PRIVACY POLICY FOR BACHATACORE.COM

Last updated: September 27, 2026
Version: 1.1

This document describes the rules for processing personal data in connection with the use of bachatacore.com, the purchase and management of Bachata Core subscriptions, access to the course and community, communications, analytics and marketing.

We respect the privacy of users of bachatacore.com (the “Service”) and people using the Bachata Core product, including the online course, community, subscriptions and related services (“Bachata Core”).

This Privacy Policy explains what personal data we process, for what purposes, on what legal bases, who we may share it with, how long we retain it, and what rights users may have.

This Policy has been prepared primarily with the GDPR and Polish data protection law in mind. To the extent applicable to our activities, it also addresses requirements relevant to users in the United Kingdom, the United States (including California), Canada and Australia.

1. Data controller

The controller of personal data is:

ALWAYS DANCE AWARE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Wilcza 44 lok. 1
00-679 Warsaw
Poland
NIP (Tax ID): 7011311109
REGON: 544601698

Privacy and personal data contact: privacy@bachatacore.com

We have not appointed a Data Protection Officer (DPO). For matters relating to personal data, you may contact us directly using the address above.

2. Scope of this Policy

This Policy applies in particular when you:

• visit bachatacore.com;
• use the purchase window (order form) in the Service;
• subscribe to a newsletter or other marketing communications;
• purchase a monthly or annual Bachata Core subscription;
• make a payment through Stripe;
• receive or use access to the course and community on Skool;
• contact us by email or through social media;
• use the Bachata Core course, community or materials;
• interact with our advertisements;
• use analytics, marketing or cookie-based features where you have provided the required consent.

External service providers such as Stripe, Skool, Google, Meta or Microsoft may, in certain circumstances, process data as independent controllers under their own privacy policies. This Policy does not replace their own privacy notices.

3. Personal data we may process

3.1. Identification and contact data

Depending on how you use Bachata Core, we may process in particular:

• first name;
• last name;
• email address;
• optionally, a telephone number if it is used in a specific feature in the future;
• country or place of residence;
• data you voluntarily provide in correspondence.

We do not require a telephone number for marketing purposes unless it is necessary for a specific service.

3.2. Purchase and subscription data

This may include, for example:

• the selected product or subscription option;
• purchase date;
• amount and currency;
• payment status;
• subscription status;
• subscription start, renewal, cancellation or end date;
• transaction, customer, subscription or Checkout Session identifiers;
• the content, date and version of the declaration made in the purchase window (acceptance of the Terms and request for immediate access to the digital content before the withdrawal period ends);
• the status of the Skool invitation;
• billing information and billing country.

Payments are processed through Stripe. As a rule, we do not receive or store full payment card details. Payment method data is processed by Stripe in accordance with that provider’s rules and policies.

3.3. Data related to the use of Skool

• first name or profile name;
• email address;
• account identifier;
• membership status;
• course access information;
• community activity;
• course progress;
• posts, comments and other content voluntarily published by the user.

Please do not publish sensitive personal data in the community unless necessary, for example information about health, beliefs, sexual orientation, identity documents or other information whose disclosure is not required to use the course.

3.4. Newsletter and marketing data

• first name;
• last name;
• email address;
• signup source;
• date, method and wording of the consent provided;
• newsletter subscription status;
• technical information relating to message delivery or interaction with a message, if this functionality is enabled.

3.5. Technical and analytics data

• IP address;
• device type, operating system and browser;
• approximate location;
• cookie identifiers and online identifiers;
• traffic source and UTM parameters;
• pages and content viewed;
• clicks, scrolling and time spent using the Service;
• information about interactions with advertisements;
• analytics event and conversion data.

Microsoft Clarity may additionally generate click maps, scroll maps and recordings of how the website is used, within the scope of the tool configuration and the consent provided.

4. Sources of personal data

We may obtain data:

• directly from you;
• from the purchase window in the Service;
• from Stripe in connection with a purchase or subscription;
• from Skool in connection with your use of the course and community;
• from cookies and similar technologies;
• from Google and Meta;
• from messages you send to us by email or through social media.

