Privacy

Last updated: 23 October 2026

This notice covers the current public website, the release-notification list, the browser-local lesson preview, learner accounts, and course purchases. Accounts are not open yet; the section on them describes what applies once they open. Purchases are not open yet either, and the same holds for their section. There are no advertising trackers or marketing cookies.

Information and purposes

Website delivery and security

Cloudflare receives technical request information needed to deliver and protect the website, such as an IP address, request time, requested path, and browser request headers. Polyseminar relies on its legitimate interest in providing a secure and reliable website under Article 6(1)(f) GDPR. Cloudflare retains this information according to the applicable service configuration and its legal obligations. Polyseminar does not create a separate application access log for these public pages.

Cloudflare Web Analytics

If you select “Allow analytics,” the website loads Cloudflare Web Analytics. It measures page views and performance information, including page paths, browser and operating-system categories, country-level location, and Core Web Vitals. It does not use analytics cookies or localStorage, does not log URL query strings, and does not track visitors across unrelated websites.

The analytics beacon is disabled until you consent. Consent is the legal basis under Article 6(1)(a) GDPR where the measurements constitute personal data. You can withdraw consent through “Privacy choices” in the footer. Withdrawal does not affect processing that occurred before withdrawal.

Cloudflare documents that unsampled beacon data is retained for seven days and then aggregated, and that Web Analytics dashboard information is available for the previous six months.

Consent preference

The website stores polyseminar.analytics-consent in your browser with the value granted or denied. This necessary preference prevents the website from repeatedly asking for the same choice. It remains until you change it or clear browser storage.

Release-notification list

If you use the form on the release-updates page, Polyseminar stores your email address, the first name you choose to give, the course you asked to hear about, the time you submitted the form, the page you submitted it from, and the identifier of the consent text you agreed to. The record holds no IP address and no browser fingerprint.

Polyseminar uses the address to send one message asking you to confirm it, and then to tell you once when the course you asked about opens. Each course is a separate choice and a separate consent, so asking about one course does not put you on a list for any other. Consent is the legal basis under Article 6(1)(a) GDPR. Storing the confirmation and the consent version is how Polyseminar demonstrates that consent under Article 7(1) GDPR, relying on its legitimate interest under Article 6(1)(f) GDPR.

An unconfirmed request is deleted within 30 days, and an address that is left following no course is deleted with it. A confirmed request is kept until you ask to be removed or until that course’s list is closed. To be removed, write to office@polyseminar.com and the record is deleted.

Polyseminar holds the records in a Cloudflare D1 database created in the European Union jurisdiction, which restricts storage of the data at rest to the EU.

Learner accounts

You sign in with a link sent to your email address; there is no password. When you first sign in, Polyseminar creates an account that holds your email address, the times the account was created and last changed, and when you were last signed in.

A sign-in link works once, for 15 minutes. Until it is used or expires, the database holds the address it was sent to and the link itself only as a one-way hash. To stop one inbox being flooded with links, each request for a link is recorded as a one-way hash of the address and the time of the request. These records are deleted after one day.

Signing in sets one cookie, polyseminar.session_token. It is necessary for staying signed in, cannot be read by scripts on the page, and expires 30 days after the session was last renewed, unless you sign out first. While you use the site, the session is renewed at most once a day. The matching session record holds its expiry date and the times it was created and last renewed. It holds no IP address and no browser or device identification. You can sign out on one device or on every device. Expired sessions are deleted daily.

For each course you can open, the account records when access was granted and, where there is one, when it ends. Within 30 days of that end, Polyseminar emails you the date once, and records which end date it emailed you about. For each lesson you work on, it records the activities you completed, the answers you gave to its questions, when you first finished the lesson, and when you last worked on it. For each attempt at a course's practice exam, it records the questions it asks, the answers you gave, the question you were on, when you started and last worked on it, and when you submitted it. This is what lets you continue on another device, and read a mock result again later.

The legal basis is the performance of the contract to provide the account and its courses under Article 6(1)(b) GDPR. Recording link requests to prevent abuse relies on legitimate interest under Article 6(1)(f) GDPR. The account, its course access, its progress, and its practice exam attempts are kept until you delete the account or ask us to, or until nobody has used it for 12 months. Using it means signing in, working on a lesson or a practice exam, starting an order, or having course access that has not yet ended. After 12 months unused, we email you that the account will be deleted, and delete it 30 days later unless you sign in before then. Deleting the account deletes its course access, progress, practice exam attempts, and sessions. To ask, write to office@polyseminar.com. Account records are held in the same EU-jurisdiction Cloudflare D1 database as the release-notification list.

Course purchases

When you buy a course, Polyseminar records an order linked to your account. It holds the course, the price and currency, the amount you paid after any discount code, Stripe’s reference for that code, and the access period. It also holds whether you ticked the box asking for access to open at once, the version of that box’s wording, and the time you ticked it. It records the version of the terms of sale you accepted, the language you ordered in, the order’s status and dates, Stripe’s references for the payment, and the billing country you gave Stripe. When the payment is confirmed, Polyseminar emails you a confirmation of the contract. If the order is refunded, it emails you that too.

