---
title: "Privacy Policy"
subtitle: "LearnSynth by Caterpillar Garden — learnsynth.net"
version: "v1.4"
date: "2025-01-15"
lang: "en"
kind: "privacy"
pdf: "/LearnSynth_Polityka_Prywatnosci_v1.4.pdf"
---

Note: This website is operated by ON Technologies Marcin Karkocha, a Polish sole proprietorship. The governing law for all data processing activities is Polish law and EU GDPR. In the event of any discrepancy between the Polish and English versions of this Privacy Policy, the Polish version shall prevail.

## § 1. Data Controller {#1-data-controller}

The Data Controller of your personal data is:

ON Technologies Marcin Karkocha, ul. Szafarnia 11/F8, 80-755 Gdańsk, Poland, VAT-EU: PL7651606629,

operating under the brands LearnSynth and Caterpillar Garden (hereinafter: "Controller").

Data protection contact: contact@caterpillar.garden

## § 2. Data We Collect and Why {#2-data-we-collect-and-why}

### 2.1. Newsletter {#2-1-newsletter}

When you subscribe to the product newsletter, we collect:

- First name – to personalise communications
- Email address – as the newsletter delivery channel

Legal basis: Article 6(1)(a) GDPR – your consent. You may withdraw your consent at any time by writing to contact@caterpillar.garden.

### 2.2. Surveys (training demand, dates, locations) {#2-2-surveys-training-demand-dates-locations}

Surveys are optional. If you choose to provide contact details, we collect:

- First name (required if you want a follow-up)
- Last name (optional)
- Email address (required if you want a follow-up)

Anonymous surveys require no personal data whatsoever.

Legal basis: Article 6(1)(a) GDPR – consent; Article 6(1)(f) GDPR – legitimate interest of the Controller (analysis of demand for training services).

### 2.3. Training Registration (sign-up form) {#2-3-training-registration-sign-up-form}

When registering for a training session, we collect:

- First and last name – participant identification
- Email address – communication, booking confirmation, delivery of materials
- Phone number – operational contact (changes, cancellations)
- Company name, VAT number, address – only if you request a VAT invoice
- Catering preference – for in-person trainings with catering only; options: standard (meat), vegan, or free-text notes (e.g. allergies). Used solely for meal logistics.
- Schedule availability – information about preferred participation dates

Legal basis: Article 6(1)(b) GDPR – conclusion and performance of a contract; Article 6(1)(c) GDPR – VAT invoicing (legal obligation). Catering data is processed for meal logistics purposes and does not constitute special category data under Article 9 GDPR unless it reveals health conditions or religious beliefs. If a participant voluntarily provides such information in the free-text notes field, they are considered to have given explicit consent by virtue of submitting that data (Article 9(2)(a) GDPR).

### 2.4. Payments via Stripe {#2-4-payments-via-stripe}

Payments for trainings are processed through the Stripe platform. The Controller does not store payment card data. Payment data is processed by Stripe Payments Europe, Ltd. (a processor established in the EU). Data shared with Stripe includes: first name, last name, email address, transaction amount.

Legal basis: Article 6(1)(b) GDPR – performance of a contract.

DPA: The Data Processing Agreement (DPA) with Stripe is incorporated into the Stripe Services Agreement (stripe.com/legal/ssa). Stripe operates under EEA Standard Contractual Clauses (SCC) as per the Data Transfers Addendum (stripe.com/legal/dta). The full list of Stripe sub-processors is available at stripe.com/legal/service-providers.

### 2.5. Invoicing (InFakt + automation) {#2-5-invoicing-infakt-automation}

Following payment, the Controller issues a VAT invoice via the KSeF system, using automation based on the InFakt service. Data required for invoicing: first and last name or company name, address, VAT number (for businesses).

Legal basis: Article 6(1)(c) GDPR – legal obligation (Accounting Act, VAT Act).

