Privacy Policy

Last updated: 2 September 2026

This policy explains what personal data Sunny Valley Studio collects when you visit courses.sunnyvalleystudio.com or enrol in a course, why we collect it, how long we keep it, and what rights you have. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR), which applies because we are established in Poland.

1. Who is responsible for your data

The data controller is:

We have not appointed a Data Protection Officer, as we are not required to. Privacy questions and requests should go to the email address above.

2. What we collect, why, and on what legal basis

Name and email address

We use this to create your account, give you access to courses you have bought, and provide support.

Legal basis: performance of a contract, GDPR Article 6(1)(b).

Record of what you bought and when

We use this to give you access to the right courses, handle refunds and support, and meet our own accounting obligations. Your billing address and payment details are collected by Teachable as seller of record (see section 4) and are not held by us.

Legal basis: contract, Article 6(1)(b); legal obligation, Article 6(1)(c).

Course progress and completion

We use this to show you where you left off and to issue certificates where offered.

Legal basis: contract, Article 6(1)(b).

Support messages and comments you post

We use these to answer you and to run the course community.

Legal basis: contract, Article 6(1)(b); legitimate interest, Article 6(1)(f).

Marketing emails (newsletter, launch announcements)

We use your email address to tell you about new courses and content.

Legal basis: your consent, Article 6(1)(a). You may withdraw it at any time using the unsubscribe link in any email.

Aggregate, non-identifying usage measurement

We use this to understand roughly how many people visit which pages.

Legal basis: legitimate interest, Article 6(1)(f). See section 3: we do not store analytics identifiers on your device.

You are never obliged to give us personal data, but we cannot deliver a course you have bought without an account, and we cannot email you without an email address.

3. Cookies and similar technologies

We do not set analytics or advertising cookies on your device.

Strictly necessary cookies

Our course platform, Teachable, sets cookies that are required for the site to work — keeping you logged in, remembering the contents of your cart, and protecting the checkout against fraud. These cannot be switched off without breaking the site, and under the ePrivacy rules they do not require your consent.

Our analytics

We use Google Analytics 4 (property G-0LKLX03PS4) to count page visits. It is configured with Google Consent Mode set to "denied" by default and never granted. In practice this means Google Analytics does not write cookies or store any identifier on your device. It sends us anonymous, cookieless signals only, which we use to see which pages are read. We cannot use this to identify you or to follow you between visits or across other websites.

Tracking run by Teachable, which we do not control

Our courses are hosted on Teachable, and Teachable loads its own measurement tools on these pages for its own purposes as the platform operator. These include a separate Google Analytics property (G-SL8LSCXHSV), a Google Tag Manager container, Heap and Segment analytics, and affiliate tracking cookies. We do not control this collection, cannot switch it off, and do not receive the data. Teachable's own privacy policy governs it: teachable.com/privacy-policy.

Teachable displays its own cookie consent notice on checkout pages to visitors who are not signed in. We cannot customise or extend that notice to other pages.

You can block or delete cookies at any time in your browser settings. Blocking strictly necessary cookies will prevent you from logging in or completing a purchase.

4. Who else receives your data

We do not sell, rent, or trade your personal data. We share it only with the service providers we need in order to run the school:

  • Teachable (Teachable, Inc., 470 Park Ave South, New York, USA) — acts in two distinct roles. As our processor it hosts the school, your account, your course progress and platform emails, under the data processing agreement at teachable.com/dpa. As an independent controller it is the seller of record for your purchase: Teachable collects your billing name, address, country and any VAT number, handles your card payment, determines and remits VAT, and issues your invoice. We never see or store your card details. Teachable's handling of that data is governed by its own privacy policy.
  • Google (Google Ireland Ltd / Google LLC) — cookieless website measurement, as described above.
  • [[ EMAIL PROVIDER — e.g. MailerLite — delete this line if you do not yet send email ]] — sending newsletters and course announcements.

We may also disclose data where we are legally required to do so.

5. Transfers outside the European Economic Area

Some of the providers above are based in the United States, so your data may be transferred there. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, together with the safeguards set out in each provider's data processing agreement. You may request a copy of the safeguards that apply by writing to us.

6. How long we keep your data

  • Account and course access data — for as long as your account exists, and for [[ e.g. 12 months ]] after you ask us to close it.
  • Records of your purchase that we hold — for as long as our own accounting and tax obligations require. Your invoice is issued and retained by Teachable as seller of record, under their retention rules, not ours.
  • Newsletter subscription — until you unsubscribe.
  • Support correspondence — [[ e.g. 24 months ]] from the last message.

7. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you, and receive a copy of it;
  • have inaccurate data corrected;
  • have your data erased, where we have no continuing legal basis to keep it;
  • restrict how we use your data while a dispute about it is resolved;
  • receive your data in a portable, machine-readable format, or have it sent to another provider;
  • object to processing we carry out on the basis of legitimate interest;
  • withdraw consent at any time, where our processing is based on consent — withdrawing it does not affect anything we did lawfully before you withdrew it.

To exercise any of these, contact us here. We will respond within one month.

If you believe we have handled your data unlawfully, you may complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. If you live in another EEA country, you may complain to your own national authority instead.

8. Automated decision-making

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

9. Children

Our courses are intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make a change that materially affects how we use your data, we will tell registered students by email rather than relying on you to re-read this page.