal basis: consent; legitimate interest in direct marketing where permitted by law.

5.8 To maintain CRM and business relationships

We may process personal data of business contacts, leads, customer representatives and partners for CRM, business development, customer management and communication purposes.

Legal basis: legitimate interest in managing business relationships; performance of a contract or pre-contractual steps; consent where required.

5.9 To measure, analyse and improve the website and platform

We use analytics and reporting tools to understand how users interact with the website and platform, measure performance, improve content, evaluate campaigns, troubleshoot issues and prepare aggregated reports.

Legal basis: consent for non-essential cookies and similar technologies where required; legitimate interest for basic technical, security and aggregated operational analytics where permitted.

5.10 To measure advertising and conversions

We may use tools such as Google Analytics, Google Tag Manager, Looker Studio and LinkedIn Campaign Manager to measure campaigns, conversions and advertising performance.

Legal basis: consent where required for cookies, pixels, tracking and similar technologies; legitimate interest in aggregated campaign reporting where permitted.

5.11 To ensure security and prevent misuse

We process personal data to secure accounts, prevent fraud, protect paid content, detect unauthorised access, monitor technical performance, maintain backups, troubleshoot errors and protect our systems, users and business.

Legal basis: legitimate interest in security, fraud prevention and platform integrity; compliance with legal obligations where applicable.

5.12 To comply with legal obligations and protect legal claims

We may process personal data to comply with accounting, tax, corporate, consumer protection, data protection, cybersecurity or other legal obligations, respond to lawful requests and establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations; legitimate interest in legal protection and dispute management.

 

6. External providers and third-party processing

We use external providers and technical partners to operate Flagship Academy. Depending on how you use the platform, your personal data may be transferred to, accessed by, stored with or otherwise processed by these providers.

We use such providers mainly for hosting, server management, monitoring, backups, ecommerce, payments, transactional e-mails, marketing e-mails, CRM, video hosting, live sessions, analytics, conversion tracking, cookies, consent management, AI tools and expert tools.

Where these providers process personal data on our behalf, we take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are in place. Some providers may also act as independent controllers for certain processing activities, such as payment processing, fraud prevention, analytics, advertising, platform security or account-level service data.

You can find additional information about each provider’s own data processing practices on the provider pages linked below.

Provider / tool	Main purpose	Provider information
WordPress / website database	User accounts, profiles, access rights, registrations, consents, membership status, protected content access and account-related events. WordPress is used as part of our self-hosted website infrastructure.	WordPress-related processing depends on our website setup and plugins.
Hetzner	Hosting of the website and database, currently on servers in Germany.	Hetzner Data Privacy Policy
RunCloud	Server management, technical administration and potentially backups.	RunCloud Privacy Policy
WP Umbrella	Website monitoring, maintenance and backups.	WP Umbrella Privacy Policy
SureCart	Ecommerce, checkout, orders, subscriptions, customer dashboard, order confirmations, invoices / receipts and tax / VAT handling.	SureCart Privacy Policy
Stripe	Payment processing, payment data, customer and transaction data, fraud prevention and payment-related compliance.	Stripe Privacy Policy
Brevo	Transactional e-mail delivery, where used.	Brevo Privacy Policy
Microsoft	Microsoft Teams for live Expert Sessions; potentially e-mail or other communication infrastructure in the future.	Microsoft Privacy Statement
MailerLite	Marketing database, segmentation, Academy user groups, session groups, membership groups and users with marketing consent.	MailerLite Privacy Policy
Raynet	CRM and management of contacts, leads and business relationships.	Raynet Security and Data Protection
Vimeo	Hosting and playback of video recordings embedded on the platform.	Vimeo Privacy Policy
Google Analytics, Google Tag Manager and Looker Studio	Analytics, reporting, conversion measurement, tag management and aggregated performance reports.	Google Privacy Policy, How Google uses information from sites or apps, Google Tag Manager privacy and security,
LinkedIn Campaign Manager	Advertising conversion tracking, campaign reporting and measurement of LinkedIn advertising performance.	LinkedIn Privacy Policy, LinkedIn Marketing Solutions GDPR information
OpenAI	AI processing for Ask ESG Expert through API, including prompts, relevant context and generated responses as needed to provide the tool.	OpenAI Privacy Policy, OpenAI Data Processing Addendum, OpenAI Business Data information
Lovable	Greenwashing Check tool or related app functionality.	Lovable Privacy Policy, Lovable Data Processing Agreement
Complianz	Cookie banner, cookie consent management and Consent Mode.	Complianz Privacy Statement
Cloudflare	Not currently active, but may be used in the future for CDN, DNS, security, caching, bot protection or similar infrastructure functions.	Cloudflare Privacy Policy

