Public privacy notice

Privacy and learning data

This notice explains how Landfield handles personal data across its public website and invite-only corporate language programmes.

Effective 15 September 2026

Operator and privacy contact

Landfield is operated by Sandor Kohan, trading as Landfield in the Netherlands. Sandor Kohan is the controller for the processing purposes Landfield determines itself, as explained below.

For privacy questions or rights requests, contact kohansandor@landfield.eu.

Landfield and your company

For a company programme, the company determines why its employees participate and which programme administration and reporting are needed. Where Landfield processes personal data on the company’s instructions to deliver that programme, Landfield acts as a processor and the company acts as controller. The applicable agreement defines these responsibilities.

Landfield acts as controller for its own business contacts, demo enquiries, website operations, account security, billing administration, and legal obligations where it determines those purposes. Direct relationships with tutors or other individuals can also involve Landfield acting as controller. A company contract is not, by itself, a contract with each employee.

For data processed on a company’s instructions, we coordinate rights requests with that company. You can contact your programme owner or Landfield; we will help identify who should respond.

Personal data we handle

The data depends on your role and the features you use. Learners and programme owners join through a company invitation and role-based access. We receive data from you, your company, your tutor, session activity, and the providers involved in the feature.

Account and company data: name, email address, password credential, profile image, sign-in information, role, permissions, company membership, programme contacts, time zone, and availability. Google sign-in can provide your name, email address, and profile image.
Learning data: job context, target language, level, goals, learning plans, tasks, writing submissions, feedback, skill indicators, and progress.
Session and communication data: scheduling, attendance, live audio/video, messages, tutor notes, support enquiries, and recordings or transcripts where the required consent applies.
Demo and commercial data: contact name, work email, company, role, team size, languages, programme needs, source page, referral/campaign information, billing status, and invoice records where relevant.
Device and website data: IP address, browser/device information, technical logs, language and consent preferences, and optional analytics page/action events only when analytics is configured and consented to.

Purposes and lawful bases

When Landfield acts as controller, the lawful basis depends on the purpose and circumstances. When we act as processor, we follow the company’s lawful instructions; the company is responsible for its own lawful basis and employee information.

Contract: account and service administration necessary to perform a contract with you, or to take steps you request before entering one, where you are a party to that contract.
Legitimate interests: handling business enquiries, coordinating company programmes, supporting users, and preventing misuse, where those interests are not overridden by your rights and interests.
Legal obligations: records and disclosures required by applicable tax, accounting, and other laws.
Consent: optional website analytics and recording, transcription, or AI processing where the applicable feature requires your consent. You may decline or withdraw that consent for future processing; withdrawal does not affect processing lawfully carried out beforehand.

What your company can see

Authorized HR and L&D programme owners can see participation, attendance, general progress, and agreed goals for the company programme.

Full recordings and transcripts, private tutor conversations, private messages and tutor notes, and itemized individual mistakes stay outside normal HR reporting. Learners, assigned tutors, and authorized support personnel may access relevant material to deliver and support the service, subject to role controls.

A company’s programme reporting is distinct from private lesson material. Any exceptional disclosure must have a lawful basis, appropriate authority, and a defined purpose.

Service providers and recipients

Providers receive data needed for the functions used, under the arrangements applicable to that service. They do not all receive every category of data. Some providers may also act as independent controllers for their own account, legal, or security purposes.

Amazon Web Services (AWS): hosting and infrastructure. Our core infrastructure is hosted in AWS Frankfurt, Germany.
LiveKit: live session audio/video and related session infrastructure.
Anthropic: AI support for preparation, summaries, and learning feedback; Deepgram: transcription; Microsoft Azure: speech and pronunciation assessment.
Twilio SendGrid: transactional and service email delivery.
Google: sign-in when selected, optional Google Analytics after consent, and bot protection where enabled on product account forms.
Stripe: payment processing when payments use Stripe; Landfield receives relevant billing/payment status rather than your full card number.
Authorized company programme owners and tutors: information within their programme and teaching roles. Authorities or professional advisers: information where lawfully required or needed to establish, exercise, or defend legal claims.

International transfers

Some processors may handle personal data outside the EU or EEA. AWS Frankfurt hosting does not mean every provider processes data exclusively there.

Where international transfers occur, the applicable legal transfer mechanism and safeguards must be used, such as an adequacy decision or appropriate contractual safeguards, including standard contractual clauses where relevant. The mechanism depends on the provider and processing. Contact kohansandor@landfield.eu for information about the safeguards applicable to your data.

Security safeguards

Passwords are stored as salted hashes. Two-factor authentication secrets are encrypted. HTTPS protects information in transit, and authentication and role controls limit platform access.

We apply technical and organizational safeguards appropriate to the service and review them as it changes. No online service can eliminate all security risk. Protect your credentials and report suspected unauthorized access to kohansandor@landfield.eu.

Retention and deletion

Retention depends on the data, programme duration, service purpose, company instructions where applicable, legal record-keeping duties, and the need to resolve disputes or protect the service. Different records can have different retention periods.

When data is no longer needed for an applicable purpose, it should be deleted or anonymized under the relevant process. Billing, tax, dispute, fraud-prevention, security, and backup records can have separate limits or retention requirements. The deletion guidance explains how to make a request and what may remain.

Your rights and complaints

Where applicable and subject to legal conditions, your rights include access, correction, deletion, restriction, objection, portability, and withdrawal of consent. These rights are not absolute; we may need to verify identity and assess the circumstances.

Contact kohansandor@landfield.eu to exercise a right. We respond without undue delay and generally within one month. Complex or numerous requests may require two further months; we will give notice and reasons within the first month.

Where applicable, you may lodge a complaint with a competent supervisory authority, including the Dutch Autoriteit Persoonsgegevens. You may also have rights to a judicial remedy. Contacting Landfield first is not a condition of making a complaint.

Cookies and website preferences

The cookies and browser storage notice describes local storage, session attribution, optional Google Analytics, and product-only storage. Use Cookie settings in the footer to reopen the analytics choice. Your saved choice remains in place until you explicitly accept or reject again.

Adult professional scope

Landfield is intended for adult professionals in company language programmes and authorized tutors and programme owners. It is not directed at children. Contact us if you believe a child’s personal data has been provided.

Updates and contact

We may update this notice as services, providers, or processing change. The effective date identifies the published version; material changes will be communicated where required. Contact kohansandor@landfield.eu with any privacy question.