1. Who the controller is
The controller of your personal data is [full company name], [registered address], VAT ID [NIP]. For data matters write to [e-mail address] or use the contact form.
[If a data protection officer has been appointed, give their contact details. A sole trader usually does not need one.]
2. What we collect and why
| What we collect | Why |
|---|---|
| Name, e-mail address, password (hashed) | Running your account and giving you what you bought |
| Invoice details: name, VAT ID, address | Issuing a sales document — only if you provide them |
| Order and payment history | Fulfilling orders, handling complaints, tax obligations |
| Course progress, notes, certificates | Running the player and issuing certificates |
| Phone number | Contact about your order; with a separate consent, also text messages about new materials and offers |
| E-mail address given for the newsletter | Sending the newsletter — only with your consent |
| Messages sent through the contact form | Answering your question and handling the case |
| IP address, browser details, server logs | Security of the service and detecting abuse |
We do not make decisions about you based solely on automated processing, including profiling, that would have legal effects.
3. Legal grounds
- Performance of a contract (Art. 6(1)(b) GDPR) — account, sales, access to materials.
- Legal obligation (Art. 6(1)(c) GDPR) — sales documents and tax records.
- Consent (Art. 6(1)(a) GDPR) — newsletter and marketing text messages. Each channel has its own consent and either can be withdrawn at any time, without losing access to what you bought.
- Legitimate interest (Art. 6(1)(f) GDPR) — security of the service, pursuing and defending claims.
Providing data is voluntary, but without an e-mail address and password there is no account, and without an account no purchase.
4. How long we keep it
- Account data — for as long as the account exists. After deletion we erase or anonymise it.
- Sales documents — 5 years from the end of the tax year in which the tax became payable. Deleting the account does not shorten this.
- Data needed to defend claims — until the limitation period expires.
- Newsletter sign-up — until consent is withdrawn.
- Server logs — [number] days.
5. Who we share it with
We do not sell data. We share it only with providers the service could not run without:
- Server provider — OVH (hosting, servers in the European Union).
- Payment provider — [name], for handling transactions. We never receive your card details.
- E-mail provider — [name], for system messages and the newsletter.
- Video hosting — [name], for playing recordings.
- Accounting and invoicing — [name].
- Google Fonts — typefaces are loaded from Google servers, which involves sharing your IP address.
[If any provider processes data outside the European Economic Area, name it and state the transfer basis — standard contractual clauses or an adequacy decision.]
6. Your rights
You have the right to:
- access your data and receive a copy,
- have inaccurate data corrected,
- have your data erased,
- restrict processing,
- port your data to another controller,
- object to processing based on legitimate interest,
- withdraw consent at any time — without affecting the lawfulness of processing before withdrawal.
Most of this you can do yourself in your account settings: change details, withdraw consent or delete the account. For anything else write to [e-mail address].
You may also lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
7. Cookies
We use cookies and browser storage only as far as the service needs to work:
- Session cookie — keeps you signed in. The account cannot work without it.
- Browser storage — holds your cart and small view preferences. It stays on your device and never reaches the server.
- Referral cookie — remembers which landing page you arrived from, so a purchase can be attributed to a campaign.
We use no advertising or third-party analytics cookies. That is why there is no consent banner — cookies strictly necessary for the service do not require one. Should analytics or advertising pixels be added later, this page and a consent banner will follow.
8. Security
The connection is encrypted (HTTPS). Passwords are stored only as hashes — we do not know your password and cannot read it. Purchased materials are released only after checking that the account has access to them. The database is backed up daily.
9. Changes
We will announce material changes by e-mail or in the service. The date it took effect is shown at the top of this document.
The terms of sale are described in the terms and conditions.