This list may change over time as our platform, tools and providers develop. We may replace, add or remove providers where reasonably necessary to operate, secure or improve Flagship Academy, comply with law, or provide the services requested by users and customers.

 

7. AI tools: important information

Ask ESG Expert and other AI-supported tools are provided to help users work with ESG, sustainability and related expert content. Always remember that AI outputs may be incomplete, inaccurate or not suitable for a specific legal, regulatory, tax, financial, investment, technical or business decision without independent expert review.

When you use AI tools, your input may be processed by Flagship and relevant external providers as described in this Privacy Policy. This may include your prompts, related context, metadata and generated outputs.

You are responsible for ensuring that you have the right to submit any information entered into AI tools. Do not submit personal data about other people, confidential information, trade secrets or sensitive information unless you are authorised to do so and the submission is lawful.

We do not use AI tools to make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you, unless expressly stated and permitted by applicable law.

 

8. Cookies, analytics and consent

We use cookies and similar technologies to operate the website, remember choices, manage consent, analyse website performance, measure conversions, improve the platform and support marketing activities.

Some cookies are necessary for the website and platform to function. Other cookies, such as analytics, advertising and conversion tracking cookies, may be used only with your consent where required by law.

Cookie consent is managed through Complianz or another consent management solution. You can adjust your cookie choices through the cookie banner or cookie settings available on the website, where applicable. You can also control cookies through your browser settings.

If you disable certain cookies, some parts of the website or platform may not function properly.

 

9. Marketing communications and opt-out

If you receive marketing communications from us, you can unsubscribe at any time by:

• clicking the unsubscribe link in the relevant marketing e-mail;
• changing your preferences where such functionality is available;
• contacting us at academy@flagshipimpact.com.

If you unsubscribe from marketing communications, we may still send you transactional, account, access, payment, security, legal or service-related communications where necessary.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

 

10. International transfers

We are based in the Czech Republic and many of our core services are operated within the European Union or the European Economic Area. However, some of our providers or their sub-processors may process personal data in countries outside the EEA, the United Kingdom or Switzerland, including the United States or other jurisdictions.

Where personal data is transferred internationally, we rely on appropriate safeguards where required by applicable law. These safeguards may include adequacy decisions, standard contractual clauses, data processing agreements, transfer impact assessments, technical and organisational measures, or other lawful transfer mechanisms.

Because our provider ecosystem may change over time, the countries in which data is processed may also change depending on the providers, sub-processors, features and services used.

 

11. How long do we keep personal data?

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

In particular:

• account and profile data may be kept for as long as your account exists and for a reasonable period afterwards where necessary for legal, security, accounting, support or dispute purposes;
• access rights, purchase and membership data may be kept for as long as needed to provide access, document the transaction and comply with legal obligations;
• accounting, tax, invoice and payment-related records may be kept for the period required by applicable accounting and tax laws, which may be up to 10 years or longer if required by law;
• Expert Session registration and participation data may be kept for as long as needed to organise the session, provide access to related materials, manage customer relationships and protect legal claims;
• recordings may be kept for as long as they remain part of the relevant product, session archive, membership benefit or other legitimate business purpose;
• marketing data may be kept until you unsubscribe, withdraw consent or object, and for a limited period afterwards to maintain suppression lists and demonstrate compliance;
• cookie consent records may be kept for as long as necessary to demonstrate consent choices and comply with applicable laws;
• chatbot prompts, generated outputs and technical logs may be kept for as long as necessary to provide the tool, maintain security, troubleshoot, improve the service, comply with law and protect legal claims;
• CRM and business contact data may be kept for the duration of the business relationship and for a reasonable period afterwards.

