Last updated: 09/07/2026

This Privacy Policy explains how we handle the personal data of visitors to cyl.academy (the “Site”), in accordance with Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act (Chapter 586 of the Laws of Malta).

This Site is informational and presentational in nature: it presents the Change Your Life Academy learning paths and materials and directs users to the pages where those materials can be purchased. No purchases are made on this Site and no payment details are entered here.

1. Who processes your data (Data Controller)

The Bridge – The Third Millennium Teaching Ltd CMS House, Third Floor, St. Peter’s Street, San Gwann SGN 2310, Malta Registration number: C116263 — VAT: MT 3292-4705 Privacy email: privacy@thebridgettmt.com

We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so.

2. What data is processed

Browsing data. The server hosting the Site automatically records technical information: your IP address, your browser and device, the date and time of your visit, and the pages you view. This information is used solely to operate the Site, keep it secure and protect it from abuse.

Technical cookies. The Site uses technical cookies only, which are necessary for it to function. It does not use profiling cookies, analytics tools or advertising pixels. [FONT SENTENCE: include only if the F12 test confirms locally hosted fonts → “Typefaces are hosted on our own servers.”]

Data you provide. Only if you choose to use the withdrawal form described in section 4.

3. Purchases take place outside this Site

The buttons giving access to the learning paths and materials lead to the online shop italianteaching.it, operated by Italian Teaching Srl (VAT 02972650184), which is the seller of the products offered there.

When you click those buttons you leave this Site. All order-related data — personal details, billing address, payment information — is collected and processed directly by Italian Teaching Srl on its own website, under its own privacy policy, which we invite you to read before proceeding. cyl.academy does not receive, store or process any payment data.

4. Withdrawal from a contract

For each language, the Site provides a link to an online form for exercising your right of withdrawal from a contract. The form is hosted on the HubSpot platform, which acts as our Data Processor (Art. 28 GDPR) on infrastructure located within the European Union.

The data you enter in the form (identification and contact details, contract references, and any further information you choose to give us) is processed solely to handle your withdrawal request and to meet the related contractual and legal obligations.

5. Why we process it, and on what legal basis

• Operating the Site, security, abuse prevention → Legitimate interest (Art. 6.1.f)
• Handling your withdrawal request → Performance of a contract (Art. 6.1.b)
• Complying with legal, accounting and tax obligations, or with requests from the authorities → Legal obligation (Art. 6.1.c)

6. Who else sees your data

Browsing data passes through our hosting provider; withdrawal form data passes through HubSpot. Both process it on our behalf, under an agreement pursuant to Art. 28 GDPR.

We do not sell, disclose or transfer your data to third parties for commercial or advertising purposes. We may disclose it to the competent authorities where required by law, or to our professional advisers where necessary to handle your request.

7. Links to other websites

This Site contains links to other websites, including the online shop referred to in section 3. By clicking them you leave this Site: from that moment your data is processed under the privacy policy of the destination site, over which we have no control and which we invite you to read.

8. Your data stays in the European Union

The Data Controller is established in Malta (EU) and the infrastructure used for the forms is located within the European Union. Should any provider carry out processing outside the European Economic Area, this takes place on the basis of the Standard Contractual Clauses approved by the European Commission or another appropriate safeguard provided for under Chapter V of the GDPR.

9. How long we keep your data

• Server logs (including IP addresses): no longer than 12 months.
• Technical cookies: for the duration of the session or according to the expiry set by your browser.
• Withdrawal form data: for as long as needed to handle the request and, thereafter, for the retention periods required by contractual, accounting and tax law.

10. Do you have to give us anything?

No. Simply browsing the Site does not require you to provide any data. If you use the withdrawal form, the fields marked as mandatory are necessary to identify you and act on your request: without them we cannot process it.

11. Your rights

At any time you may ask us to give you access to your data, to correct it, erase it, restrict its use, to object to processing based on legitimate interest, and to receive it in a portable format. Where processing is based on consent, you may withdraw that consent at any time.

Write to us at privacy@thebridgettmt.com: we will reply within one month.

As the Data Controller is established in Malta, the competent supervisory authority is the Information and Data Protection Commissioner (IDPC) — idpc.org.mt. You may also contact the authority in your own country: in the United Kingdom, the Information Commissioner’s Office (ICO) (www.ico.org.uk); in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it); in Spain, the AEPD (www.aepd.es); in France, the CNIL (www.cnil.fr).

12. How we protect your data, and updates

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or misuse. No system is 100% secure, but we work to make ours as secure as possible.

We may update this Privacy Policy over time. Any changes will be published on this page; the “last updated” date always indicates the version in force.

13. Transparency Notice on the Use of Artificial Intelligence (EU AI Act)

In accordance with Regulation (EU) 2024/1689, cyl.academy advises that certain support processes, graphic layout elements or teaching materials may be produced with the assistance of generative Artificial Intelligence tools. All textual, educational and training content on our site and within our programmes is fully reviewed, verified and approved by our team before publication. Any audio or video material created using voice synthesis or digital avatars is clearly labelled as such, in compliance with legal requirements.

14. Contact

For any questions: privacy@thebridgettmt.com