Privacy and cookies

SayPeter SARL-S, société à responsabilité limitée simplifiée
Registered office: 9, rue Raymond Poincaré, L-2342 Luxembourg
RCS B313377 Luxembourg
hello@primarysource.lu

The controller is SayPeter SARL-S, which publishes this site as Primary Source and is the seller named in the terms of sale. Anything on this page, including a request to delete what is held about you, is asked for through the contact page.

Career self-assessment answers are stored without a name, and an email address is stored against them only if you type one in.

We keep your test result, language, score, written answer and areas to work on with your email address. The optional email offers box records your preference, the wording version and the time. After a free test, an account or a started purchase, we send a few emails about the courses. Every email has a one-click unsubscribe. A purchase ends the follow-up. You can also ask for removal through the contact page.

An account holder is recorded by name. That is the reason the name is asked for: progress, assessment results and certificates of completion are issued against a name, and that is what makes them usable as evidence of training. A certificate carries that name, the module or the course, the date, the content version and the runtime.

Training records and certificates stay on the account after an access period ends. Your name is never sent to Meta and never sold, shared with an employer or shared with a recruiter. To have your data removed, write through the contact page.

While a lesson, reading or assessment page is open in front of you, this platform records how long it is open, in one-minute beats, and adds it up as your time on the programme. It is recorded because an employer claiming the Luxembourg state co-financing of training has to be able to state the hours of training each participant received, and because that figure cannot be reconstructed afterwards. Any single gap counts as at most two minutes, so a page left open overnight adds two minutes rather than a night. It is not advertising measurement, it is not shared with anyone outside your organisation, and it is not affected by the cookie banner.

It is recorded for everyone with an account, and it is not affected by the cookie banner, because it is not advertising measurement: it is part of delivering the training and, where an organisation bought your seat, part of what that organisation has to be able to document. It is never sent to Meta and it is never sold or shared with a recruiter.

If your seat was paid for by an organisation, its administrators can see your name and email address, which lessons you have opened and on which dates, your total time on the programme per course, your assessment scores including attempts you did not pass, and your certificates. That is what allows the organisation to document its training programme, which article 46(2) of CSSF Regulation 12-02 requires of it, and to state the hours each participant received if it claims the Luxembourg state co-financing of training.

Two limits are deliberate. Time is shown to your organisation as a total per course, not lesson by lesson: the claim needs the total, and the rest is more than an employer needs to hold. And an organisation only ever sees the period during which you actually held one of its seats, so anything you studied on your own account before you joined it, or after you left, is not on its record.

Your certificates are issued to you. They stay on your account permanently, including after a seat is released, after a licence ends and after you leave the organisation.

A banner appears on your first visit with two buttons of the same size: Accept all and Only necessary. Nothing is preselected and neither answer is made harder to give than the other.

Until you answer, this site treats you as having refused. No advertising pixel is loaded, no advertising cookie is set, and nothing is sent to Meta. Refusing keeps it that way.

Your answer is kept in one cookie named ps_consent, which holds the single word granted or denied and lasts 12 months. To change it, use Cookie choices in the footer of any page. It reopens the same banner with the same two buttons, so withdrawing agreement takes the same one click as giving it. Withdrawing also deletes the Meta cookies and this site's own visit and campaign cookies from your browser straight away.

Three things, and only because the site cannot do its job without them.

• ps_consent, the cookie above. It remembers your answer, which is the only way the site can honour it without asking again on every page. It lasts 12 months.
• lcm_session, a sign-in session cookie. It is set only when you sign in, it is what keeps you signed in, and it lasts thirty days. Signing out deletes it.
• ps_lang, the language cookie. It is set only when you open an address that names a language, which is what the FR and EN selector in the header does. It holds fr or en and lasts 12 months. Without it the site uses the language of your browser.

