Privacy Policy

Last updated: 22 December 2025

1) Who we are (Data Controller)

[Tree Agency OÜ] (“we”, “us”)
Registered address: [Sepapaja 6, 15551, Tallinn, Estonia]
Company/VAT number: [EE102033690]
Contact for privacy: [luigi@treeagency.eu]
Data Protection Officer (DPO): [Luigi Della Sala + luigi@treeagency.eu]

This policy explains how we collect and use personal data when you browse our website, purchase lessons, attend live sessions, and access recordings/resources.

We comply with the EU/EEA GDPR, UK GDPR (for UK visitors), and applicable national laws. If our service is offered to individuals in the UK, we act as a data controller under UK GDPR as well.

2) What data we collect

a) When you browse our site

• Device and usage data (IP address, browser, OS, pages viewed, timestamps, referrers).
• Cookie/SDK identifiers and similar technologies (see Cookie Policy).

b) When you buy a course

• Identity & contact: name, email, billing address, organisation, country.
• Order data: product purchased, price, currency, discounts, seat count.
• Payment meta-data: transaction ID, status, method (processed by PayPal; we do not store full card details).
• Tax data: VAT country code, VAT ID (if applicable), invoice details.

c) When you attend live sessions

• Meeting/registration data (Zoom): name, email, join/leave time, questions, chat messages, polls.
• Recordings: video/audio of the session, screen shares, and chat content if enabled.

d) When you contact us or subscribe

• Messages, support requests, newsletter preferences.
• Marketing analytics (open/click rates) if you consent to marketing.

e) Optional user-provided content

• Prework files or draft texts shared for exercises.
• Feedback forms, surveys, reviews, testimonials (with your consent if published).

We do not intentionally collect special category data. Please avoid sharing sensitive data in public Q&A or documents.

3) Why we process data and legal bases

Where we rely on legitimate interests, we balance them against your rights and expectations.

4) Who receives your data (processors/third parties)

We use trusted vendors to run our service:

• Payment: PayPal (Europe) S.r.l. acts as an independent controller for your payment details; we receive transaction metadata.
• Video platform: Zoom (processor) to deliver live sessions and host recordings.
• Email & CRM/newsletters: [e.g., Mailchimp] (processor) for confirmations and opt-in marketing.
• Analytics/consent: [e.g., Matomo (self-hosted)], Consent Management Platform (processor) to manage cookie consent.
• Hosting/CDN: [Netsons/CDN] (processor).
• Productivity & storage: [e.g., Google Workspace] (processor) for support and document delivery.

All processors are bound by Data Processing Agreements. We never sell your data.

5) International transfers

Some providers may process data outside the EEA/UK (e.g., the United States). Where they do, we use a valid transfer mechanism, such as:

• The provider’s participation in the EU-US Data Privacy Framework (DPF) and/or UK extension (if applicable), or
• Standard Contractual Clauses (SCCs) plus transfer impact assessments and supplementary safeguards.

Details are available on request.

6) How long we keep data

• Orders, invoices, tax records: typically 6–10 years (local law).
• Accountless purchase & support emails: up to 3 years from last contact.
• Zoom attendance logs & recordings: by default 30–90 days unless we state otherwise or you request deletion where feasible.
• Marketing data: until you withdraw consent or we detect inactivity.
• Cookies: see retention per cookie in the Cookie Policy.

We delete or anonymise data when no longer needed.

7) Your rights

Under GDPR/UK GDPR you can:

• Access your data; rectify inaccuracies; erase data in certain cases;
• Restrict or object to processing (especially where based on legitimate interests);
• Port data you provided;
• Withdraw consent at any time (marketing/cookies);
• Lodge a complaint with your local authority.

To exercise your rights, contact [luigi@treeagency.eu]. We may need to verify your identity.

We do not use automated decision-making that produces legal or similarly significant effects.

8) Security

We implement technical and organisational measures: TLS encryption, access controls, least-privilege, MFA for admin accounts, vendor due diligence and DPAs, incident response procedures, and regular reviews. No method is 100% secure; we will notify authorities and affected users where required by law.

9) Children

Our services are intended for adults and organisations. If you are under the age required by your local law to consent online, please do not use our services without parental/guardian involvement.

10) Changes to this policy

We may update this policy to reflect law or service changes. We’ll post the new version with a new “Last updated” date and, where appropriate, notify you by email or banner.

Cookie Policy

Last updated: 22 December 2025

This Cookie Policy explains how [europeanfunding.net] uses cookies and similar technologies (web beacons, pixels, local storage) on our website.

1) What are cookies?

Cookies are small text files placed on your device to make the site work, remember preferences, and understand how you use our services. Some cookies are essential; others require your consent.

2) How we use cookies (categories)

• Strictly necessary (essential): required for core features like page navigation, security, fraud prevention, and remembering your consent. These do not require consent.
• Preferences (functional): remember choices (language, time zone). Consent-based where required.
• Analytics (performance): help us understand site usage and improve content (e.g., page views, session duration). We use either privacy-friendly analytics (e.g., Matomo self-hosted) or consented tools (e.g., Google Analytics with IP masking).
• Marketing/advertising: measure campaign effectiveness, retargeting on platforms like LinkedIn/Instagram if you consent.
• Third-party integrations: embedded Zoom/PayPal widgets, video players, or social share tools may set their own cookies.

3) Consent and managing cookies

On your first visit, you’ll see a cookie banner from our Consent Management Platform (CMP). You can:

• Accept all, reject non-essential, or customise categories;
• Change your choices anytime via Cookie Settings (link in footer).
  We respect the ePrivacy Directive and applicable national rules. Non-essential cookies load only after consent.

Browser controls let you delete or block cookies; doing so may affect site functionality.

4) Cookies we set (illustrative)

Replace this list with your exact inventory from your CMP.

• cmp_consent (first-party, essential): stores your consent choices; expires 6–12 months.
• session_id (first-party, essential): maintains session state during checkout; expires at end of session.
• language_pref (first-party, functional): remembers language; expires 6 months.
• _analytics_id (first-party, analytics): pseudonymous visitor ID; expires 13 months (or shorter as required locally).
• _ga / _gid (Google Analytics, third-party, analytics – only if used and consented): usage statistics; expires 24 hours–2 years.
• paypal cookies (third-party, essential/functional): payment processing, fraud prevention; varying expiry.
• zoom cookies (third-party, functional): meeting registration/embeds; varying expiry.
• ad_platform_id (third-party, marketing – only if used and consented): ad measurement/retargeting; expiry per provider.

5) Third-party cookies and links

Third-party services (e.g., PayPal, Zoom, social media, analytics and ad platforms) set and control their cookies according to their own policies. We recommend reviewing their notices.

6) Similar technologies

We may use pixels/web beacons in emails to measure open/click rates only if you opted in to marketing. You can opt out anytime using the unsubscribe link or by emailing us.

7) Your rights and contact

For privacy rights related to cookies (access, deletion, withdrawal of consent), see our Privacy Policy. To contact us about cookies, email [luigi@treeagency.eu].

8) Updates

We will update this Cookie Policy when we add or change tools. The CMP’s live cookie list is the authoritative record of active cookies.

Payment & platform specifics (helpful disclosures for your Terms/checkout)

• PayPal acts as an independent controller for payment processing. We receive transaction metadata only.
• Strong Customer Authentication (SCA) may apply under PSD2 for certain transactions.
• Zoom is our processor for live delivery; meeting links are unique per session and should not be shared publicly. Recordings are limited-access and time-bound.