Aestia privacy policy

English translation of the Polish policy, version 2.1. Effective from 7 November 2026.

1. Controller and contact

The controller of personal data processed in connection with Aestia is OSTEOPATIA BIODYNAMICZNA sp. z o.o., ul. Jana Mohna 50G/8, 87-100 Toruń, Poland, tax identification number (NIP) 9562402889, KRS 0001172798, REGON 541724704. Aestia is a brand of this company.

For matters concerning your data and rights, write to osteopatia.biodynamiczna@gmail.com or the company's postal address. We have not appointed a data protection officer. The controller handles these matters at the contact address above.

2. Purposes, data and legal bases

Our legitimate interests include protecting accounts and payments, contacting the buyer's representative, recording agreements, and establishing, exercising and defending legal claims. We rely on these interests only as necessary and with regard to your rights.

Creating an account and making a purchase do not subscribe you to the newsletter. Joining the list is optional and requires separate confirmation. Messages about sign-in, purchases, access, complaints or security serve performance of the agreement and do not require marketing consent.

We do not request patient data or information about users' health. Do not put it in notes or messages. If you send it nevertheless, we will limit its use to what is necessary to handle the matter and remove unnecessary information in accordance with the applicable legal basis.

Payments take place through Stripe. Aestia does not receive your complete card number or security code. Stripe processes payment-instrument details, transaction data and information needed for payment security under its own obligations and policy.

3. Is providing data mandatory?

Providing data is voluntary, but an email address and authentication data are necessary to operate an account. Buyer details marked as required are used to enter into and settle the purchase and issue an accounting document. Without them, you cannot complete this ordering method. A tax number and company details are required for company purchases, not private purchases.

Joining the list, consenting to measurement and keeping personal notes are optional. Declining does not prevent a purchase, course access or language selection. Technical information such as an IP address is generated when you connect to the service.

Answering the questions and downloading a certificate are optional. You may use the materials without doing either. You provide your first and last name only when you request a named certificate. We do not take it automatically from an invoice because the buyer may be a different person from the participant.

4. Recipients

We use the following providers to the extent necessary for their roles:

Providers acting on our behalf operate under appropriate data processing agreements. Some recipients, particularly Stripe for its own payment, security and fraud-prevention obligations, may also act as separate controllers. See the Stripe privacy policy for details.

Data may also be received, as necessary, by authorised customer-support and system personnel, accountants and legal advisers, and public authorities entitled to receive it by law, including the Polish National Revenue Administration in the applicable document process. We do not sell data or pass it to third parties for their independent marketing.

We do not publish certificates in a publicly accessible register.

5. Transfers outside the EEA

Aestia's primary database operates in the Frankfurt region. This does not mean that every operation of every provider takes place exclusively in the European Union. Hosting, payment, email and video providers use global infrastructure, support and subprocessors. This may involve transfers outside the European Economic Area, including to the United States.

For these transfers, we use mechanisms provided for in Chapter V GDPR: an applicable European Commission adequacy decision where it covers the recipient and operation, or Standard Contractual Clauses and required supplementary safeguards. We do not assume that a provider's European address means no transfers take place. You can request information about the mechanism used and a copy of the relevant safeguards at our contact address, subject to protection of other people's confidential data.

6. Retention

These periods concern data for which we are responsible as controller. We retain only what is needed for the relevant purpose. Accounting records, contractual evidence and sign-in data serve different purposes, so closing an account does not automatically remove every document.

We remove unnecessary working copies and technical queue data once their task and any error reconciliation are complete. Durable evidence of an agreement or invoice is retained for its separate period stated above, without keeping unnecessary duplicates. We carry out retention reviews; this does not mean that a single automatic mechanism deletes every category.

Recipients acting as separate controllers may retain their own data for periods required by their obligations and described in their policies. For providers acting on our behalf, we also take account of the contractual expiry periods for backups and logs.