5. Purposes and legal bases for processing

5.1. Transactional messages vs. marketing messages

Messages concerning purchase confirmation, access activation, renewal, cancellation, account security or other important matters connected with providing the service are transactional or service messages and are not treated as a newsletter.

Purchasing Bachata Core does not automatically subscribe you to the newsletter. Messages about new courses, products, promotions, events or special offers are sent on the basis of an appropriate, freely given marketing consent where required. You may withdraw consent at any time, including by using the unsubscribe link or contacting privacy@bachatacore.com.

6. Stripe - payments and subscriptions

Payments for Bachata Core are processed through Stripe under the Stripe Managed Payments model, in which the applicable Stripe entity (Sold through Link, LLC or another entity indicated at checkout) acts as merchant of record. The Stripe payment form (Stripe Embedded Checkout) is displayed in the purchase window directly in the Service, and the Stripe.js script is loaded only after you proceed to payment. You enter card and other payment method details directly into elements provided by Stripe - they do not reach our servers. Stripe may process, among other things, your name, email address, billing address, country, device data, IP address, payment method data and transaction information.

Depending on the operation, Stripe may act as a processor or as an independent controller, particularly in relation to fraud prevention, legal compliance, payment and tax obligations, and operation of its own platform features.

Full payment card details are not stored by ALWAYS DANCE AWARE Sp. z o.o.

6.1. Our purchase records

After an order is placed, Stripe sends transaction information to our system (by automated notification - a webhook). We store it in a database on our hosting server (Zenbox). This consists of: the email address provided at checkout, Stripe customer, subscription and checkout session identifiers, the selected plan, amount and currency, payment and subscription status, Skool invitation status, the number of attempts and any error message, and the dates of these events. We do not store card details, billing address or other billing data - these remain with Stripe.

We use this data to grant and remove access to Bachata Core, automatically retry failed invitations, handle enquiries and complaints, and demonstrate proper performance of the contract (Article 6(1)(b) and (f) GDPR). We also receive information about events that require our action - for example the end of a subscription, a refund, a dispute or a failed Skool invitation - in automated email messages that include the Customer’s email address. Our system’s technical logs do not contain payment data.

7. Skool - course and community

The Bachata Core course and community are provided through Skool. After payment is confirmed, our system automatically provides Skool (through Skool’s official invitation mechanism) only with the email address used at checkout - Skool sends an invitation to the Bachata Core community to that address. You provide your first name, last name, profile name and other account data directly on Skool.

Information about the end of a subscription is not transmitted to Skool automatically. We receive it from Stripe and then remove the membership manually in the community’s administration panel on Skool. As community administrators, we have access to member data visible to administrators on Skool (e.g. profile name, email address, membership status and community activity).

Skool has its own privacy rules and may act as an independent controller in certain circumstances.

8. Newsletter and marketing communications

As of the latest update, we do not run a newsletter, the Service does not contain a sign-up form, and we do not use MailerLite or any other email-marketing tool. If we start such communications, we will update this Policy before they begin, and we will process the data described in section 3.4 only on the basis of appropriate consent.

We add people to the marketing mailing list only where we have an appropriate legal basis. In particular, purchasing Bachata Core does not itself constitute consent to additional marketing communications.

9. Analytics, marketing and consent-management tools

As of the latest update, we use the following tools:

• Google Tag Manager - tag and integration management;
• Google Analytics 4 - traffic and behaviour analytics;
• Microsoft Clarity - heatmaps, interaction analysis and session recordings within the scope of the tool configuration;
• Meta Pixel / Meta Ads - campaign measurement, remarketing, Custom Audiences and Lookalike Audiences;
• Cookie consent banner (Google Consent Mode) - our own cookie consent management mechanism;
• Stripe - payment form in the purchase window;
• Zenbox - hosting of the Service and the purchase database, domain and email services.

We do not currently use Google Ads, TikTok Pixel / TikTok Events API or MailerLite. If we implement them, we will update this Policy and the Cookie Policy before they are activated.

