Privacy Policy
1. Who is responsible
The controller of your personal data is Nymphalis s. r. o., Ulica Veterná 8508/45, 917 01 Trnava, Slovakia, company ID 56 689 331. Contact for anything about your data: hello@firstbootstudio.com.
2. What we collect, why, and on what legal basis
| What | Why | Legal basis |
|---|---|---|
| Name, email address, billing address, what you bought, payment status and reference | To complete your order and send your access link | Contract (Art. 6(1)(b) GDPR) |
| Your confirmation of the terms and of immediate access: time, terms version, IP address | To prove that you gave the consent required for digital content | Legal obligation and legitimate interest in proving consent (Art. 6(1)(c) and (f)) |
| Invoices and payment records | Accounting and tax duties | Legal obligation (Art. 6(1)(c)) |
| Company name, address, company ID, tax ID and VAT ID (if you buy for a company), and the result of the VAT ID check in VIES | Issuing a correct invoice and applying reverse charge | Legal obligation (Art. 6(1)(c)) |
| Device identifier cookie, browser type, approximate country and time of each access to the course | To enforce the device limit and detect sharing of a personal license | Legitimate interest in protecting our work (Art. 6(1)(f)) |
| Your messages to us | To answer you | Contract or legitimate interest (Art. 6(1)(b) and (f)) |
| Technical server logs (IP address, time, page) | Security and fault finding | Legitimate interest (Art. 6(1)(f)) |
We do not use your data for advertising, we do not sell it and we do not profile you. The device limit is applied automatically. It has no legal effect beyond blocking a third device, and you can ask a person to review it by writing to us.
3. Who receives your data
- Stripe Payments Europe, Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) process your payment. They are independent controllers of the payment data and have their own privacy policies.
- Cloudflare, Inc. hosts the website and course files and stores the access records (data centers worldwide, with an EU-US transfer framework and standard contractual clauses).
- Resend (Resend, Inc.) sends our emails to you.
- SuperFaktúra (SuperFaktúra, s.r.o., Bratislava, Slovakia) issues and sends invoices for us.
- The European Commission's VIES system receives your VAT ID when we verify it.
- Our accountant and tax authorities receive order records where the law requires.
Where data goes outside the European Economic Area, we rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
4. How long we keep it
- Order, invoice and payment records: 10 years, as Slovak accounting law requires.
- Proof of consent: for as long as claims from the contract can still be made, up to 10 years together with the order record.
- Access records for the device limit: while your license exists, then up to 12 months.
- Technical logs at Cloudflare: a few days.
- Messages: as long as they are useful for support, then deleted.
5. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict its use, to object to it, or to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time. Write to hello@firstbootstudio.com and we will answer within one month.
You can complain to a data protection authority. For us that is the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk). You may also complain to the authority in the country where you live.
6. Cookies
See the Cookie Policy. We use only what the shop needs, plus optional statistics only if you agree.
7. Children
The course is not aimed at children under 16, and we do not knowingly collect their data.
8. Changes
When this policy changes in a way that matters, we update the version above and the date.