Privacy Policy

Last updated: 15 October 2026

This privacy policy explains how NGO Training collects, uses, shares and protects personal data when you visit ngotraining.org, contact us, book a course, take part in a workshop, in-house training day or coaching session, or subscribe to our newsletter. If anything is unclear, please get in touch and we will be happy to explain.

We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, together with any other applicable data protection and privacy legislation.

1. Who we are: the data controller

The controller responsible for your personal data is:

One for All Services SPRL, trading as NGO Training
Email: [email protected]
Telephone: +32 2 403 49 83

Our full registered office address and company number are available on request at [email protected].

As a small training company, we are not legally required to appoint a Data Protection Officer. All questions about this privacy policy or about how we handle your personal data can be sent to the email address above, ideally with the subject line “Data protection”. You can also reach us through our contact page.

2. The legal bases we rely on

Under Article 6 of the GDPR, we may only process personal data when we have a valid legal basis. Depending on the situation, we rely on the following:

Performance of a contract (Article 6(1)(b)): to take steps at your request before entering into a contract (for example, answering a question about a course or preparing a quotation) and to perform the contract once you have booked (for example, registering participants, sending joining instructions, delivering training and coaching, and issuing invoices).
Legal obligation (Article 6(1)(c)): to comply with Belgian accounting, tax and VAT rules, which require us to keep invoices and related records, and to respond to lawful requests from public authorities.
Legitimate interests (Article 6(1)(f)): to run, secure and improve our website, to prevent fraud and abuse, to keep basic server and security logs, to manage our relationship with organisations that book training, to defend legal claims, and to send occasional service-related messages to existing customers. We only rely on legitimate interests after balancing them against your rights and reasonable expectations.
Consent (Article 6(1)(a)): to send you our newsletter and to place non-essential cookies (analytics, functional and marketing cookies) on your device. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.

We do not intentionally collect special categories of personal data (such as health information) as defined in Article 9 of the GDPR. The only exception is where you voluntarily tell us about an access requirement or dietary need so that we can accommodate you at a training session. In that case we use the information only for that purpose, with your explicit consent, and delete it after the session.

3. The personal data we collect

We collect only the personal data we genuinely need. The categories below describe what we collect and where it comes from.

3.1 Contact form and email enquiries

When you use the form on our contact page, send us an email or call us, we collect your name, email address, organisation, job title (if provided), telephone number (if provided) and the content of your message. If you ask about in-house training or coaching, we may also collect information about your team size, training needs and preferred dates.

3.2 Course bookings and orders (WooCommerce)

Bookings on our website are handled through WooCommerce, an e-commerce plugin for WordPress. When you book a course, an in-house training day or a coaching package through our online shop, we collect:

billing contact details: name, organisation, billing address, email address and telephone number;
VAT number of your organisation, where applicable;
participant details: the name, email address and job title of each person attending;
order details: the course or service booked, the date, the price, the payment method chosen and the status of the order;
any notes you add to your order, such as a purchase order number or an access requirement;
if you create a customer account, your username and an encrypted (hashed) password.

If you pay by card or through an online payment method, your payment details are entered directly with the payment provider. We do not see or store full card numbers. We receive only a confirmation of payment, a transaction reference and limited details such as the card type and last four digits. Many of our customers pay by bank transfer against invoice, in which case we receive the bank details shown on your transfer.

3.3 Training and coaching delivery

When you attend a workshop or coaching session, we may process your attendance record, any course evaluation form you complete, and notes a trainer takes during coaching to help you make progress. Coaching notes are treated as confidential and are not shared with your employer unless you agree.

3.4 Newsletter (only if you consent)

We send our newsletter only to people who have actively opted in, for example by ticking an unticked box on a form or by subscribing on our website. We collect your email address, your name if provided, the date and source of your consent, and basic information about whether you open our emails or click links in them. Every newsletter contains an unsubscribe link, and you can also unsubscribe by emailing us.

3.5 Cookies and analytics

Our website uses cookies and similar technologies. Strictly necessary cookies (for example, those that keep your shopping cart working) are placed automatically. All other cookies, including analytics cookies, are placed only if you accept them through our cookie banner, which is managed by CookieYes. Analytics data is used in aggregated form to understand how visitors use the site, which pages are popular and where we can improve. Full details are in our Cookie Policy. This policy does not cover external websites linked from ours; see our Disclaimer.

3.6 Server logs

Like almost every website, our web server automatically records technical information each time a page is requested: IP address, date and time of the request, the page or file requested, the referring page, the HTTP status code, and the browser and operating system (user agent). These logs are needed to deliver the website, diagnose technical problems and detect attacks.