10. Cookies and similar technologies

The Service uses cookies and similar technologies. We manage consents through our own cookie consent banner (Google Consent Mode) or another equivalent consent-management mechanism.

10.1. Functional / strictly necessary

These technologies are required for the proper operation, security and basic functions of the Service. They may be active regardless of consent where the law permits their use without consent.

10.2. Statistics

This category includes Google Analytics 4 and Microsoft Clarity. Microsoft Clarity is activated only after consent is given. Without consent, Google Analytics 4 does not store cookies, and Google may only receive pings without user identifiers (Google Consent Mode).

10.3. Marketing

This category includes Meta Pixel. It is used to measure advertising effectiveness, for remarketing and for marketing profiling.

Detailed information about the cookies we use, their duration and how to change your consent is provided in a separate Cookie Policy.

11. Profiling and automated decision-making

We do not make decisions about users that produce legal effects or similarly significantly affect them solely on the basis of automated processing.

We may, however, use marketing profiling in Meta systems, for example for remarketing, creation of audiences and similar audiences, and ad personalisation. In the EU/EEA and UK, such technologies are used in accordance with the applicable consent requirements.

12. Recipients of personal data

Personal data may be shared with entities supporting the operation of Bachata Core, in particular:

• Stripe - payments and subscriptions;
• Skool - course and community;
• Google - GTM, GA4;
• Meta Platforms - Meta Pixel and advertising;
• Microsoft - Microsoft Clarity;
• Cookie consent banner - consent management;
• Zenbox - hosting of the Service and the purchase database, domain and email;
• IT service providers and developers;
• accountants, lawyers and auditors;
• public authorities where required by law.

They receive access to personal data only to the extent necessary to perform their tasks or provide their services.

13. International transfers outside the EEA

Some providers may process personal data outside the European Economic Area, in particular in the United States. This may include, among others, Stripe, Skool, Google, Meta, Microsoft and other global service providers.

Where required by law, data transfers are made using an appropriate legal mechanism, in particular an adequacy decision, applicable transfer framework, Standard Contractual Clauses or other legally permitted safeguards.

14. How long we retain personal data

We do not retain personal data longer than necessary for the purpose for which it was collected, taking into account legal obligations and the need to protect against claims.

• active subscription data - for the duration of the subscription;
• data in our purchase records (section 6.1), including the record of the declaration made before purchase - for the duration of the subscription and then for the limitation period for contract-related claims;
• contract data - for the period required to perform the contract and then for the period appropriate for the establishment, exercise or defence of claims;
• accounting and tax data - for the period required by applicable law;
• correspondence data - for the time required to handle the matter and then for a period justified by archiving needs and protection against claims;
• newsletter data - until consent is withdrawn, you unsubscribe, or further retention is no longer justified;
• information documenting the granting or withdrawal of consent - for the period necessary to demonstrate compliance with the law;
• cookie data - for the period resulting from the settings of the relevant cookie and the Cookie Policy;
• analytics data - in accordance with the retention settings of the relevant tool and the consent provided.

We do not retain data indefinitely solely because the user has not requested its deletion.

15. Rights of users in the EU/EEA

Where the GDPR applies to the processing of your data, you may have the right to:

• access your personal data and obtain a copy;
• rectify your personal data;
• erase your personal data;
• restrict processing;
• data portability;
• object to processing based on legitimate interests;
• withdraw consent at any time;
• lodge a complaint with the competent supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).

16. Users in the United Kingdom

Where the UK GDPR applies to the processing of your data, you have the rights provided for under those rules, including in particular the rights of access, rectification, erasure, restriction of processing, objection and data portability. You may also lodge a complaint with the Information Commissioner’s Office (ICO).

ALWAYS DANCE AWARE Sp. z o.o. is established outside the United Kingdom. As of the date of the latest update to this Policy, we do not conduct regular, actively targeted sales campaigns in the UK market and our processing of personal data of people located in the UK is limited. We have therefore not currently appointed a representative in the United Kingdom.

