Privacy notice
V2.2.20 · 18.10.2026
Controller and data
Mike Heldt · TheUnschoolSchool Żurawi Trakt 67c, 83-047 Huta Dolna, Polska hello@theunschoolschool.org · +48 517 715 808 Mike Heldt is the programme’s data controller. Adults register; children have no accounts. We collect the parent’s name and email, children’s names or nicknames, chosen forms of address, language, registration and confirmation dates, participation and delivery status. Purchases add the plan, selected children, participation period and Stripe identifiers. Security uses technical session identifiers and abuse-prevention data. We do not request children’s identity documents or national identification numbers.
Purposes and legal bases
Parent data supports requested participation and pre-contract steps (GDPR Article 6(1)(b)). A child’s name or nickname and chosen form of address are processed with guardian consent for personalisation (a). One email invitation to paid continuation requires separate optional email permission and is not required for free adventures. Accounting duties rely on (c); security, necessary logs and legal claims on (f). Consent can be withdrawn without affecting earlier lawful processing. Withdrawing permission for child data may prevent further personalisation; it does not automatically cancel a paid subscription. Contact us to exercise rights or object.
Recipients and transfers
ALL-INKL hosts the website and database; Brevo (Sendinblue) sends email and receives the recipient address, message and personal PDF attachments. Stripe/Link receives the parent email, plan, quantity and technical identifiers; our integration does not pass children’s names to Checkout. Payment details are entered with Stripe, not in our database. Stripe/Link also acts as an independent controller for transaction data under its own privacy policy. Authorised support staff and advisers may access necessary information for accounting or claims. Providers use subprocessors and processing may involve countries outside the EEA. Transfers require an applicable basis, such as an adequacy decision or standard contractual clauses with additional safeguards, depending on the recipient. Ask us for information about applicable safeguards and how to obtain a copy. See brevo.com/legal/privacypolicy/ and stripe.com/privacy for provider information.
Retention
The scheduled technical task deletes unconfirmed registrations after 7 days. It deletes completed or stopped participation without any booking record after 90 days from confirmation if no unresolved deliveries remain. Active participation data is retained to deliver it. Within 90 days after paid participation ends, the operator must delete or anonymise child data unless needed for a specific complaint; this is an operator duty, not an automatic feature of the current panel. Minimum parent, consent, order and claims evidence may remain until the applicable limitation period expires. Tax records are kept as required by law, generally five years from the end of the year in which the tax payment deadline fell. This does not require retaining every PDF or child name for that period. Invitation permission is retained until withdrawal or use, with evidence kept only as needed for legal claims. Logs, queues, cache and backups must be limited to necessary periods and reviewed; ask the operator about particular copies and provider retention. We do not promise immediate deletion from every historic backup.
Your rights
You may request access, correction, deletion, restriction and portability where applicable, withdraw consent, and object to processing based on legitimate interests. You may complain to the Polish supervisory authority, UODO (uodo.gov.pl), or the relevant authority in your country of residence. We normally respond within one month, subject to GDPR extensions. Identity checks use proportionate information. Data provision is voluntary; an email and child identifier are needed for personal letters. Refusing the sales invitation does not limit the five free adventures.
Cookies, security and photographs
We use a necessary session to protect forms and a website-language cookie lasting up to one year. This version uses no advertising pixels or external website analytics. Hosting and email providers may record technical delivery data. We do not use profiling or automated decisions with legal or similarly significant effects. Children do not have to submit work. Publishing submitted photographs or testimonials requires a separate agreement; participation alone does not authorise advertising use of a child’s image. External Stripe/Link Checkout has its own privacy and cookie arrangements.
Back to TheUnschoolSchool