3.7 Security plugin logs

We use a WordPress security plugin, such as Wordfence, to protect the website against malicious traffic, brute-force login attempts and known vulnerabilities. The plugin records IP addresses, requested URLs, user agents, login attempts (including the username entered), and whether a request was blocked. Where the plugin’s threat-intelligence features are active, limited data such as IP addresses of suspicious requests may be checked against, or shared with, the plugin provider’s security network. We rely on our legitimate interest in keeping the website and our customers’ data secure.

4. Why we use your personal data

The table below summarises our purposes and the legal basis for each.

Purpose	Data used	Legal basis
Answering enquiries and preparing quotations	Contact details, message content, training needs	Pre-contractual steps; legitimate interests
Processing bookings and registering participants	Billing and participant details, order details	Performance of a contract
Delivering open courses, in-house training and coaching	Participant details, attendance, coaching notes	Performance of a contract
Invoicing, payment and bookkeeping	Billing details, VAT number, payment records	Performance of a contract; legal obligation
Sending joining instructions and service messages	Name, email address, booking details	Performance of a contract
Collecting feedback to improve our courses	Evaluation responses	Legitimate interests
Sending our newsletter	Email address, name, consent record, engagement data	Consent
Website analytics	Cookie identifiers, pseudonymised usage data	Consent
Running and securing the website	Server logs, security logs, necessary cookies	Legitimate interests
Handling complaints and legal claims	Any relevant correspondence and records	Legitimate interests; legal obligation

We will not use your personal data for a new purpose that is incompatible with the purpose for which it was collected. If we wish to do so, we will inform you beforehand and, where required, ask for your consent.

5. How long we keep your data

We keep personal data only for as long as necessary for the purposes described above, or as long as the law requires. When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you.

Category of data	Retention period
Contact form submissions and enquiries that do not lead to a booking	Up to 24 months after our last exchange
Booking and order records (non-accounting data)	Up to 5 years after the training or service is delivered, to manage the customer relationship and potential claims
Invoices and accounting records	10 years from the end of the financial year, as required by Belgian accounting and tax rules
Participant attendance records	Up to 5 years after the training, so that we can confirm attendance if asked
Course evaluation forms	Up to 3 years; aggregated, anonymised results may be kept longer
Coaching notes	Up to 12 months after the last session, unless you ask us to delete them sooner
Customer account (WooCommerce)	Until you ask us to delete it, or after 3 years of inactivity
Newsletter subscription data	Until you unsubscribe; proof of consent is kept for up to 3 years after you unsubscribe
Access or dietary requirements	Deleted after the relevant session
Web server logs	Up to 90 days
Security plugin logs	Up to 90 days, unless needed to investigate a specific incident
Cookies	See the durations listed in our Cookie Policy

If data is needed to establish, exercise or defend a legal claim, we may keep it until the matter is finally resolved.

6. Who receives your data

We do not sell, rent or trade your personal data. We share it only with the recipients listed below, and only to the extent necessary.

6.1 Service providers (processors)

We use carefully selected service providers who process personal data on our behalf, under written data processing agreements that meet the requirements of Article 28 of the GDPR. These include:

Web hosting provider: hosts our website, database and server logs.
Payment providers: process card and online payments made through our shop. For certain payment services, the provider may act as an independent controller under its own privacy policy, in particular for fraud prevention and its own legal obligations.
Email services: our business email provider, the transactional email service used to send order confirmations, and our newsletter platform.
Cookie consent management: CookieYes, which records your cookie choices.
Analytics provider: only where you have consented to analytics cookies.
Security services: the provider of our website security plugin, such as Wordfence.
Accounting and bookkeeping: our accounting software provider and our external accountant, who are bound by professional confidentiality.
Video-conferencing tools: where coaching or training takes place online.

An up-to-date list of the specific providers we use is available on request at [email protected].

6.2 Other recipients

Trainers: trainers delivering a course or coaching session receive the names, organisations and job titles of participants so they can prepare and adapt their sessions. Trainers are bound by confidentiality.
Training venues: where necessary, we may share participant names with the venue hosting an open course for access and security purposes.
Your organisation: if your employer booked and paid for your place, we may confirm your attendance to the booking contact.
Professional advisers: our lawyers, auditors and insurers, where necessary.
Public authorities: tax authorities, courts or police, where we are legally required to disclose information.

