Privacy Policy

Last updated: 18 October 2026

This Privacy Policy explains how the Go2Grow learning-mobility platform processes personal data when you browse training opportunities, use search and optional local Save / Compare and Mobility Planner tools, make a course-registration enquiry, request an invoice, submit or update a provider opportunity using a private link, contact us, or use optional analytics and assistance features. Public website account registration and online card payments are not offered in the current workflow.

1. Data controller and privacy contact

For personal data processed to operate the Go2Grow platform, the platform publicly identifies its data controller as Go2Grow, with privacy enquiries received at info@go2grow.eu. Go2Grow is the public platform name; additional legally required controller-identification details are not currently included in this notice. Until that information is completed, privacy requests and notices can be sent to info@go2grow.eu or the Go2Grow contact form. Where an independent course provider receives details necessary to administer a separately confirmed training agreement, that provider may be an independent controller for its own processing; the purpose and recipient must be communicated to the participant as appropriate.

2. Categories and sources of personal data

• Participant registration enquiries: name, email, organisation or institution, destination and selected programme or date, financing option and any optional message.
• Optional invoice data: legal or organisation name, billing address and any company or VAT number entered when an invoice is requested.
• Provider submissions: organisation, contact person, organisation email, programme details, website or programme reference URL, images and details needed to review and update a listing.
• Support and correspondence: contact-form content, email exchanges, claims, corrections and requests.
• Platform and security records: IP addresses, device/browser technical data, submission timestamps, security and anti-spam records and required cookies.
• Optional interactions: Save / Compare, Mobility Planner exports and AI assistant prompts where used; processing depends on the feature and may be local to the visitor’s browser or involve a third-party service.
• Indirect sources: publicly available, provider-published factual programme details, with personal data minimised where practicable.

Go2Grow does not offer public participant or provider accounts in its current workflow, and its registration form does not collect payment-card data. Please do not submit health, identity-document or other sensitive data unless a lawful, specifically explained need arises.

3. Processing purposes and lawful bases

Responding to enquiries and arranging requested steps: GDPR Article 6(1)(b) where needed for steps requested before entering a contract or performance of the relevant platform service. Provider submissions and updates: steps connected to the requested listing service or legitimate interests in administering accurate information (Articles 6(1)(b) and, where appropriate, 6(1)(f)). Security, fraud prevention and proportionate service operations: legitimate interests (Article 6(1)(f)), balanced against individual rights. Invoicing, accounting and legal recordkeeping: compliance with applicable legal obligations (Article 6(1)(c)) where a transaction actually occurs. Optional analytics, advertising tracking and direct marketing: prior consent where required by the GDPR and applicable EU ePrivacy requirements and national implementing rules (Article 6(1)(a)); consent can be withdrawn at any time. Responding to rights requests and statutory complaints: legal obligations (Article 6(1)(c)).

Personal data must not be repurposed for unrelated advertising merely because someone submits a course enquiry. Go2Grow does not make eligibility or funding decisions with legally significant effects using automated profiling.

4. Opportunity listings and indirectly obtained information

Provider organisations may submit their organisation details, programme descriptions, permitted media and contact information for listing. The organisation warrants that it has rights to use supplied content and an appropriate basis to disclose personal contact details. Go2Grow may also prepare independent factual summaries from openly available programme announcements, taking reasonable care not to republish unlicensed photos or substantial protected material. Source, categories, lawful basis and GDPR Article 14 transparency requirements are assessed where personal data originates from someone other than the data subject. Providers can request correction, claim or removal through info@go2grow.eu.

5. Participant enquiries, invoices and disclosures

On an available course page, the Register / Request a place form sends a request to Go2Grow. It records the selected listing and participant details and, where chosen, an invoice requirement and billing information. This does not in itself create a paid order, confirmed place or charge to a payment card. Go2Grow contacts the participant about next steps, availability and manual payment instructions where applicable.

Where registration coordination requires a programme organiser to receive participant data, Go2Grow limits disclosure to the information necessary and informs the participant appropriately. Where the course organiser becomes a separate controller it is responsible for its own transparency duties and cannot treat the enquiry data as unrestricted marketing permission. Public provider website addresses supplied to Go2Grow for verification are not necessarily displayed as participant registration channels.

6. Cookies and similar technologies

Go2Grow uses essential cookies or local storage for security, forms, visitor choices and other functions expressly requested by the visitor. A consent preference is recorded in the g2g_cookie_consent cookie for up to 180 days, unless changed or cleared earlier, to remember the visitor’s choice. Optional analytics or advertising storage is not necessary for the basic service and requires prior consent under applicable EU ePrivacy requirements and national implementing rules and the GDPR. Visitors should be able to accept or decline optional tracking with comparable ease and withdraw their choice through the Cookie settings control accessible on the site.