When personal data is no longer needed, we will delete, anonymise or otherwise restrict it, unless further retention is required or permitted by law.

 

12. Who may access personal data?

Personal data may be accessed by:

• authorised Flagship personnel and contractors who need access for the purposes described in this Privacy Policy;
• technical, ecommerce, payment, marketing, CRM, analytics, hosting, communication, AI and other service providers;
• professional advisers, such as lawyers, accountants, auditors or tax advisers;
• public authorities, courts, regulators or law enforcement bodies where required by law;
• business customers or organisations that arrange access for their authorised users, where relevant;
• successors or counterparties in connection with a merger, acquisition, restructuring, transfer of assets or similar corporate transaction, subject to appropriate safeguards.

Persons authorised to access personal data are expected to process it only as necessary and are subject to confidentiality or equivalent obligations.

 

13. Security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, authentication, server security, protected file access, backups, monitoring, role-based permissions, secure hosting, technical maintenance, encryption where appropriate, logging, supplier controls and internal procedures.

No online service can be guaranteed to be completely secure. You are responsible for keeping your login credentials confidential and for notifying us if you suspect unauthorised access to your account.

 

14. Business users and company accounts

If you use Flagship Academy on behalf of a company, employer or other organisation, that organisation may provide us with your personal data, arrange your access, manage payment or receive information about access rights, membership, participation or usage where relevant to the relationship.

If you are a business customer or administrator, you are responsible for ensuring that any personal data you provide to us about employees, contractors, clients, representatives or other individuals is provided lawfully and that those individuals receive appropriate privacy information where required.

 

15. Your rights

Depending on applicable law and your location, you may have the following rights regarding your personal data:

• the right to be informed about processing;
• the right of access to your personal data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of your personal data;
• the right to restriction of processing;
• the right to object to processing based on legitimate interests, including direct marketing;
• the right to data portability;
• the right to withdraw consent at any time, where processing is based on consent;
• the right not to be subject to certain decisions based solely on automated processing, where applicable;
• the right to lodge a complaint with a supervisory authority.

To exercise your rights, contact us at academy@flagshipimpact.com.

We may need to verify your identity before processing your request. Some rights may be limited by applicable law, legal obligations, third-party rights, security requirements or our need to establish, exercise or defend legal claims.

If you are located in the European Union or in any other jurisdiction, you may always lodge a complaint with your local data protection authority. As we are established in the Czech Republic, you may also contact the Czech supervisory authority:

Úřad pro ochranu osobních údajů
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
Website: https://uoou.gov.cz/

 

16. Children

Flagship Academy is not intended for children. We do not knowingly collect personal data from children under the age required by applicable law for valid use of online services without appropriate consent or authorisation.

If you believe that a child has provided us with personal data, please contact us.

 

17. Links to third-party websites and services

The platform may contain links to third-party websites, tools, content, payment pages, video players, meeting platforms or other services. Those third parties may process personal data according to their own privacy policies, terms and settings.

We are not responsible for the privacy practices of third-party websites or services that are not controlled by us. We encourage you to read the privacy information provided by those third parties.

 

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example if our services, tools, providers, legal obligations or data processing practices change.

The updated version will be published on the website with the updated effective date or last updated date. Where required by law or where changes are material, we may notify you by e-mail, through the platform or by another appropriate method.

 

19. Contact

If you have any questions, requests or concerns regarding this Privacy Policy or the processing of your personal data, please contact us at:

Flagship Impact s.r.o.
Vězeňská 859/9
110 00 Prague 1
Czech Republic

E-mail: academy@flagshipimpact.com
Privacy / GDPR contact: academy@flagshipimpact.com