# Aestia privacy policy

**English translation of the Polish policy, version 2.1. Effective from 7 November 2026.**

## 1. Controller and contact

The controller of personal data processed in connection with Aestia is **OSTEOPATIA BIODYNAMICZNA sp. z o.o.**, ul. Jana Mohna 50G/8, 87-100 Toruń, Poland, tax identification number (NIP) 9562402889, KRS 0001172798, REGON 541724704. Aestia is a brand of this company.

For matters concerning your data and rights, write to **osteopatia.biodynamiczna@gmail.com** or the company's postal address. We have not appointed a data protection officer. The controller handles these matters at the contact address above.

## 2. Purposes, data and legal bases

| Purpose | Data and source | Basis under Article 6(1) GDPR |
|---|---|---|
| Operating your account, confirming your address, signing in and recovering access | The email address you provide, protected authentication data, account identifier, creation and sign-in dates, session data and selected language | Point (b): performance of the account agreement |
| Accepting and fulfilling a purchase | Your name or company details, billing address, company tax number where applicable, account email, course, price, currency, order number and status; payment identifiers and status received from Stripe | Point (b): entering into and performing the agreement; for a person representing a company, also point (f): contact and performance of the agreement with that company |
| Providing the course and learning features | Account, course entitlement, selected lesson, saved progress, your notes, and technical playback and download data | Point (b): performance of the agreement |
| Lesson questions, recording results and issuing a certificate | Your account identifier, course and question edition, selected answers, results and attempt dates; when requesting a certificate, your first and last name entered and confirmed by you, document number, date, scope and any correction | Art. 6(1)(b): performance of the agreement and the requested course feature; Art. 6(1)(f) only as needed to resolve an error, document a correction or protect specific legal claims |
| Confirming the agreement and its terms | The recorded offer, document versions, declarations and their timestamps, buyer details at purchase, confirmation dispatch status and correspondence | Point (c): obligations towards the customer; point (f): evidence of entering into and performing the agreement, and protection of legal claims |
| Invoices, accounting, corrections and refunds | Buyer details, document items and amounts, taxes, document and payment identifiers; confirmations required for the applicable KSeF process | Point (c): tax and accounting obligations; point (b): making a refund that is due |
| Replies, support, complaints and exercise of rights | Contact details, message contents and necessary case information provided by you or arising from support | Point (b): contractual matters; point (c): legal obligations; point (f): other correspondence and protection of claims |
| Security and prevention of abuse | IP address, browser and device information, event dates, session and security identifiers, necessary operational records | Point (f): protection of the service, customers and transactions; point (c) where a specific legal obligation applies |
| Optional course mailing list | Email, language, course interest, sign-up and confirmation timestamps, consent wording and version, and withdrawal information | Point (a): consent to the list; point (c): evidence of required consent; point (f): honouring withdrawal and protection of claims |
| Optional visit measurement | After your choice: course code, permitted visit-source and source-type labels, and day; the hosting provider also processes connection metadata | Point (a) insofar as personal data and optional measurement are concerned; the resulting anonymous totals are not personal data |

Our legitimate interests include protecting accounts and payments, contacting the buyer's representative, recording agreements, and establishing, exercising and defending legal claims. We rely on these interests only as necessary and with regard to your rights.

Creating an account and making a purchase do not subscribe you to the newsletter. Joining the list is optional and requires separate confirmation. Messages about sign-in, purchases, access, complaints or security serve performance of the agreement and do not require marketing consent.

We do not request patient data or information about users' health. Do not put it in notes or messages. If you send it nevertheless, we will limit its use to what is necessary to handle the matter and remove unnecessary information in accordance with the applicable legal basis.

Payments take place through Stripe. Aestia does not receive your complete card number or security code. Stripe processes payment-instrument details, transaction data and information needed for payment security under its own obligations and policy.

## 3. Is providing data mandatory?

Providing data is voluntary, but an email address and authentication data are necessary to operate an account. Buyer details marked as required are used to enter into and settle the purchase and issue an accounting document. Without them, you cannot complete this ordering method. A tax number and company details are required for company purchases, not private purchases.

Joining the list, consenting to measurement and keeping personal notes are optional. Declining does not prevent a purchase, course access or language selection. Technical information such as an IP address is generated when you connect to the service.

Answering the questions and downloading a certificate are optional. You may use the materials without doing either. You provide your first and last name only when you request a named certificate. We do not take it automatically from an invoice because the buyer may be a different person from the participant.