If that billing country is in the United Kingdom, the order is held (terms of sale, clause 6.10), and Polyseminar emails you and its own office about it. The order then also records the country you state as the one where you normally live, the version of the statement’s wording, when you made it, and when Polyseminar sent you a reminder. Polyseminar uses the statement to decide whether it may sell to you. Kept with the order, the statement and the billing country are the evidence of where the buyer lives that VAT law asks a seller to keep, under Article 6(1)(c) GDPR.

You pay on a page run by Stripe, and Polyseminar never receives your card details. Polyseminar sends Stripe your email address and the order reference. Stripe also receives what you enter on its page, such as your name, payment details, and billing country. Stripe processes this information for Polyseminar. Its privacy policy says it also uses the information for its own purposes, such as preventing fraud.

The legal basis for the order and the payment is the performance of the contract under Article 6(1)(b) GDPR. Paid orders are kept as sales records because Polish tax law requires it, under Article 6(1)(c) GDPR. Keeping your answer about immediate access, with its wording and time, shows whether the right of withdrawal still applies. That relies on legitimate interest in establishing and defending legal claims under Article 6(1)(f) GDPR.

An order that is never paid is deleted after two days. A paid or refunded order is kept until the end of the sixth year after the year of payment, or of the refund if there was one, because Polish tax law can require sales records until then. An order paid in 2026 is kept to the end of 2032. Deleting your account does not delete your orders, but it removes their link to the account. Orders are held in the same EU-jurisdiction Cloudflare D1 database as accounts.

Free access

Polyseminar sometimes gives a learner free access to a course, for example to review it. It records the grant with your account: the course, the number of months, a short note of why, who at Polyseminar gave it, when, and when it was taken back if it was. It emails you that the access is open. The legal basis is the performance of the account contract under Article 6(1)(b) GDPR. A grant is not a sale, so no sales record is kept for it. It is included in your data export and deleted with your account.

The UK list

Polyseminar does not sell to people who live in the United Kingdom. If you live there, the buy page lets you ask to be emailed once you can buy a course. The list records that request for your account: the course, the version of the request’s wording, and when you made it. It uses your account’s email address and stores no other contact details. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time with the button on the same page, which removes the entry. Polyseminar emails each address on the list once, when UK sales open, and then deletes the list. Deleting your account deletes its entries too.

Anti-spam check on the forms

The release-updates form and the sign-in form are protected by Cloudflare Turnstile. Turnstile receives your IP address, browser request headers, and signals about how the page behaved, and it returns a pass or fail result to Polyseminar. Polyseminar receives the result, not the signals. The legal basis is legitimate interest in preventing automated abuse of the forms under Article 6(1)(f) GDPR. Cloudflare states that Turnstile does not use the data for advertising or cross-site tracking.

Turnstile is not loaded while you are only reading this site. Its script is fetched the moment you place the cursor in one of these forms, so nothing reaches Cloudflare from a form's page unless you set out to use the form.

Email correspondence

If you email Polyseminar, the message, email address, name you provide, and related correspondence are used to answer you or take steps you request before a possible contract. The legal bases are Article 6(1)(f) or, where applicable, Article 6(1)(b) GDPR. Correspondence is normally retained for 12 months after the last message and may be retained longer when necessary to establish, exercise, or defend legal claims or meet a legal obligation.

Browser-local lesson progress and readiness answers

The readiness check scores your answers in your browser and sends none of them to Polyseminar. Leaving the page discards them. The lesson preview can save completion state in your browser. That state remains on the device and is not sent to Polyseminar. You can remove it through your browser settings. When you are signed in and have access to a course, its lesson pages also save your progress to your account, as described under learner accounts.

Recipients and international transfers

Cloudflare, Inc. and its affiliates provide hosting, content delivery, security, the form anti-spam check, the database behind the release-notification list and learner accounts, and, after consent, Web Analytics. Resend (Plus Five Five, Inc.) sends the messages for the release-notification list, the sign-in links, and purchase confirmations. It receives the address needed to deliver them, and for the list also the first name. Stripe (Stripe Payments Europe, Limited, Ireland) takes course payments, as described under course purchases. Cloudflare may process information outside the European Economic Area. Where GDPR transfer restrictions apply, Cloudflare states that it uses applicable safeguards, including adequacy mechanisms or the European Commission’s Standard Contractual Clauses. Resend may likewise process information outside the European Economic Area under Standard Contractual Clauses. Stripe states that it transfers information under adequacy decisions, including the EU-U.S. Data Privacy Framework, or under Standard Contractual Clauses. You may request information about the safeguards using the contact address below.

Your rights

Depending on the processing and applicable conditions, you may request access, rectification, erasure, restriction, or portability of your personal data; object to processing based on legitimate interests; and withdraw consent at any time. Polyseminar does not use automated decision-making that produces legal or similarly significant effects.

Once you have an account, its page lets you download a copy of your account data and delete the account yourself.

To exercise a right, email office@polyseminar.com. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Operator and controller

No data protection officer has been appointed. Privacy requests should be sent to the operator using the email address above.

No CEIDG, KRS, REGON, or business NIP registration is claimed.

Changes to this notice

The notice will be updated when accounts and purchases open, and before additional analytics or other personal-data features are activated. The date above identifies the current revision.