Privacy Notice
Last updated: 9 October 2026
This notice explains what personal data Co-op Business School (cbs.coop and its subdomains, the "Platform") processes, why, who we share it with and what rights you have.
1. Controller
The controller of your data is National Cooperative Business Association CLUSA International ("NCBA CLUSA"), 1775 I Street NW, 8th Floor, Washington, DC 20006, USA.
- Email for any privacy question or request: info@cbs.coop
- NCBA CLUSA has not appointed a representative in the European Union. If you live in the EU, you can write to us at info@cbs.coop.
2. What data we process
Account. Email address, first and last name, your sign-in method (email code, Google or Microsoft) and the date of your last sign-in. We do not store passwords.
Profile. What you give us when you complete your profile or details: age, gender, country, phone and, if you choose, organization, job title, bio, photo and social media links.
Course applications. Name, age, gender, email, WhatsApp and details about your organization or cooperative (type, name, role, activity, product, state and city). For some programs we also ask for academic details (student ID number, campus, degree, semester, academic level), and you may upload a copy of your identity document and a proof of enrollment (PNG, JPEG or PDF).
Learning. Enrollments, progress, submitted activities and assignments, grades, certificates (name, course, date and how many times the link was opened), event registrations and favorites.
Forums. Your threads and posts, their edited versions, the reports you make and the log of moderation actions on your content.
Contact forms. The details and message you send.
Usage and technical data. Pages visited, clicks and usage events, device and browser type, approximate location derived from your IP address, referring page and campaign parameters. Whether analytics cookies run before you choose depends on your country, and session recordings run only if you allow them (section 5). When you are signed in, our product analytics tool links usage to an internal identifier, not to your email or name.
Errors. When something fails, we record technical data about the error. We configure this service not to send personal data by default.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and keep your account, give you access to courses, workshops and events, issue and verify certificates | Performance of a contract (the Terms) |
| Assess course applications | Contract, or steps taken at your request before a contract |
| Process your identity document when a program requires it | Your consent, given when you upload it |
| Publish and moderate the forums, handle reports, keep the moderation log | Contract and our legitimate interest in a safe space |
| Send you service emails (sign-in codes, confirmations, certificates) | Performance of a contract |
| Analytics cookies to understand and improve the Platform (PostHog, Google Analytics) | Your consent where the law requires it; elsewhere our legitimate interest, with the right to refuse in Cookie settings (section 5) |
| Session recordings and heatmaps (PostHog) | Your consent, in every country (section 5) |
| Marketing tracking on our pages and sending your sign-in details to HubSpot | Your consent where the law requires it; elsewhere our legitimate interest, with the right to refuse in Cookie settings (section 5) |
| Learning-activity records that our servers send to PostHog when you are signed in, for program reports to our funders | Legitimate interest |
| Contact records of participants and partners in our CRM (HubSpot) | Legitimate interest in following up on our programs |
| Security, abuse prevention and error monitoring | Legitimate interest |
| Meet legal obligations and obligations to our funders | Legal obligation or legitimate interest |
You can object to any processing based on legitimate interest (section 8). We do not sell your data. We do not use your data for personalized advertising, and we do not make automated decisions with legal effects about you.
4. Who we share it with
We share data only with service providers that work on our behalf and with the people who need to see it:
- Web hosting: Vercel (USA).
- Database, sign-in and file storage: Supabase (United States, AWS us-east-1).
- Third-party sign-in: Google and Microsoft, only if you choose that method.
- Email: Resend.
- Analytics: PostHog (US cloud) and Google Analytics 4 (Google).
- CRM and marketing tracking: HubSpot. When marketing cookies are on (section 5), we send HubSpot your email, first name, last name and sign-in method when you sign in.
- Error monitoring: Sentry.
- Course videos and presentations: YouTube (privacy-enhanced player), Vimeo, Google Slides and Canva, when a page shows them.
- Other people: what you post in an open forum is public and search engines may index it. Anyone with a certificate's link can see that certificate. The CBS team and the course staff can see your application and your progress in that course.
- Authorities: when the law requires it.
5. Cookies and analytics
We use cookies and similar technologies, such as browser storage, in four groups: necessary, analytics, marketing and session recordings. Necessary cookies are always on. Whether analytics and marketing are on before you choose depends on where you are. Session recordings are on only if you allow them.
Where you are. We estimate your country from your IP address; with a VPN, the VPN's country applies. If you are in the United States, its territories (Puerto Rico, Guam, the U.S. Virgin Islands, American Samoa, the Northern Mariana Islands and the U.S. Minor Outlying Islands) or Guatemala, analytics and marketing are on until you turn them off. In every other country, or if we cannot tell where you are, they stay off until you accept them.