## 4. Recipients

We use the following providers to the extent necessary for their roles:

| Provider | Role and data |
|---|---|
| Cloudflare | Website hosting and protection, and server services; connection metadata, requests and data passed to the relevant function |
| Supabase | Authentication, database of accounts, orders, entitlements, progress, notes, answers, results, private certificate data and contractual evidence, and private PDF storage; the Aestia project's primary region is Frankfurt, EU |
| Bunny | Video playback; material identifier, IP address, browser, referring page address and technical transmission information; we do not put email addresses or invoice details in the player URL |
| Stripe | Accepting and securing payments, refunds and payment disputes; buyer and transaction data and details submitted directly on the payment page |
| Fakturownia | Issuing, storing and delivering accounting documents and corrections, and KSeF handling where applicable; buyer, sales and document details |
| Resend | Account and contractual messages and mailing-list confirmation; recipient email, message contents, attachments and delivery status |
| MailerLite | Optional mailing list; email, language and course interest, passed on after sign-up confirmation |
| Google, Gmail service | Correspondence sent to our contact address; sender address, message contents and attachments |

Providers acting on our behalf operate under appropriate data processing agreements. Some recipients, particularly Stripe for its own payment, security and fraud-prevention obligations, may also act as separate controllers. See the [Stripe privacy policy](https://stripe.com/en-pl/privacy) for details.

Data may also be received, as necessary, by authorised customer-support and system personnel, accountants and legal advisers, and public authorities entitled to receive it by law, including the Polish National Revenue Administration in the applicable document process. We do not sell data or pass it to third parties for their independent marketing.

We do not publish certificates in a publicly accessible register.

## 5. Transfers outside the EEA

Aestia's primary database operates in the Frankfurt region. This does not mean that every operation of every provider takes place exclusively in the European Union. Hosting, payment, email and video providers use global infrastructure, support and subprocessors. This may involve transfers outside the European Economic Area, including to the United States.

For these transfers, we use mechanisms provided for in Chapter V GDPR: an applicable European Commission adequacy decision where it covers the recipient and operation, or Standard Contractual Clauses and required supplementary safeguards. We do not assume that a provider's European address means no transfers take place. You can request information about the mechanism used and a copy of the relevant safeguards at our contact address, subject to protection of other people's confidential data.

## 6. Retention

These periods concern data for which we are responsible as controller. We retain only what is needed for the relevant purpose. Accounting records, contractual evidence and sign-in data serve different purposes, so closing an account does not automatically remove every document.

| Category | Period or criterion |
|---|---|
| Active account and course entitlement | For the duration of the account and performance of the access agreement. We do not remove paid access solely because there has been no sign-in for a period. |
| Progress and personal notes | While you use the feature, until their deletion or closure of the account; longer only as necessary for a specific obligation or dispute. |
| Unconfirmed account created through the public form | Up to 7 days after registration, removed in the next hourly cleanup cycle. The activation link itself has the shorter validity period stated in the message. |
| Unpaid order whose payment has definitively expired | Buyer data not needed for another purpose is deleted or anonymised within 30 days of expiry. If payment status is unresolved or a dispute has been raised, we retain what is needed to resolve it. |
| Order, terms and evidence of performance | As necessary during performance of the agreement, and then until the relevant limitation period for claims expires. Generally this is 6 years, or 3 years for claims connected with business activity or periodic payments; the period and its starting point depend on the type of claim. We do not retain unnecessary technical details throughout this period. |
| Invoices, corrections and data required for accounting | For the period required by tax and accounting law, generally until 5 years have elapsed from the end of the year in which the tax payment deadline fell. This may be longer if the limitation period is lawfully suspended or interrupted. |
| Complaints and disputes | During the matter and then until the limitation period applicable to its claims expires. Where proceedings require longer retention, until their final conclusion and completion of associated obligations. |
| Ordinary enquiry without a purchase or dispute | Until correspondence ends, then no longer than 12 months unless a specific matter requires evidence to be retained for longer. |
| Unconfirmed mailing-list sign-up | Up to 7 days after the confirmation message is sent; then deleted. |
| Confirmed mailing-list subscription | Until consent is withdrawn or the list ends. After withdrawal, we stop marketing messages. |
| Evidence of consent or withdrawal, and the suppression list preventing further sends | The minimum evidence needed to demonstrate compliance and handle claims for the applicable limitation period; the address on the suppression list only for as long as necessary to honour withdrawal. We review the continuing need to retain it at least every 3 years. |
| Our own technical logs that do not form part of transaction evidence | Up to 30 days. An extract necessary to investigate a specific incident may be retained until the matter and applicable period for protection of claims end. |
| Main database backups | A rotating 7-day period. Data deleted from the active database may remain until a backup expires; we do not use that backup for routine operations or marketing. Following restoration, we take account of deletion requests. |
| Aggregate anonymous visit statistics | Up to 24 months. They are not linked to an account or mailing list. |

We remove unnecessary working copies and technical queue data once their task and any error reconciliation are complete. Durable evidence of an agreement or invoice is retained for its separate period stated above, without keeping unnecessary duplicates. We carry out retention reviews; this does not mean that a single automatic mechanism deletes every category.

