Privacy Policy
This Privacy Policy explains what personal data we process when you visit our website, buy the
Service, and use it, and what your rights are under the EU General Data Protection Regulation
(GDPR) and the Polish Act on the Protection of Personal Data. It forms part of, and should be
read together with, our End User License Agreement.
1. Who is the controller
Grzegorz Olszewski is the data controller for the personal data described in
this Policy, except for payment and tax data handled by our merchant of record (see Section 4),
which that provider processes as an independent controller under its own terms.
Given the scale and nature of our processing, we are not required to appoint a Data
Protection Officer. For any privacy question, contact us at the address above.
2. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Name, email, order id (from your purchase) | Deliver the Service, create your account, send licence + login details, provide support | (b) performance of a contract |
| Per-copy watermark / canary identifier linking your licensed copy to you | Protect our intellectual property and trace unauthorized redistribution (see EULA §5, §11) | (f) legitimate interest in preventing infringement |
| Consent record at checkout (timestamp + which boxes you ticked for immediate performance / withdrawal waiver) | Prove the pre-purchase consent was given; comply with consumer law | (c) legal obligation; (f) establishing/defending legal claims |
| Account & course-progress data in our learning platform (login, lessons viewed) | Give you access to the course and track your progress | (b) performance of a contract |
| Video playback analytics (via our video host) | Operate and improve the lessons | (f) legitimate interest in a working product |
| Marketing / newsletter email, if you opt in | Send course updates, tips, and offers | (a) consent (withdrawable anytime) |
| Support correspondence (emails you send us) | Answer your questions and keep records | (f) legitimate interest in supporting customers |
| Technical data & server logs (IP address, device/browser, essential cookies) | Run the website securely, diagnose faults, and prevent abuse | (f) legitimate interest in a secure, working website |
We only collect what we need for these purposes. Providing purchase and account data is
necessary to buy and use the Service; without it we cannot deliver it.
3. The watermark / canary system (transparency note)
Each licensed copy of the Software may carry a unique identifier that associates it with you
as the purchasing user. We use this solely to deter and investigate unauthorized
redistribution. We do not use it to profile you or track your use of the Software beyond
identifying the source of a leaked copy. If a copy bearing your identifier appears in an
unauthorized public location, we may rely on it as evidence under EULA §5. You have the
right to object to this processing (Section 6); note that we may continue where we have
compelling legitimate grounds, in particular for the establishment or defence of legal claims.
4. Payments
Payments are processed by our merchant of record,
Lemon Squeezy, LLC, who sells
the Service to you as reseller and handles checkout, billing, VAT/tax, invoices, and refunds.
They process your payment and billing data as an independent controller under
their own privacy policy at lemonsqueezy.com/privacy.
We never receive or store your full card details.
5. Who we share data with (processors and recipients)
We do not sell your personal data. We share it only with service providers that help us run
the Service, each bound to protect it:
- Merchant of record / payments — Lemon Squeezy, LLC (independent controller, see Section 4).
- Website & course hosting (the WordPress/TutorLMS environment) — OVHcloud (OVH Sp. z o.o., ul. Powstańców Śląskich 9, 53-332 Wrocław, Poland).
- Video hosting & playback — Vimeo.com, Inc.
- Marketing email (course updates, launch announcements) — MailerLite, EU-based.
- Transactional email (account, enrolment and password messages) — sent from our own mail server at OVHcloud (the hosting provider named above); no separate email provider is involved.
- Analytics — none. We use no analytics, tracking or advertising tools. Our host keeps standard server logs (including IP addresses) for security and troubleshooting.
We may also disclose data where required by law, or to establish, exercise, or defend legal
claims.
6. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy;
- rectify inaccurate or incomplete data;
- erasure (“right to be forgotten”), subject to our need to keep
certain records (e.g. tax invoices, and infringement-evidence data where we have compelling
grounds); - restrict or object to processing based on legitimate
interests, including the watermark processing and any direct marketing (objection to direct
marketing is always honoured); - data portability for data processed by automated means on the basis of
consent or contract; - withdraw consent at any time (e.g. unsubscribe), without affecting
processing done before withdrawal.
To exercise any right, email greg@constructivegreg.com. We will respond
within one month. You also have the right to lodge a complaint with the Polish supervisory
authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony
Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa,
https://uodo.gov.pl — or with the authority in
your EU country of residence.
7. Retention
We keep personal data only as long as needed for the purposes above:
- Account & licence data — for the life of your licence, then as needed
to provide “lifetime updates” you purchased. - Purchase / invoice records — for the period required by Polish tax law
(currently 5 years from the end of the accounting year). - Watermark / infringement-evidence data — while your licence is active and,
if an infringement is detected, until the related claim is resolved and limitation periods
expire. - Marketing email — until you unsubscribe or withdraw consent.
- Support correspondence — up to 3 years after the last contact.
8. International transfers
Some providers in Section 5 may process data outside the European Economic Area. Where they
do, transfers are protected by an adequacy decision or by Standard Contractual
Clauses (and supplementary measures where needed). Contact us for a copy of the relevant
safeguards.
9. Cookies
Our website uses essential cookies only — those needed for security, login,
and checkout. We set no analytics, advertising or profiling cookies of our own, so no cookie
consent banner is shown. If this ever changes, we will update this policy and ask for your
consent before any non-essential cookie is set.
Video lessons are embedded from Vimeo, which may set its own cookies when you play a lesson;
see Vimeo’s privacy policy for details.
10. Children
The Service is intended for professional adults. It is not directed at children
and we do not knowingly collect data from anyone under 16.
11. Changes to this Policy
We may update this Policy from time to time. Material changes will be posted on this page with
a new “Last updated” date and, where required, notified to you directly. Continued use
of the Service after a change takes effect indicates you have read the updated Policy.
12. Contact
Questions or requests: greg@constructivegreg.com.
See also our Terms of Service,
End User License Agreement and
Refund Policy.