Privacy Policy
This policy explains what personal data Still Brewing collects when you use stillbrewing.school, why we collect it, who we share it with, and the rights you have over it.
1. Who is responsible for your data
The data controller for this website is Still Brewing, an unincorporated business operating from Kyiv, Ukraine.
You can reach us about anything in this policy at contact@stillbrewing.school.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.
2. What we collect and why
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Name, email address and anything else you type into our enquiry or level-check forms | To reply to you, arrange a free call, and assess your English level | Article 6(1)(b) — steps taken at your request before entering a contract | 24 months after our last contact |
| Email correspondence | To answer your questions and keep a record of what was agreed | Article 6(1)(b) and 6(1)(f) — our legitimate interest in keeping business records | 24 months after our last contact |
| Booking details when you schedule a call | To hold the appointment and send you the joining link | Article 6(1)(b) | 24 months |
| Analytics data — pages viewed, approximate location (country/city level), device and browser, referring site | To understand which pages are useful and improve the site | Article 6(1)(a) — your consent, given through the cookie banner. No analytics cookies are set unless you accept. | 14 months |
| Your cookie choice itself | To remember what you agreed to, and to prove it if asked | Article 6(1)(c) — our legal obligation to demonstrate consent | 12 months |
| Payment records — amount, currency, date, transaction reference, the last four digits of your card, and the name and email you gave at checkout | To take payment for your lessons, run recurring 4-week billing, issue refunds and keep our accounts | Article 6(1)(b) — performance of our contract with you — and Article 6(1)(c) for the accounting records | 3 years, per Ukrainian tax and accounting law |
| Server logs, including IP address | Security, abuse prevention, and keeping the site online | Article 6(1)(f) — legitimate interest in a secure service | Short-term, per our hosting provider’s defaults |
We do not ask for special category data (health, beliefs, and so on). Please do not send it to us in a form or an email.
3. Who we share it with
We do not sell your data and we do not share it for advertising. We use the following providers, who process data on our instructions:
- Google Ireland Ltd / Google LLC — Google Analytics 4, for website statistics. Only ever with your consent. We also use Google for scheduling and running the free introductory calls.
- Usercentrics A/S (Cookiebot) — the consent banner and the record of your cookie choice.
- Cloudflare, Inc. — hosting and serving the site, and keeping short-term security logs. Our domain is registered through Vercel Inc., which handles the domain and its DNS.
- Google Workspace — carrying email between you and us.
- WayForPay — taking card payments and handling recurring billing. They are the ones who receive your card details, as a payment processor in their own right, not on our instructions.
We may also disclose data where we are legally required to, for example in response to a valid order from a public authority.
Payments for lessons are taken through WayForPay (LLC “WAYFORPAY”, Ukraine), our payment gateway. Your card details are entered on WayForPay’s own secure page and go straight to them — we never see, receive or store your card number. WayForPay passes back only what we need to recognise the payment: the amount, the currency, whether it succeeded, a transaction reference and the last four digits of the card. Where you set up a recurring 4-week payment, WayForPay also holds the token that lets the next charge run. We keep our payment records for the period Ukrainian tax and accounting law requires, currently three years.
4. Transfers outside the EEA
Some of the providers above are based in, or store data in, the United States. Where data leaves the European Economic Area, it is protected by the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
We keep this to a minimum: our fonts are self-hosted rather than loaded from Google Fonts, so simply reading this site does not send your IP address to a font CDN.
5. Cookies
Nothing but strictly necessary storage is placed on your device until you choose. Analytics runs in a consent-aware mode: before you accept, Google Analytics writes no cookies and no identifiers at all.
The full, automatically maintained list of cookies is on our Cookie Policy page, where you can also change or withdraw your choice at any time.
6. Your rights
Under the GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where we have no overriding reason to keep it;
- ask us to restrict how we use it;
- receive it in a portable, machine-readable format;
- object to processing we base on legitimate interests;
- withdraw your consent at any time — this is as easy as giving it, via the link, and withdrawing does not affect anything done beforehand.
Email contact@stillbrewing.school and we will respond within one month.
If you are unhappy with how we have handled your data, you can complain to your national data protection authority. In Ukraine, where we are based, that is the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman), who supervises personal data protection. If you are in the EEA, you may instead complain to the supervisory authority where you live or work.
7. Children
This site is aimed at adults. We do not knowingly collect data from children under 16. If you believe a child has sent us personal data, tell us and we will delete it.
8. Changes to this policy
If we change how we use your data, we will update this page and revise the date at the top. Where the change is significant, we will ask for your consent again.