Skip to main content
Agentic Universityv1.31.2
|

Privacy policy

Last updated: 2026-10-16

Privacy Policy

This privacy policy explains how personal data is processed on agentic-university.com.

1. Controller

Sentient Dynamics LTD Archiepiskopou Makariou III, 61, Serghides House, Office 1016 6017 Larnaca, Cyprus Email: [email protected]

Commercial Register (Republic of Cyprus): HE 477786 · VAT: CY 60199326H · Director: Florian Nagel.

You can reach us with any data-protection questions at the same email address.

2. Applicable Law

This policy is governed by the EU General Data Protection Regulation (2016/679) together with Cypriot data protection law. The supervisory authority at the controller's seat is the Office of the Commissioner for Personal Data Protection, Republic of Cyprus.

3. Purposes and Legal Bases

We process personal data to operate the website, handle inquiries, deliver courses, and improve our services.

  • Art. 6(1)(b) GDPR (contract and pre-contract measures)
  • Art. 6(1)(c) GDPR (legal obligations)
  • Art. 6(1)(f) GDPR (legitimate interest in a secure and usable platform)
  • Art. 6(1)(a) GDPR (consent, e.g. newsletter or optional tracking)

4. Processors

We use the following processors under Art. 28 GDPR:

  • Matomo (self-hosted), website analytics at analytics.sentient-dynamics.com. Runs on our server at Hetzner in Helsinki (Finland); Hetzner and Cloudflare process analytics data on our behalf. Cloudflare additionally processes certain network and security data as an independent controller under its privacy policy.
  • Rybbit (self-hosted), website analytics via t.sentient-dynamics.com. Runs on our server at Hetzner in Helsinki (Finland); Hetzner and Cloudflare process analytics data on our behalf. Cloudflare additionally processes certain network and security data as an independent controller under its privacy policy.
  • Hetzner Online GmbH (Gunzenhausen, Germany), hosting of our servers in the Helsinki data center park (Finland).
  • Cloudflare, Inc. (USA), content delivery network and attack protection. Requests to our websites and our analytics hosts pass through Cloudflare, which processes, among other things, your IP address. For transfers to the United States, Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, Cloudflare's data processing addendum includes standard contractual clauses.
  • Cal.com Cloud (EU), demo booking. DPA in place. EU hosting.
  • Resend, transactional and campaign email delivery. DPA in place.
  • OpenRouter / Google (Gemini), AI-assisted feedback on learner task responses. Data is forwarded only where explicitly enabled per course. Processing under each provider's DPA.

5. Cookies and Analytics

Matomo runs in cookieless mode on public pages, no analytics cookies are written to your device.

We also measure the use of our pages with Rybbit. Rybbit sets no cookies and stores nothing in your browser. The script also reads localStorage for an existing opt-out entry and an existing Rybbit user identifier. When a page loads, the Rybbit script reads your browser's screen size and language setting as well as technical browser signals (including window size, plugins and the browser's graphics card name), from which it calculates a score on your device to detect automated access; of these, the screen size, language setting, score and a bitmask indicating the detected signal categories are transmitted. To distinguish visits, Rybbit creates a shortened hash from your IP address, using its network range for datacenter and proxy addresses, and the version-normalized user agent, with a daily salt derived from a server secret and the UTC date; in addition, your full IP address is stored together with the analytics data so that we can analyse access more precisely and detect abusive and automated access, and is deleted automatically from the analytics data after 30 days. As long as the IP address is stored, visits on different days can be linked through it. To detect automated access, Rybbit also keeps the IP address in a temporary store for at most 48 hours. We do not combine the data with other data. We store the pages viewed including URL parameters such as utm_source (links to personal results without their identifier), the page title, the referring source, approximate location (country, region, city), network operator, browser, operating system, device type, screen size and language, as well as a booked demo with its duration, without names, email addresses or user accounts. We also store approximate IP-derived latitude and longitude, timezone, browser and operating-system versions, event timestamps, pseudonymous visitor and session identifiers, acquisition channels and, where applicable, bot-detection results including the score and signal mask. Clicks on external links also record the destination URL including any query parameters, link text and target window. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to measure reach and usage, to improve our offering and to detect abusive and automated access. In the active analytics database, other analytics data is deleted after 14 months and access recognised as bots after three months. Backup copies are deleted no later than 15 days after creation, so IP addresses can remain in backups for up to 15 days after their deletion from the active database. If your browser sends a Do Not Track or Global Privacy Control signal, or if your browser's local storage is blocked, we do not load Rybbit. You can also object to this processing under Art. 21 GDPR, for example by email to the address given above.

If cookie-based tracking is introduced in the future, a dedicated consent mechanism will be added first.

6. Downloads, Request Forms and Appointment Booking

When you request a document through a form on this website (for example the AI Act checklist, the KPI framework or the AI policy template), use the readiness check or the ROI calculator with your email address, request a quote or book an appointment, we process the details from the form: your email address and, where provided, name, company and role, as well as the language, the page through which you reached us and campaign parameters (UTM) from the link you used.

  • Delivery and handling: We send you the requested document or result and handle your request or appointment. Where it concerns an offer or a contract, the legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your request). To do so we store the request in our database so we can match it and recognise duplicate requests (Art. 6(1)(f) GDPR).
  • Origin of the request: We store the page through which you reached us and the campaign parameters (UTM) to understand which content leads to requests (Art. 6(1)(f) GDPR, legitimate interest in improving our offer).
  • Further contact: Beyond the requested service, we only contact you by email if you agreed in the form and confirmed that consent via the link in our email (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future, for example by email to the address in section 1. We keep a record of your consent (time and wording) to be able to demonstrate it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
  • Recipients: Emails are sent via Resend; appointment bookings run via Cal.com (see section 4).
  • Retention: see section 7. On request we delete your details unless a statutory retention obligation applies.

7. Retention

Personal data is retained only as long as needed for the purposes above or to satisfy statutory retention requirements.

8. Your Rights

You have the following rights under GDPR:

  • Access (Art. 15)
  • Rectification (Art. 16)
  • Erasure (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection (Art. 21)
  • Lodge a complaint with a supervisory authority (Art. 77), e.g. the Cypriot Data Protection Commissioner or the authority at your place of residence

9. Updates

This policy is updated whenever legal or technical requirements change.