Privacy policy

SIMONLGCY, S.L., Spanish tax ID (NIF/CIF) B93895746, CL. Ceramista Joan Daifa, 2, 07800 Eivissa, Illes Balears (Spain). Contact: contact@simonlgcy.com. As the controller is established in Spain, the lead supervisory authority is the Spanish Data Protection Agency (AEPD).

Account: name, email address, password (stored hashed, never in plain text) and your choice whether to receive news emails. Signup profile: experience level and goal declared during onboarding. Usage: lesson progress, activity days, owned courses. Community: posts, comments and attachments, messages exchanged with the trainer, files submitted to validate an exercise. Waiting list: email address and, where provided, name, phone number, company and answers to the form’s questions, left to be notified when a course opens. Site assistant: the messages you write to it; they are not stored in our database. Orders: purchase and billing history, plus the name, email address and, when requested, phone number and billing address entered on the payment page; card data is processed exclusively by the payment provider and never passes through our servers. Technical: IP address and connection logs, and essential cookies. Audience measurement and advertising: browsing identifiers set only after consent (see Cookie Policy).

Providing the member area, the courses and the community, including automatic translation of messages between members: performance of the contract. Invoicing and accounting: legal obligation. Responding to contact requests and to questions asked to the site assistant: legitimate interest. Site security and abuse prevention: legitimate interest. Sending news and offers, and opening notices to people on a waiting list: consent, withdrawable at any time via the unsubscribe link or by email. A single reminder email sent when a payment session expires without purchase: legitimate interest. Audience measurement and advertising through cookies: consent, withdrawable at any time from the site footer. You may object to any processing based on legitimate interest (see section 7).

Data is accessible to the controller and to the providers that need it to run the site. Acting as processors, on its instructions and bound by a contract compliant with Article 28 GDPR: Vercel (site hosting), Supabase (database, authentication and file storage), Resend (sending the site’s emails), Zoho (mailbox of the contact address), Loom (course video streaming), Anthropic (answers from the site assistant and translation of community messages, when these features use its AI model) and, after consent, Google (Google Analytics). Acting as separate controllers, under their own policies: Stripe, for payment and fraud prevention, and Klarna Bank AB, when you choose to pay in instalments with Klarna. Meta (Facebook, Instagram) receives, after consent, the data collected by its pixel; for that collection and transmission, SIMONLGCY, S.L. and Meta are joint controllers, Meta then processing the data under its sole responsibility. Your community posts, your name and your position on the progress leaderboard are visible to other signed-in members. No data is sold or rented to third parties.

The current list of processors by name, together with their country of establishment, is provided on request at contact@simonlgcy.com.

Some providers, notably for hosting, payment, email delivery, video streaming, the site assistant and community translation, audience measurement and advertising, are established outside the European Union, mainly in the United States, or hold infrastructure there. These transfers rely on a European Commission adequacy decision where one exists, failing which on the Commission's standard contractual clauses, supplemented by technical measures (encryption in transit, minimisation of the data transmitted). A copy of the applicable safeguards can be requested at contact@simonlgcy.com.

Account data: for the life of the account, then deleted within 30 days of a closure request. Posts, messages and files submitted in the member area: for the life of the account, unless deleted earlier. Waiting list: we write to you until you unsubscribe using the link in each email; your entry is then kept, marked as unsubscribed, so that we do not write to you again. Messages to the site assistant: not stored in our database. Billing data: six years, in accordance with Article 30 of the Spanish Commercial Code, without prejudice to tax limitation periods. Marketing emails: until consent is withdrawn or 3 years after last contact. Measurement and advertising trackers: according to each tracker’s own lifetime, with consent itself requested again after six months. Technical logs: 12 months maximum.

You have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time without affecting processing already carried out, and the digital rights recognised by the LOPDGDD, including the ability to give instructions on what happens to your data after your death. To exercise these rights: contact@simonlgcy.com (response within one month).

If the reply does not satisfy you, you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD, www.aepd.es), or with the supervisory authority of your country of habitual residence.

Data is protected by encryption in transit (HTTPS), password hashing and row-level security (RLS) in the database. The services are restricted to adults; minors must not create an account. Article 7 of the LOPDGDD also sets fourteen as the age from which a minor may consent to the processing of their data on their own.

The French version of this document is authoritative. The English translation is provided for convenience only.