We retain answers and results while you use this account feature. We retain certificate data while the document is available in your account, to allow you to download it again and request corrections. After account closure or a valid erasure request, we remove data that is no longer needed to perform the agreement, meet a specific legal obligation, or establish, exercise or defend legal claims. Any longer retention is limited to the data and time necessary in the particular case. Deleting the record ends the ability to download the certificate again from the account; a file you have already downloaded remains with you.

7. Cookies and device storage

The site opens in Polish by default. You do not need to accept optional measurement to select a language, create an account or buy a course.

- Operation and security: the signed-in account session, hosting protection and data needed for requested features. These are used when necessary to provide those features. Account-session storage maintains sign-in; signing out ends the local session. - Selected language: after you choose a language, the functional cookie `aestia_language` remembers it for 12 months. It is not used for advertising. - Your privacy choice: localStorage contains `aestia.privacy.v1`, holding the setting version and whether you allow measurement. It contains no email or account identifier. It remains until you change your decision or clear site storage. If storage is blocked, the decision applies on the open page and you may need to choose again on a later visit. - Optional measurement: off by default. In the footer's privacy settings you can choose to accept all or use only necessary technologies, and change that choice later. “All” refers to the optional measurement available here, not any future tools. It does not subscribe you to the newsletter or activate advertising pixels.

After consent, the counter aggregates page views by course, day and permitted visit source. It does not transmit email, account identifier or the full address of the page visited. Technical infrastructure may nevertheless process the IP address and other metadata on each connection. Withdrawing consent blocks further measurement requests; it does not reverse anonymous totals already recorded or a request already accepted by the server.

We do not use advertising pixels that track people across websites. You can also manage storage in your browser. Clearing or blocking necessary data may sign you out or prevent a requested feature from working. Player data is processed when you start a video; this does not constitute consent to the provider's independent marketing.

8. Your rights

Within the limits of the GDPR, you may request access and a copy of your data, rectification, erasure, restriction, and portability of data processed automatically on the basis of consent or a contract. You may object to processing based on legitimate interests on grounds relating to your particular situation. Objection to direct marketing is effective without further justification.

You may withdraw consent at any time, as easily as it was given: through privacy settings, an unsubscribe link or contact with us, depending on the consent involved. Withdrawal does not affect the lawfulness of earlier processing.

Write to the address in section 1. We handle requests individually. If there are reasonable doubts, we may ask for information necessary to confirm your identity. We do not routinely require a copy of an identity document. We respond without undue delay and within one month at the latest. If an extension is necessary under the GDPR because of the complexity or number of requests, we will explain the reason and the new deadline within the first month; the extension is limited to two further months.

You do not need an account-deletion button. An email request is sufficient to start the process. Account and data deletion does not include documents we must still retain. We will explain what remains and on what basis. We do not treat a data request as automatic surrender of paid access.

You may complain to the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Current contact and complaint methods are available at https://uodo.gov.pl.

9. Automation and security

We automatically compare payment confirmation with the order to grant the correct access, and check entitlements before video playback or PDF download. A confirmed full refund may automatically end the course entitlement. We do not use this data to set an individual price or build an advertising profile. If a status is wrong or access is refused despite purchase, you can obtain an explanation and human review at our contact address. Stripe may use its own payment-security assessment mechanisms, described in its policy.

We use encrypted connections, database and material access restrictions, backups, and permissions for people carrying out particular tasks. Passwords are processed in protected form by the authentication service; we do not read them or send them in messages.

We assess and handle personal data breaches in accordance with the GDPR. Where notification to the supervisory authority is required, we notify without undue delay and, where feasible, within 72 hours of becoming aware. If a breach poses a high risk to individuals, we inform them without undue delay, subject to the exceptions provided by law.

We automatically compare answers with the approved question set's answer key. We add up the best results from each lesson and check whether you have reached 50% of all questions in that edition. The result supports learning and certificate issuance. It does not restrict access to the materials or confer professional qualifications. You may dispute the result, obtain an explanation and request human review at our contact address.

10. Changes

We update this policy when actual processing, providers or the law change. Every version has a number and date. We inform users of significant changes on the site and, as appropriate, by email. A policy change is not consent to a new optional purpose. Where consent is needed, we request it separately before starting that processing.

Earlier versions are available on request.