Necessary. These keep you signed in, remember your language, your cookie choice (the cbs_consent cookie, 12 months) and the result of the country check (the cbs_region cookie, until you close the browser), save your learning progress, protect the Platform and report errors (Sentry, without session recordings). They do not need your consent.
Analytics. PostHog and Google Analytics 4 measure the pages you visit, your clicks, how far you scroll, page speed, errors and other usage events. PostHog receives your full IP address. When you are signed in, PostHog links this data to an internal identifier, not to your email or name. Google Signals and ad personalization are off.
Marketing. The HubSpot tracking code links your visits to a HubSpot contact. When you sign in, we send HubSpot your email, first name, last name and sign-in method. HubSpot can also record the forms you send on our pages and show a chat.
Session recordings, only if you allow "Session recordings". PostHog records sessions (clicks, scrolls, mouse movement, page changes and browser console messages) and heatmaps of where people click. This is never on by default, in any country.
What runs without cookies. When you are signed in, our servers send records of your learning activity (for example, a module you started or a forum reply) to PostHog with your internal account identifier. No cookie is involved. We use these records for program reports to our funders (legitimate interest). We also count some public actions with no identifier and with nothing stored on your device. Contact records that you give us stay in HubSpot (legitimate interest). Turning off cookies does not delete a contact and does not unsubscribe you from emails. For that, write to info@cbs.coop.
How to change your choice. Use "Cookie settings" in the footer of our public pages, in the Co-op Curious menu or below. Turning something off is as easy as turning it on. When you turn off analytics or marketing, we delete their cookies and reload the page. A saved choice lasts 12 months. If you turned something on while you were in one of the countries above, that choice does not count in other countries: there we ask you again. If your browser sends Global Privacy Control and you have not saved a choice, we treat it as a refusal.
Videos and presentations. YouTube videos use the privacy-enhanced player (youtube-nocookie.com). Workshops can show presentations from Google Slides or Canva, which load from those services.
6. International transfers
NCBA CLUSA is in the United States, and we process your data in the United States. If you live in the European Union or the European Economic Area, these transfers rely on the providers' Standard Contractual Clauses or, where the provider is certified, on the EU-U.S. Data Privacy Framework.
7. How long we keep it
- Account, profile, progress and certificates: while your account is active and for as long as needed to keep your certificates and meet legal obligations.
- Deletion on request: if you write to info@cbs.coop, we delete your data, except data that a legal obligation requires us to keep.
- Application documents: only as long as needed to process the application and meet its legal and audit requirements.
- Forums: your posts stay published until you ask us to remove them or staff remove them. We keep reports and the moderation log to protect the community.
- Analytics: according to each provider's retention settings.
8. Your rights
Depending on the law of your country, you can:
- access your data and get a copy;
- correct inaccurate data (you can change your name in your account);
- erase your data, including your forum posts;
- object to processing based on legitimate interest, including analytics and marketing where they are on by default and the learning-activity records (section 5);
- restrict processing;
- portability: receive your data in a commonly used format;
- withdraw your consent at any time, including your cookie choice (section 5), without affecting what was done before.
How to exercise them: write to info@cbs.coop from your account's email address. We may ask you to confirm your identity. We reply within one month (45 days for California residents), which may be extended where the law allows.
Complaints: you can complain to the data protection authority of your country (in the EU, the authority where you live; in Peru, the Autoridad Nacional de Protección de Datos Personales).
9. US residents (including California)
In the last 12 months we collected these categories: identifiers (name, email, phone, internal identifier, IP address); personal records; protected characteristics (age, gender); internet activity (use of the Platform); approximate geolocation; professional and education information; and, when a program asks for it, a government identity document (sensitive data), which we use only to assess your application. We get them from you and from your browser. The purposes and recipients are in sections 3 and 4.
If you are in the United States, analytics and marketing are on by default. You can turn them off in "Cookie settings" (section 5), and if you have not saved a choice, we treat Global Privacy Control as a request to opt out. Session recordings are on only if you allow them.
We do not sell your personal information or "share" it for cross-context behavioral advertising. You can ask to know, access, correct and delete your data (section 8), and you will not be treated differently for doing so. An authorized agent can make the request for you.
10. Children
The Platform is not for people under 16, and we do not allow accounts for people under 16. If you think someone under 16 gave us data, write to info@cbs.coop and we will delete it.
11. Security
We use encrypted connections, role-based access and action logs. No system is fully secure; if an incident affects you, we will tell you as the law requires.
12. Changes
We will publish any change on this page with its date. If a change is important, we will tell you on the Platform or by email.