The site includes Google Tag / Site Kit integration. When optional technologies are enabled, information such as browser identifiers, visited pages and usage events may be processed by the relevant provider subject to its terms and GDPR requirements. Technical scripts can be present even when optional storage is denied; the site operator must routinely verify that no non-essential cookies or tracking are activated before a valid choice. For the confirmed Go2Grow choice cookie, its 180-day configured lifetime and the status of optional technologies, see our Cookie Policy. A complete third-party cookie inventory still requires a current browser-based technical audit.

7. Recipients, service providers and roles

Relevant data may be handled by authorised Go2Grow personnel and service providers supporting website hosting and backups, WordPress infrastructure, transactional email, forms, anti-spam and security, and analytics or AI only where actually used and legally authorised. Where relevant, independent programme organisers may receive the limited participant details needed to progress a specific enquiry or deliver a subsequently confirmed course. Go2Grow requires appropriate processor safeguards under GDPR Article 28 when a supplier acts on its instructions. Some recipients, such as separately contracting course organisers, may act as independent controllers rather than Go2Grow processors.

The active website uses WordPress, Hostinger services, a mail delivery service and Google site-management technology. This list describes categories, not a verified exhaustive register of all processors or Google products; the operator must maintain a current subprocessor and transfer inventory.

8. International data transfers

Some infrastructure, analytics or AI technology providers may access personal data outside the European Economic Area. If a restricted international transfer takes place, Go2Grow must rely on an appropriate GDPR Chapter V mechanism, such as an adequacy decision or valid Standard Contractual Clauses, with additional safeguards where required. You may ask info@go2grow.eu for information about applicable safeguards. A specific list of destination countries or transfer mechanisms must be checked against current supplier contracts before any categorical statement is made.

9. Retention and deletion

Go2Grow follows purpose-based retention: enquiries are kept while their handling, communications and any related complaint or legal claim reasonably require them; optional invoicing and financial records, if generated, are kept for applicable applicable statutory accounting and tax retention periods; provider submission records remain while an opportunity is maintained and until reasonable expiry of related legal or operational needs; security and technical logs are retained for limited security and abuse-prevention purposes; consent choices remain until their configured expiration or withdrawal; and backups are cycled according to the platform backup schedule.

Exact retention periods must be determined in the operator’s internal retention register and relevant technical settings. This notice does not invent specific deletion periods that have not been verified. Data is deleted or anonymised when no longer needed unless applicable law requires longer preservation.

10. AI assistant and automated features

Where the optional AI assistant is enabled, a visitor’s prompts and relevant site content may be transmitted to the configured AI provider solely to generate the requested answer, subject to its service terms and data-protection arrangements. Do not enter sensitive personal information, passwords or financial account details into an AI prompt. Go2Grow’s AI and template-based Mobility Planner are informational tools: they do not decide Erasmus+ eligibility, create a contract, approve a grant or give authoritative legal advice.

Save / Compare features and exported Mobility Plans may use browser-side processing; whether any particular interaction is transmitted or stored must be determined by the active technical implementation. Go2Grow should not describe chat histories or IP records as universally unlogged unless its current configuration and all suppliers have been verified.

11. Security and access controls

Go2Grow uses administrative access restrictions, HTTPS, submission validation, anti-spam controls, private provider management links and backups to protect the platform. Public account creation has been disabled, although restricted administrative WordPress accounts may exist. Private editing URLs are access credentials and should be kept confidential. No security measure guarantees absolute protection; personal-data breaches are assessed and notified to regulators and affected persons where GDPR Articles 33 and 34 require it.

12. Your rights and supervisory authority

Subject to legal conditions, you may ask to access or correct your personal data, request erasure or restriction, object to processing based on legitimate interests, obtain portable information where applicable and withdraw a consent without affecting lawful processing carried out beforehand. You can request these rights at info@go2grow.eu or through the contact page. We will normally respond within one month, subject to lawful extensions or verification of identity. You may complain to the a competent EEA data protection supervisory authority.

13. Personal data from public sources

Where a provider’s publicly published training information is independently summarised, Go2Grow aims to minimise identifiable individuals’ data, record the source when relevant and assess GDPR Article 14 notice obligations and exceptions. Public availability alone is not a free-standing legal basis to reuse a person’s private contact information for unrelated purposes. Requests about sourced content can be sent to info@go2grow.eu.

14. External websites and booking channels

Go2Grow may link to independent official Erasmus+ resources, destination guides or verified providers as background sources, but current participant enquiries are submitted through Go2Grow. A linked external site has its own controller, notice and terms. Following an outside link does not mean that Go2Grow has automatically shared the visitor’s enquiry or payment information with that party.

15. Children

Go2Grow is aimed at adult staff, educators and professional development participants, not children. If a child submits data without an appropriate lawful basis, please contact info@go2grow.eu so it can be reviewed and deleted where appropriate.

16. Updates to this notice

Go2Grow will update this notice when its functionality, actual data flows, subprocessors or applicable law change. The date at the top identifies the current version. Changes do not remove statutory data subject rights. Any further mandatory controller identification, retention and processor disclosures remain subject to verification.