Privacy policy

[À COMPLÉTER — dénomination sociale exacte (razón social)], Spanish tax ID (NIF/CIF) [À COMPLÉTER — NIF / CIF espagnol], [À COMPLÉTER — adresse complète du siège social en Espagne] (Spain) — contact@simonlgcy.com. As the controller is established in Spain, the lead supervisory authority is the Spanish Data Protection Agency (AEPD).

Account: name, email address, password (stored hashed, never in plain text). Signup profile: experience level and goal declared during onboarding. Usage: lesson progress, owned courses. Orders: purchase and billing history — card data is processed exclusively by the payment provider and never passes through our servers. Technical: connection logs and essential cookies. Audience measurement and advertising: browsing identifiers set only after consent (see Cookie Policy).

Providing the member area and courses: performance of the contract. Invoicing and accounting: legal obligation. Responding to contact requests: legitimate interest. Sending news and offers: consent, withdrawable at any time via the unsubscribe link or by email. Audience measurement and advertising: consent, withdrawable at any time from the site footer.

Data is accessible only to the controller and to processors acting on its instructions, bound by a contract compliant with Article 28 GDPR. They operate by category: site hosting and infrastructure, database and authentication, payment processing, course video streaming, email delivery, audience measurement and advertising (only after consent). No data is sold or rented to third parties.

The current list of processors by name, together with their country of establishment, is provided on request at contact@simonlgcy.com.

Some processors — notably for hosting, payment, video streaming and audience measurement — are established outside the European Union, mainly in the United States, or hold infrastructure there. These transfers rely on a European Commission adequacy decision where one exists, failing which on the Commission's standard contractual clauses, supplemented by technical measures (encryption in transit, minimisation of the data transmitted). A copy of the applicable safeguards can be requested at contact@simonlgcy.com.

Account data: for the life of the account, then deleted within 30 days of a closure request. Billing data: six years, in accordance with Article 30 of the Spanish Commercial Code, without prejudice to tax limitation periods. Marketing emails: until consent is withdrawn or 3 years after last contact. Measurement and advertising trackers: according to each tracker’s own lifetime, with consent itself requested again after six months. Technical logs: 12 months maximum.

You have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time without affecting processing already carried out, and the digital rights recognised by the LOPDGDD, including the ability to give instructions on what happens to your data after your death. To exercise these rights: contact@simonlgcy.com (response within one month).

If the reply does not satisfy you, you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es — or with the supervisory authority of your country of habitual residence.

Data is protected by encryption in transit (HTTPS), password hashing and row-level security (RLS) in the database. The services are restricted to adults; minors must not create an account. Article 7 of the LOPDGDD also sets fourteen as the age from which a minor may consent to the processing of their data on their own.

The French version of this document is authoritative. The English translation is provided for convenience only.