# Aestia Privacy Policy (English) **Version 1.1, effective 24 October 2026** --- ## 1. Who is the controller The controller of your personal data is **OSTEOPATIA BIODYNAMICZNA sp. z o.o.**, ul. Jana Mohna 50G/8, 87-100 Toruń, Poland, NIP 9562402889, KRS 0001172798. Data protection contact: **osteopatia.biodynamiczna@gmail.com**. Aestia is the name of the service operated by this company. The company is the controller of data collected on aestia.eu, in user accounts and on the course mailing list. We have not appointed a Data Protection Officer, as this is not required at our scale and for our processing. All data protection matters are handled by the controller at the address above. --- ## 2. What data we collect and why ### 2.1 Account Data: email address, password stored as an irreversible bcrypt hash, account creation date, last login date, interface language, technical session identifier. Purpose: operating the account, enabling login, password recovery and use of service features. Legal basis: Article 6(1)(b) GDPR, performance of a contract for electronic services. **The account is free. It does not give access to paid courses and does not subscribe you to the course mailing list.** These are three separate things. ### 2.2 Course mailing list Data: email address, date and time of sign-up, date and time of confirmation, version of the consent text you agreed to, language and course of interest, record of withdrawal. Purpose: sending news about courses, teaching materials and invitations to Aestia meetings. Legal basis: Article 6(1)(a) GDPR, your consent. You may withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Sign-up is double opt-in. After you submit your address we send a confirmation email. Only clicking the link activates the subscription. An unconfirmed address is never added to the mailing list. ### 2.3 Security and abuse prevention Data: IP address, browser and device information, request timestamps, security identifiers. Purpose: protecting the service against attacks, fraud, spam and unauthorised access; maintaining stability. Legal basis: Article 6(1)(f) GDPR, our legitimate interest. You may object; we will then assess whether our interest prevails. ### 2.4 Aggregate statistics We count page views by day, course and source. **The counter does not store IP addresses and does not identify visitors.** The result is an aggregate number and is not personal data. We do not link it to accounts or to the mailing list. ### 2.5 Contact and complaints Data: email address, message content, attachments you send, correspondence. Purpose: answering enquiries, handling complaints and data protection requests. Legal basis: Article 6(1)(b) GDPR for contractual matters; Article 6(1)(f) otherwise. ### 2.6 Claims and legal obligations Purpose: establishing, exercising and defending claims, and complying with legal obligations, including tax and accounting once sales begin. Legal basis: Article 6(1)(f) and Article 6(1)(c) GDPR. --- ## 3. What we do not do We do not profile you in a way that produces legal effects. We do not make decisions based solely on automated processing. We do not collect health data, beliefs or other special categories of data. We do not sell data and do not share it with third parties for their own advertising. We do not link the account with the mailing list. If you have an account and have not subscribed, you will not receive marketing messages from us. --- ## 4. Who receives your data We share data only with entities processing it on our behalf under a data processing agreement, and with entities entitled to it by law. | Provider | Role | Data | Location | |---|---|---|---| | Cloudflare, Inc. | public website hosting, attack protection, DNS | IP address, request metadata | United States | | Supabase Pte. Ltd | account database, authentication, private consent evidence register | email address, account data, consent evidence | Singapore, data stored in the Frankfurt region, European Union | | Plus Five Five, Inc., trading as Resend | account emails, address confirmation, password recovery, sign-up confirmation | email address, message content, delivery status | United States | | MailerLite, UAB | mailing list and segments | email address, language, course interest | Lithuania, European Union | **Who sees the address when.** The address given at registration is processed by Supabase and Resend. The address given for the mailing list is processed by Supabase and Resend already at the confirmation email stage, and by MailerLite only after confirmation. Before confirmation the address is not passed to MailerLite. **We do not deliver video at this stage.** We will name the video delivery provider in this policy before courses launch, after concluding a data processing agreement with it. **Other recipients:** our accounting provider and legal advisers where necessary, and public authorities where required by law. **Processing agreements.