Recipients acting as separate controllers may retain their own data for periods required by their obligations and described in their policies. For providers acting on our behalf, we also take account of the contractual expiry periods for backups and logs.

We retain answers and results while you use this account feature. We retain certificate data while the document is available in your account, to allow you to download it again and request corrections. After account closure or a valid erasure request, we remove data that is no longer needed to perform the agreement, meet a specific legal obligation, or establish, exercise or defend legal claims. Any longer retention is limited to the data and time necessary in the particular case. Deleting the record ends the ability to download the certificate again from the account; a file you have already downloaded remains with you.

## 7. Cookies and device storage

The site opens in Polish by default. You do not need to accept optional measurement to select a language, create an account or buy a course.

- **Operation and security:** the signed-in account session, hosting protection and data needed for requested features. These are used when necessary to provide those features. Account-session storage maintains sign-in; signing out ends the local session.
- **Selected language:** after you choose a language, the functional cookie `aestia_language` remembers it for 12 months. It is not used for advertising.
- **Your privacy choice:** localStorage contains `aestia.privacy.v1`, holding the setting version and whether you allow measurement. It contains no email or account identifier. It remains until you change your decision or clear site storage. If storage is blocked, the decision applies on the open page and you may need to choose again on a later visit.
- **Optional measurement:** off by default. In the footer's privacy settings you can choose to accept all or use only necessary technologies, and change that choice later. “All” refers to the optional measurement available here, not any future tools. It does not subscribe you to the newsletter or activate advertising pixels.

After consent, the counter aggregates page views by course, day and permitted visit source. It does not transmit email, account identifier or the full address of the page visited. Technical infrastructure may nevertheless process the IP address and other metadata on each connection. Withdrawing consent blocks further measurement requests; it does not reverse anonymous totals already recorded or a request already accepted by the server.

We do not use advertising pixels that track people across websites. You can also manage storage in your browser. Clearing or blocking necessary data may sign you out or prevent a requested feature from working. Player data is processed when you start a video; this does not constitute consent to the provider's independent marketing.

## 8. Your rights

Within the limits of the GDPR, you may request access and a copy of your data, rectification, erasure, restriction, and portability of data processed automatically on the basis of consent or a contract. You may object to processing based on legitimate interests on grounds relating to your particular situation. Objection to direct marketing is effective without further justification.

You may withdraw consent at any time, as easily as it was given: through privacy settings, an unsubscribe link or contact with us, depending on the consent involved. Withdrawal does not affect the lawfulness of earlier processing.

Write to the address in section 1. We handle requests individually. If there are reasonable doubts, we may ask for information necessary to confirm your identity. We do not routinely require a copy of an identity document. We respond without undue delay and within one month at the latest. If an extension is necessary under the GDPR because of the complexity or number of requests, we will explain the reason and the new deadline within the first month; the extension is limited to two further months.

You do not need an account-deletion button. An email request is sufficient to start the process. Account and data deletion does not include documents we must still retain. We will explain what remains and on what basis. We do not treat a data request as automatic surrender of paid access.

You may complain to the **President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)**. Current contact and complaint methods are available at https://uodo.gov.pl.

## 9. Automation and security

We automatically compare payment confirmation with the order to grant the correct access, and check entitlements before video playback or PDF download. A confirmed full refund may automatically end the course entitlement. We do not use this data to set an individual price or build an advertising profile. If a status is wrong or access is refused despite purchase, you can obtain an explanation and human review at our contact address. Stripe may use its own payment-security assessment mechanisms, described in its policy.

We use encrypted connections, database and material access restrictions, backups, and permissions for people carrying out particular tasks. Passwords are processed in protected form by the authentication service; we do not read them or send them in messages.

We assess and handle personal data breaches in accordance with the GDPR. Where notification to the supervisory authority is required, we notify without undue delay and, where feasible, within 72 hours of becoming aware. If a breach poses a high risk to individuals, we inform them without undue delay, subject to the exceptions provided by law.

We automatically compare answers with the approved question set's answer key. We add up the best results from each lesson and check whether you have reached 50% of all questions in that edition. The result supports learning and certificate issuance. It does not restrict access to the materials or confer professional qualifications. You may dispute the result, obtain an explanation and request human review at our contact address.

## 10. Changes

We update this policy when actual processing, providers or the law change. Every version has a number and date. We inform users of significant changes on the site and, as appropriate, by email. A policy change is not consent to a new optional purpose. Where consent is needed, we request it separately before starting that processing.

Earlier versions are available on request.