This Privacy Policy explains how [Company Name/Organizer’s Name] (hereinafter: "Administrator") collects, uses, and protects personal data of Users related to the purchase and participation in the online course provided through the Easytools platform (hereinafter: "Course"). The Administrator is committed to protecting Users' privacy and ensuring that personal data is processed in compliance with applicable laws, including the General Data Protection Regulation (GDPR).
Data Controller
The data controller of personal data of Users (those who have purchased or participate in the Course) is Krystian Kmieć with its registered office at Łódź, Milionowa 6a, Poland,, email address: krystian@designsystems.online. The Administrator is responsible for ensuring data protection and fulfilling the rights of the individuals whose data is processed.
Types of Data Collected
Contact information: name and surname (or nickname) and email address of the User – collected during account registration on the Platform or when placing an order for the Course. This information is necessary to create the User’s account, process the order, and communicate about the Course (e.g., sending purchase confirmations, providing access to modules).
Payment data: information necessary to process the payment for the Course (e.g., selected payment methods, billing address, and possibly company name for invoicing purposes). Financial data, such as credit card numbers or bank login details, are not disclosed to us – payment processing is handled by the external payment provider integrated with the Platform. We receive only the information necessary to confirm the transaction (e.g., transaction status).
Technical data (logs): while using the Course on the Platform, certain technical data may be automatically collected, such as the User's IP address, browser type, language preference, date and time of access, cookies, etc. This data may be collected by the Easytools platform for technical, statistical, and security purposes (e.g., to ensure the proper functioning of the service and to prevent misuse). This information is generally not used by the Administrator to identify the User but may be available in the system logs of the Platform.
Other voluntarily provided data: information that the User may voluntarily provide to the Administrator, such as during email communication, completing surveys or feedback forms about the Course, posting comments/questions within the Course (if such functionality is available), or subscribing to a newsletter.
Purposes and Legal Basis for Processing Data
Personal data of Users are collected and used for specific purposes:
Performance of the contract (Course service): Primarily, we process data to perform the contract with the User, i.e., to provide access to the purchased Course, handle the Platform account, provide technical support, and communicate regarding the Course progress. The legal basis for this processing is the necessity for the performance of the contract with the User (Art. 6(1)(b) of the GDPR).
Accounting and legal obligations: Data related to transactions (Course purchase) may be processed for invoicing, accounting, tax obligations, and record-keeping purposes. The legal basis for this processing is compliance with a legal obligation (Art. 6(1)(c) of the GDPR), such as the accounting or tax law requirements.Newsletter and marketing communication (with consent): If the User has given explicit consent, their contact information (e.g., email address) may be used to send newsletters or other marketing materials regarding new courses, promotions, products, or services. The legal basis for this processing is the User’s consent (Art. 6(1)(a) of the GDPR). Granting consent for marketing communication is optional and does not affect the ability to purchase or access the Course.Analytical purposes and service improvement (legitimate interest): We may process aggregated data about how Users use the Course (e.g., statistics on module completion, general activity) to better understand User needs and improve the content of the Course or our future services. Such processing is based on the legitimate interest of the Administrator (Art. 6(1)(f) of the GDPR), which is to enhance the educational offering. Data used for these purposes are anonymized or pseudonymized whenever possible, and the analysis does not aim to identify specific individuals.Establishing rights or defending against claims (legitimate interest): In case of disputes, complaints, or claims, the Administrator may process the User’s data to establish, assert, or defend claims. The legal basis for this processing is also the legitimate interest of the Administrator (Art. 6(1)(f) of the GDPR).