** We have data processing agreements in place with Cloudflare, Supabase, Resend and MailerLite. With each of them the agreement forms part of their terms of service and takes effect on acceptance of those terms, without a separate signature. --- ## 5. Transfers outside the European Union Account data and consent evidence are stored on servers in the Frankfurt region, in the European Union. Our providers are nevertheless established outside the Union: Cloudflare in the United States, Resend in the United States, Supabase in Singapore. In those cases data may be transferred outside the European Economic Area. Transfers rely on the Standard Contractual Clauses approved by the European Commission, included in the processing agreement with each of those providers. The Cloudflare agreement additionally provides for the Data Privacy Framework. MailerLite is established in Lithuania, so mailing list data remains in the European Union. MailerLite uses sub-processors within the European Union, including data centres in Germany and the Netherlands. You may obtain a copy of the safeguards by writing to the contact address. --- ## 6. How long we keep data | Data | Period | Why | |---|---|---| | Active account | until deletion | contract | | Unconfirmed account | 7 days from registration, then deleted | address not confirmed | | Database backups | 7 days | BackupPro plan, disaster recovery | | Data needed to defend claims | up to 3 years after deletion | limitation period, Article 118 Polish Civil Code | | Unconfirmed sign-up | **7 days** from the confirmation email | automatic deletion if unconfirmed | | Confirmed subscription and consent evidence | for the duration of consent | we must demonstrate consent, Article 7(1) GDPR | | Evidence of withdrawal | **3 years** from withdrawal | defence against claims | | Address on the suppression list | indefinite, reviewed every 3 years | without it we cannot honour the objection | | Correspondence and complaints | 3 years from closure | limitation period | | Technical and security logs | our own up to 30 days; Cloudflare, Supabase and Resend logs according to their documentation and the plan we use | incident detection and analysis | | Aggregate statistics | 24 months | traffic analysis, not personal data | **Link validity is not retention.** The account confirmation link is valid for 24 hours. If you do not use it, the account remains unconfirmed and we delete it after 7 days. The mailing list confirmation link is valid for 7 days and an unconfirmed sign-up is deleted after 7 days. After the period ends we delete or irreversibly anonymise the data. --- ## 7. Your rights You have the right to: access and obtain a copy of your data; rectification; erasure; restriction of processing; data portability; objection to processing based on our legitimate interest; and withdrawal of consent at any time, without giving reasons and without affecting earlier sends. To exercise these rights, write to **osteopatia.biodynamiczna@gmail.com**. We respond without undue delay and at the latest within one month, extendable by two further months for complex requests. You may lodge a complaint with the **President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland**, or with the supervisory authority in your country of residence. Deleting your account does not require a self-service panel. A message to the contact address is enough. We delete the account and the data that we are not required to keep. --- ## 8. Is providing data mandatory Providing your email address is voluntary, but without it you cannot create an account or subscribe to the list. Your IP address is generated automatically when you connect to the service. --- ## 9. Cookies The service uses only cookies and technologies necessary for operation and security, including our hosting provider's protection against attacks and bots. We do not use advertising or analytics cookies that track your behaviour across sites. For this reason we do not display a cookie consent banner. If we add an analytics or advertising tool in the future, a banner will appear and this policy will be updated before the tool is launched. You can restrict or disable cookies in your browser settings. Disabling essential cookies may prevent you from logging in. --- ## 10. Security We use encrypted connections, access control, separate environments and restrict data access to staff who need it. Passwords are stored only as an irreversible bcrypt hash. We do not know your password and cannot read or recover it. If you lose it, you can set a new one through the password recovery function. In the event of a personal data breach likely to result in a high risk to your rights, we will inform you without undue delay and notify the supervisory authority within 72 hours of becoming aware. --- ## 11. Changes We update this policy when the scope of processing, our providers or the law change. Each version carries a number and a date. We inform you of material changes by email if you have an account or are subscribed, and publish the new version on the site. Earlier versions are available on request. ---