The self-assessment on the home page stores one identifier in your browser's local storage, lcm_sid, written the first time you answer a question rather than when the page opens. It is a random string that holds your answers together across the steps and lets you come back to them later. If you only read the page, nothing is stored. Assessment answers are held without a name, and an email address is held against them only if you type one in.

The server also counts how many times a course page was opened, the free lesson was started and the checkout was opened. Without your agreement that count carries the step, the course and the address of the page, and nothing else: no cookie is written or read to produce it, no identifier of any kind is attached, no campaign is recorded, and it is not joined to your account or used for advertising. It is stored separately from the measured figures so that the two are never added together.

Counted the same way, and for the same reason: how many times the banner above put the question, and which of the two answers it was given. That pair is how this site knows what its advertising figures mean. It carries the address of the page and the word granted or denied, nothing more, and a refusal is counted exactly as a refusal and used for nothing else.

All of the following, and none of it happens if you refuse or have not yet answered.

• The Meta pixel. A local consent stub starts in revoked mode. The Meta script is downloaded and events are sent only after you accept.
• Meta's own cookies, _fbp and _fbc. They are set by that tag, they identify your browser to Meta, and _fbc carries the identifier of the advertisement you clicked if there was one.
• The events sent to Meta from this site's server, described below.
• ps_v, this site's own visitor identifier. A random string with nothing in it, so that several pages opened in one visit are counted as one visit rather than as several people. It lasts 12 months. It exists for measurement rather than because a page needs it, so it waits for your agreement like everything else here.
• ps_a, the first and most recent measured visit. It stores the landing path, referrer host, UTM values, gclid, fbclid, gbraid and time. The first visit stays in place when later visits arrive; the latest visit is updated. It lasts 12 months, like ps_v.

Once you accept, this site keeps the first landing path, referrer host, campaign parameters and time with its visitor identifier. If you accept on the first page, that page is the first touch. If you accept later, the page where you accept is the first measured touch. The latest measured page is kept separately.

When you leave an email address, the lead record receives a copy of that first touch. At checkout, the order receives a copy and Stripe Checkout receives the landing path, referrer host, source, medium, campaign, gclid, fbclid and gbraid as session metadata. Without agreement, those fields are absent from leads and orders. Withdrawing clears them from open orders and your active assessment lead.

Checkout and confirmed purchase events are reported by the browser pixel and the server with matching identifiers, so Meta can count one event rather than two. Page views granted on the current page or during browser navigation are reported by the browser.

The events are: opening any page, opening a course page, starting the free lesson, creating a payment session, and completing a confirmed purchase. A course event carries the course and its price; a purchase event carries the amount, the currency and the order reference.

When available, events carry: the address of the page, your IP address, your browser's user agent string, the Meta cookies described above, and, if you are signed in, your email address and the ps_v identifier, both converted to a fingerprint with SHA-256 first. Your email address is never sent to Meta in a readable form and neither is your name. With consent, browser matching fields are saved with your order for the confirmed payment event; withdrawing before payment clears them.

Not sent to Meta, ever: your name, your assessment answers, your progress, your assessment results, your certificates, or anything you write on the contact form. The addresses of pages that carry a secret in the address itself, such as a password reset link, an invitation or a shared result, are never reported at all.

What Meta does with what it receives is governed by Meta's own terms rather than by this page. The purpose here is one thing only: to know which advertisements lead to a purchase.

Cookie choices in the footer of any page reopens the banner and shows which answer is in force. Choosing Only necessary stops the pixel loading on every page from that moment, deletes _fbp, _fbc, ps_v and ps_a, and stops anything further being sent to Meta about you.

Blocking third-party scripts may block the browser pixel; it does not withdraw consent to server-side measurement. Use Cookie choices to withdraw. The site works normally either way: nothing on it is behind the pixel, and no page or purchase depends on it.

The advertising preferences held by Meta about you are changed inside your own Meta account rather than here.

To ask for an email address to be removed from the records held by this site, write through the contact page. Section 7 of the terms of sale says the same thing about your account.