## § 3. Data Retention {#3-data-retention}

| Purpose | Retention Period | After Expiry |
| --- | --- | --- |
| Newsletter | Until consent withdrawn | Deletion or anonymisation |
| Surveys (with contact data) | 12 months from completion | Anonymisation |
| Training registration (participant data) | 2 years from training date | Anonymisation for statistical purposes |
| Invoices and accounting documents | 5 years from end of calendar year of issue | Destruction per applicable law |
| Dietary data | Until training completion | Immediate deletion |

## § 4. Recipients — Sub-processors {#4-recipients-sub-processors}

In connection with its operations, the Controller uses the services of the following data processors acting on behalf of the Controller:

| Entity | Purpose | Server Location |
| --- | --- | --- |
| Stripe Payments Europe | Online payment processing | EU (Ireland) + potentially USA – SCC |
| Notion Labs, Inc. | Forms and surveys (Notion Forms) | USA – SCC; DPA signed with Notion (Business plan); contact: privacy@notion.so |
| OVH SAS (OVHcloud) | Website hosting | France (EU) — data processed within the EU |
| InFakt S.A. | Invoicing | Poland (EU) |
| Microsoft 365 (Exchange Online / Outlook) | Manual newsletter delivery | EU (Microsoft European data centres) |

The Controller enters into appropriate data processing agreements with each sub-processor, where required under GDPR.

Transfers of personal data outside the European Economic Area (EEA) are carried out exclusively on the basis of appropriate safeguards, in particular Standard Contractual Clauses (SCC) approved by the European Commission.

## § 5. Your Rights {#5-your-rights}

Under the GDPR, you have the following rights:

- Right of access – you may obtain information about the data we process (Article 15 GDPR)
- Right to rectification – you may request correction of inaccurate data (Article 16 GDPR)
- Right to erasure – you may request deletion of your data ("right to be forgotten", Article 17 GDPR)
- Right to restriction – you may request suspension of processing in certain cases (Article 18 GDPR)
- Right to data portability – you may receive your data in a structured format (Article 20 GDPR)
- Right to object – you may object to processing based on legitimate interests (Article 21 GDPR)
- Right to withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal
- Right to lodge a complaint – with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland; or with the supervisory authority in your country of residence

## § 6. Exercising Your Rights and Unsubscribing {#6-exercising-your-rights-and-unsubscribing}

All requests regarding personal data processing, including:

- unsubscribing from the newsletter,
- deletion of data from forms or surveys,
- rectification, restriction, portability, or access requests,

should be sent to: contact@caterpillar.garden

Please include in your message: your name and the email address used during registration, and the scope of your request (e.g., "please remove my data from the newsletter", "please delete my registration data for training XYZ"). This allows us to efficiently identify and process your request.

The Controller will respond without undue delay, and in any event within 30 days (Article 12 GDPR). For particularly complex requests, this period may be extended by a further 60 days, of which the Controller will inform you.

## § 7. Cookies and Tracking Technologies {#7-cookies-and-tracking-technologies}

The LearnSynth by Caterpillar Garden website is built as a static site generated by [Astro](https://astro.build/) and hosted on OVHcloud infrastructure (data centre within the European Union). In its standard configuration, the website does not use cookie-based analytics.

The Controller uses Plausible Analytics (provider: Plausible Insights OÜ, Estonia), a cookieless analytics system. The tool does not use cookies, does not store identifiers in the user's browser, and does not process full IP addresses — it only collects aggregated, anonymous traffic statistics. For this reason, it does not require user consent under the ePrivacy Directive. Details: [plausible.io/privacy-focused-web-analytics](https://plausible.io/privacy-focused-web-analytics).

Should any consent-requiring tracking mechanisms be implemented, this Policy will be updated accordingly and users will be notified.

OVHcloud, as the hosting provider, may process users' IP addresses in server logs for technical and security purposes. Logs are stored exclusively in data centres located within the European Union.

## § 8. Changes to This Privacy Policy {#8-changes-to-this-privacy-policy}

The Controller reserves the right to update this Privacy Policy in the event of changes to data processing practices, applicable law, or the introduction of new services and tools.

Users will be informed of material changes through publication of a new version on the website and, where possible, by email (for newsletter subscribers).

The date of the most recent update is indicated in the document header.

## § 9. Legal Basis — Reference {#9-legal-basis-reference}

This Policy has been prepared in accordance with:

- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)
- Polish Act of 10 May 2018 on the Protection of Personal Data
- Polish Act of 18 July 2002 on Electronic Services
- Polish Telecommunications Law of 16 July 2004 (regarding cookies)