7. International data transfers

We aim to store and process personal data within the European Economic Area (EEA). However, some of our service providers, or their sub-processors, may be located outside the EEA, for example in the United States, or may access data from outside the EEA for support purposes.

Where personal data is transferred outside the EEA, we ensure that it remains protected in line with Chapter V of the GDPR by relying on one of the following safeguards:

an adequacy decision of the European Commission, such as the decision covering organisations certified under the EU-US Data Privacy Framework;
Standard Contractual Clauses (SCCs) adopted by the European Commission, together with any supplementary measures needed after a transfer impact assessment, such as encryption;
in exceptional cases, one of the specific derogations in Article 49 of the GDPR, such as where the transfer is necessary to perform a contract with you.

You may request more information about the safeguards we use, or a copy of the relevant clauses, by writing to [email protected].

You have the following rights regarding your personal data. They are not absolute and may be subject to conditions or exceptions set out in the law, which we will explain if they apply.

Right of access (Article 15): to obtain confirmation of whether we process your personal data and, if so, a copy of it together with information about how it is processed.
Right to rectification (Article 16): to have inaccurate data corrected and incomplete data completed.
Right to erasure (Article 17): to have your data deleted, for example where it is no longer needed or where you withdraw consent. We may have to keep certain data, such as invoices, to comply with a legal obligation.
Right to restriction of processing (Article 18): to ask us to limit how we use your data, for example while we check its accuracy.
Right to data portability (Article 20): to receive data you provided to us, which we process by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format, and to have it sent to another controller where technically feasible.
Right to object (Article 21): to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation. You have an absolute right to object to direct marketing.
Right to withdraw consent (Article 7(3)): where we rely on consent, you may withdraw it at any time, for example by unsubscribing from our newsletter or changing your preferences in the cookie banner.

8.1 How to exercise your rights

Send your request to [email protected] or call us on +32 2 403 49 83. To protect your data, we may ask you to confirm your identity before acting on a request, but we will only ask for information that is necessary for that purpose.

We will respond without undue delay and in any case within one month of receiving your request. Where a request is complex, or we receive several requests, we may extend this period by up to two further months; we will tell you within the first month if this is the case. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

9. How to complain to the Belgian Data Protection Authority

We would always appreciate the chance to address your concerns first, so please contact us if you are unhappy with how we have handled your personal data. However, you have the right to lodge a complaint with a supervisory authority at any time.

In Belgium, the supervisory authority is the Data Protection Authority, known in French as the Autorité de protection des données (APD) and in Dutch as the Gegevensbeschermingsautoriteit (GBA). It is based in Brussels and accepts complaints in writing, including through its website. Its current contact details and complaint form can be found by searching for its name online.

If you live or work in another EU or EEA country, or if the alleged infringement took place there, you may also complain to the supervisory authority in that country.

10. Children

Our website and training services are intended for adults working in, or seeking to work in, the non-profit and international sector. We do not knowingly collect personal data from children under the age of 16. If you believe that a child has provided us with personal data, please contact us and we will delete it promptly.

11. How we protect your data

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are proportionate to the size of our organisation and the nature of the data we process, and include:

encryption of data in transit using HTTPS (TLS) across the whole website;
regular updates of WordPress, WooCommerce, our theme and plugins to fix known vulnerabilities;
a web application firewall and malware scanning provided by our security plugin;
limits on failed login attempts and strong password requirements for administrator accounts, with two-factor authentication where available;
access to personal data restricted to people who need it for their role, who are bound by confidentiality;
regular, secured back-ups of the website and database;
data processing agreements with all processors;
secure handling and disposal of any printed participant lists used at training venues.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority within 72 hours where required and, if the risk is high, we will inform you without undue delay.

12. Automated decision-making and artificial intelligence

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR. Every decision about bookings, quotations, refunds or access to our services is made by a person.

We do not use your personal data to train artificial intelligence models. If we use software tools with AI-assisted features in our day-to-day work, such as spelling or drafting aids, we do not enter participants’ personal data into them unless the tool is covered by an appropriate data processing agreement and we have assessed that its use is necessary and proportionate.

13. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our services, the tools we use or the law. The date at the top of this page shows when it was last revised. If we make significant changes, such as using your data for a new purpose, we will notify you by email where we have your address, or by a clear notice on our website, before the change takes effect.

14. Contact us

For any question about this privacy policy or your personal data, please contact:

One for All Services SPRL (NGO Training), Brussels, Belgium
Email: [email protected] (subject: “Data protection”)
Telephone: +32 2 403 49 83

Our registered office address, [registered office address], and company number, [company number], are available on request at [email protected].