Newsletter and Marketing Materials
Voluntary consent: Subscription to the newsletter or receiving marketing materials from the Administrator requires explicit consent from the User. The User can grant consent by checking the appropriate box during registration or in account settings or by signing up via a separate newsletter form. Refusal to consent to marketing communication does not affect the ability to purchase or access the Course.Content of communication: If the User has given consent, the Administrator may periodically send emails containing updates related to the Course, information on new modules or upcoming course editions, discount offers, or information on new products or services related to the Course.Option to unsubscribe: The User has the right to withdraw consent to receive newsletters or other marketing emails at any time. Each email sent as part of the newsletter contains an easy-to-use opt-out link. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.Consequences of unsubscribing: After unsubscribing from the newsletter or withdrawing consent, the User’s data will no longer be used for marketing purposes. The User may still receive essential messages regarding the Course (e.g., related to schedule changes, administrative information), as these messages are not marketing communications but part of the service.
Data Transfers to Third Countries
As a rule, we strive to store and process personal data of Users within the European Economic Area (EEA). However, using Easytools infrastructure and external providers (e.g., payment providers or email service providers) may result in personal data being transferred outside the EEA (e.g., to the United States or other countries where the providers' servers or headquarters are located).In cases of transferring data outside the EEA, the Administrator ensures that appropriate safeguards are in place according to Chapter V of the GDPR. Such safeguards may include:the use of standard contractual clauses adopted by the European Commission with the data recipient in a third country (Standard Contractual Clauses),ensuring that the recipient of the data has a certificate confirming compliance with European data protection standards (if applicable),or other legally permitted mechanisms under the GDPR.The User has the right to obtain a copy of the appropriate safeguards related to the transfer of their data outside the EEA – in this case, the User can contact the Administrator.
Data Retention Period
Personal data will be stored for as long as necessary to fulfill the purposes for which it was collected or for the period required by law:Data related to Course performance (User account, purchase information): We store this data for as long as the User has access to the Course, and after the Course is completed or the account is deleted, for the period required to address any potential complaints, secure claims, or comply with legal obligations (e.g., transaction data may be stored for the period required by tax or accounting regulations, usually 5 years from the end of the tax year in which the transaction occurred).Data processed based on marketing consent (newsletter): We store this data until the consent is withdrawn by the User. After withdrawing consent for the newsletter, the User’s email address will be promptly removed from the mailing list, and their data will no longer be used for this purpose.Technical data (logs): Technical information stored in platform system logs may be retained for the period required by Easytools' internal policies (e.g., for security or diagnostics purposes), as described in Easytools' privacy policy. The Administrator does not store this data in its own systems longer than necessary for technical or security purposes.Data required for claims or defending claims: If personal data is needed to establish or defend claims or protect against them, we may retain it for the statutory period of limitation of potential claims (this period is specified by law – depending on the type of claim, it may range from 2 to 6 years or longer, in accordance with applicable regulations).After the relevant periods, the data will be deleted or anonymized so that individuals can no longer be identified based on the data.
Prawo wycofania zgody: W zakresie, w jakim przetwarzanie danych opiera się na zgodzie (np. na cele marketingowe), Użytkownik ma prawo w każdej chwili wycofać udzieloną zgodę (art. 7 ust. 3 RODO). Wycofanie zgody nie wpływa na legalność przetwarzania, którego dokonano na podstawie zgody przed jej wycofaniem.
Prawo wniesienia skargi do organu nadzorczego: Jeśli Użytkownik uważa, że przetwarzanie jego danych osobowych narusza przepisy RODO, ma prawo złożyć skargę do właściwego organu nadzorczego. W Polsce organem tym jest Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa). Jeżeli Użytkownik zamieszkuje w innym kraju, może złożyć skargę do organu nadzorczego właściwego dla jego kraju lub regionu.
Aby skorzystać ze swoich praw, Użytkownik może skontaktować się z Administratorem (pisemnie lub mailowo na wskazane dane kontaktowe). Administrator udzieli odpowiedzi bez zbędnej zwłoki, maksymalnie w terminie miesiąca od otrzymania żądania (termin ten może zostać wydłużony o kolejne dwa miesiące w razie potrzeby, o czym Użytkownik zostanie poinformowany).
Copyright © 2023 Design System MasterClass. All rights reserved.