The UK GDPR does not set a financial or numerical sales threshold at which the obligation to appoint a representative arises. The obligation depends on the nature of the processing. An exemption may apply where processing is only occasional, low risk and does not include large-scale processing of special categories of personal data or personal data relating to criminal convictions and offences.

If we begin regular campaigns targeted at people in the United Kingdom, regular sales in that market, or monitoring of user behaviour in a way that creates an obligation under the UK GDPR, we will reassess this requirement and, where necessary, appoint a UK representative and update this Policy with the representative’s contact details.

17. United States and California

Users in the United States may have additional rights under applicable state privacy laws. If and to the extent that the California Consumer Privacy Act (CCPA/CPRA) applies to our activities, California residents may have, among other rights, the right to information about the categories and sources of data, access, correction and deletion, the right to opt out of the “sale” or “sharing” of personal information as defined by applicable law, and the right not to be discriminated against for exercising their rights.

We do not sell personal data for monetary consideration. However, the use of advertising technologies from Meta may in certain circumstances be treated under state law as “sharing” personal information for cross-context behavioural advertising.

Where applicable state privacy laws apply to us, we will provide the required opt-out mechanism and honour properly transmitted privacy preference signals, such as Global Privacy Control (GPC), to the extent required by law. Requests may be sent to privacy@bachatacore.com.

18. Canada

Where the Canadian PIPEDA or applicable provincial privacy legislation applies to a particular processing activity, we follow the principles of accountability, identifying purposes, appropriate consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, and individual access and correction.

Requests from users in Canada may be submitted to privacy@bachatacore.com.

19. Australia

Where the Australian Privacy Act 1988 and the Australian Privacy Principles apply to our activities, you may have, among other rights, the right to information about how your personal data is handled, access to your personal data and correction of that data. Where required by law, we will also provide information about overseas disclosures and how complaints are handled.

Requests may be sent to privacy@bachatacore.com. If you believe that your rights under Australian privacy law have been infringed, you may also contact the Office of the Australian Information Commissioner (OAIC).

20. Minors

Bachata Core may contain educational materials suitable for younger dancers; however, use of online services and creation of accounts must comply with the law applicable to the user’s age and the rules of the platforms used.

Skool sets a minimum age for holding an account. As of the date of the latest update to this Policy, the minimum age for a Skool account is 13.

Children under 13 should not create a Skool account on their own or independently provide us with personal data online. If the course is purchased for a child under 13, the purchase and account details should belong to a parent or legal guardian, and the materials should be used with their involvement and in accordance with Skool’s rules.

For users aged 13-17, we may require the involvement, consent or confirmation of a parent or legal guardian where required by the law applicable in the user’s place of residence or by the platform rules. In particular, U.S. laws relating to children may require verifiable parental consent before collecting personal information online from a child under 13.

We do not direct personal-data-based advertising profiling at children in a manner contrary to applicable law.

21. Security

We use technical and organisational measures appropriate to the risk, including in particular:

• encrypted HTTPS connections;
• access controls and access restrictions;
• individual user accounts;
• multi-factor authentication where available;
• system and component updates;
• backups to the extent provided by the services we use;
• cooperation with providers that apply appropriate security measures.

However, no information system can guarantee the complete elimination of security risks.

22. How to exercise your rights

Requests concerning personal data may be submitted to:

privacy@bachatacore.com

We may ask for information necessary to verify the identity of the person making the request. Requests are handled within the time limits provided by applicable law.

23. Changes to this Policy

This Policy may be updated, in particular if we change how Bachata Core operates, add new systems, providers or marketing channels, change the payment model, or if the law changes.

The current version will be published in the Service together with the date of the latest update. Where changes are material for active customers, we may additionally notify them by email.

24. Contact

For matters relating to this Privacy Policy or the processing of personal data, please contact:

ALWAYS DANCE AWARE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Wilcza 44 lok. 1
00-679 Warsaw
Poland
NIP (Tax ID): 7011311109
REGON: 544601698
privacy@bachatacore.com

End of document