1. Introduction

Global Mayors Academy ('GMA'), a proud part of the Living Cities Earth (LCE) ecosystem, is committed to responsible and transparent data practices. This Privacy Policy applies specifically to visitors to our public website at https://globalmayors.academy.

This website is built and hosted using Tilda, a website-building platform operated by Tilda Publishing (registered in the United Arab Emirates, with an EU representative — Tilda Publishing Ltd. — based in Dublin, Ireland).

This policy explains what data is collected when you visit our public website, how it is used, and your rights in relation to that data. This policy has been drafted in compliance with the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR) (Regulation (EU) 2016/679).

GMA acts as the Data Controller for data collected via the public website. Tilda acts as a Data Processor, processing visitor data on GMA's behalf under Tilda's Data Processing Agreement framework.

2. What Data We Collect

When you visit globalmayors.academy, the following usage data is collected automatically by Tilda as part of its website hosting and analytics operation:

• Device type (e.g., desktop, mobile, tablet).
• IP address.
• Browser type and version.
• Operating system.
• Country (derived from your IP address).
• Search engine used to reach the website (e.g., Google, Bing).
• Referral traffic source (i.e., the website or link you came from).
• Buttons clicked on the website.
• Pages viewed during your visit.
• Number of sessions (i.e., how many separate visits you have made).

This data is collected automatically. You do not need to fill in a form or create an account for this data to be collected. If you choose to contact GMA via a form on the website, any personal information you provide in that form (e.g., name, email) will be processed separately under GMA's main Privacy Policy for registered users and services (see below).

3. How We Use This Data

The usage data collected via the public website is used for the following purposes:

• Website Analytics: To understand how visitors interact with the GMA website, which pages are most visited, and how users navigate the site.
• Website Improvement: To identify areas for improvement in website design, content, and user experience.
• Marketing & Outreach: To inform GMA's marketing strategy and understand where traffic is coming from (e.g., search engines, social media, referral partners).
• Security & Platform Operation: To help detect and prevent fraudulent or malicious activity, and to ensure the website operates correctly.

4. Legal Basis for Processing

We process this data on the following legal bases under Article 6 of the GDPR:

• Legitimate Interests (Article 6(1)(f)): GMA has a legitimate interest in understanding how visitors use its public website and in improving the website experience. This interest is not overridden by your rights and freedoms, as the data collected is limited to non-identifiable usage metrics.
• Consent (Article 6(1)(a)): Where analytics cookies are used (see Section 7 below), your consent will be sought via a cookie consent banner on first visit.

5. Who Has Access to This Data

The usage data collected via the public website is processed and stored by:

• Tilda (Data Processor): Tilda hosts the GMA website and collects usage data as part of its platform operation. Tilda processes this data on GMA's behalf under its Data Processing Agreement framework. Tilda does not use end-user data for its own advertising or marketing purposes. Tilda's Privacy Policy is available at tilda.cc/privacy .
• GMA (Data Controller): GMA has access to aggregated and anonymised analytics reports generated by Tilda, which GMA uses to understand website performance and visitor behaviour.

We do not sell or share this data with any other third parties for marketing purposes.

6. Where Your Data Is Stored

Tilda's main servers are located in Germany and Finland (both EU Member States), operated via Hetzner. Website content is delivered globally through Cloudflare's CDN network. Because Tilda's primary data processing and storage infrastructure is located within the European Economic Area (EEA), the transfer of visitor usage data does not ordinarily require additional safeguards under GDPR Chapter V.

Tilda maintains an EU representative — Tilda Publishing Ltd., based in Dublin, Ireland — for GDPR compliance purposes.

7. Cookies

The GMA public website uses cookies to enable website analytics. Tilda places the following types of cookies:

• Essential Technical Cookies: These are essential for the website to function correctly and cannot be turned off.
• Performance and Analytics Cookies: These power Tilda's website statistics feature, which collects the usage data described in Section 2 above. Your consent is required before analytics cookies are placed. You will be presented with a cookie consent banner on your first visit to the website.

You can manage your cookie preferences at any time via the consent management tool. For more information on how cookies are used on the GMA website, please refer to our full Cookie Policy.

Tilda's own Cookie Policy is available at tilda.cc/cookie-policy .

8. Data Retention

Usage data collected by Tilda is retained for up to 3 years for analytics purposes, in accordance with Tilda's data retention policy. After this period, the data is deleted or anonymised.

If you submit a contact form or enquiry via the public website, the data you provide in that form (e.g., name, email) is retained separately under GMA's main data retention policies for registered users and prospective contacts (see GMA's Privacy Policy for CC360 Platform Services).

9. Your Rights

As a Data Subject, you have the following rights under Chapter III of the GDPR:

• Right of Access (Article 15): To request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): To request correction of inaccurate or incomplete data.
• Right to Erasure (Article 17): To request deletion of your personal data, where no legal basis for retention applies.
• Right to Restriction of Processing (Article 18): To request that we limit how we use your data in certain circumstances.
• Right to Object (Article 21): To object to the processing of your personal data, particularly where based on legitimate interests.

Because the data collected via the public website is largely anonymised and aggregated, it may not be possible to identify and retrieve data relating to a specific individual. However, if you have submitted a contact form or otherwise provided identifiable information, you may exercise these rights by contacting us at: contact@globalmayors.academy

We will respond to your request within 30 days, as required under Article 12(3) of the GDPR.

10. Complaints & Supervisory Authority

If you are located in the United Kingdom, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority, at: www.ico.org.uk

If you are located within the European Union, you may also lodge a complaint with the relevant supervisory authority in your EU Member State.

11. Changes to This Policy

GMA may update this Privacy Policy from time to time. Any changes will be posted on the public website, and we will notify users of material changes where appropriate. The date of the most recent revision is indicated at the top of this policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or GMA's data practices, please contact us at: contact@globalmayors.academy