Candle Making Course
Legal

Privacy Policy

Last Updated: 02.10.2026

1. Controller (Data Controller)

Responsible for processing your personal data:

Zoriana-Sofiia Hulka
Wasagasse 23, 1090 Wien, Austria
Phone: +43 676 410 5406
Email: hello@candlemakingcourse.com

2. What this Privacy Policy covers

This Privacy Policy explains how we process personal data when you:

  • visit candlemakingcourse.com and related subdomains (the “Website”),
  • create an account, purchase, and access our online course via our own backend,
  • receive transactional or marketing emails from us,
  • interact with our marketing and analytics technologies (only after consent where required).

3. Categories of personal data we may process

Depending on how you use the Website and course, we may process:

a) Website / device data (log data)

  • IP address, date/time, accessed pages, referrer URL, browser type/version, device information, and similar technical data.

b) Newsletter data

  • Email address (and if provided: name), consent timestamp, subscription status, and email interaction data (e.g., opens/clicks).

c) Course purchase & access data (own platform)

  • Account data (e.g., email address, login identifiers),
  • purchase and transaction data (e.g., product purchased, payment status, country, timestamps, order IDs),
  • course access data (e.g., enrollment status, access rights).
  • Payment card and payment method data are processed exclusively by our payment provider (Paddle). We do not store full payment card details.

d) Order/account data stored in our backend database

We store “accounts” and “orders” in our database. This may include identifiers (e.g., email address or user ID), purchase status, order IDs, product, timestamps, and related metadata necessary for providing access and administration.

4. Purposes and legal bases (GDPR Art. 6)

We process personal data for the following purposes and legal bases:

a) Providing the Website securely and reliably

Purpose: website delivery, IT security, abuse prevention, troubleshooting.
Legal basis: legitimate interests (Art. 6(1)(f)).

b) Providing the course, access, and customer administration

Purpose: purchase processing via Paddle, course access, account administration, technical operations.

Legal basis: contract performance (Art. 6(1)(b)).

c) Accounting and legal obligations

Purpose: bookkeeping, tax, compliance, handling legal claims.
Legal basis: legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)).

d) Newsletter marketing

Purpose: sending newsletters and marketing emails.
Legal basis: consent (Art. 6(1)(a)).
You can withdraw consent at any time (see Section 10).

e) Analytics and advertising (Google Analytics, PostHog, Google Ads, Meta Pixel/CAPI, TikTok Pixel/Events API)

Purpose: measuring website performance, conversion attribution, improving campaigns, remarketing/audience building.
Legal basis: consent (Art. 6(1)(a)) where required for cookies/tracking technologies.
We load these tools only after consent via our cookie consent settings.

5. Cookies, consent management, and your choices

We use our own cookie consent banner that lets you accept or reject optional cookies and tracking. Your choice is stored in the essential cookie cmc_consent (lifetime 6 months).

  • Essential cookies may be set without consent because they are necessary for the Website to function.
  • Analytics and marketing cookies/tags (Google Analytics, PostHog, Google Ads, Meta Pixel, Conversions API, TikTok Pixel, TikTok Events API, Google Tag Manager used for these tags) are activated only after your consent.
    You can change or withdraw your consent at any time via “Cookie Settings” on the Website.

6. Services and recipients (processors / third parties)

We use the following categories of service providers to operate the Website and deliver the course:

a) Website and backend hosting (Vercel)

We host the public Website and our backend infrastructure (course logic, APIs, access control) on Vercel. Vercel processes technical data such as IP addresses, server logs and request metadata to provide hosting, security, and reliability.

b) Database (Supabase – region us-east-2)

We store account and order-related data in Supabase. Supabase acts as a processor and provides database hosting and security services.

c) Payments & checkout (Paddle)

We use Paddle as our payment provider and merchant of record. Paddle processes payment, billing, tax, and transaction data. We do not receive or store full payment card details. Paddle acts as an independent controller for payment processing under its own privacy policy.

d) Transactional emails and newsletter (Resend)

We use Resend to send transactional emails such as account confirmations, purchase confirmations, and access-related messages, as well as our newsletter and marketing emails (only based on your consent). Newsletter subscriptions are managed in our own database (see b). Resend processes email addresses and message metadata on our behalf.

e) Video hosting (Cloudflare Stream)

We use Cloudflare Stream to host and deliver course videos. Cloudflare may process IP addresses and technical playback data to provide secure and performant video delivery.

f) Error monitoring (Sentry)

  • Provider: Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
  • Purpose: detecting, analysing and fixing technical errors and measuring the stability and loading times of the Website and course platform (operational and data security, quality assurance).
  • Data processed (errors): in the event of an error, the technical error message including the call path through the program code, the page called up, the time, browser type and version and operating system.
  • Data processed (performance): for page views and server requests, performance data such as the page or endpoint called, the duration of individual processing steps, the time, browser and operating system.
  • Data minimisation: the automatic transmission of additional personal data is disabled. Form contents, request bodies, headers and cookies are not transmitted. Reports from the browser are routed via our own domain, so Sentry does not receive your IP address.
  • Cookies: no cookies are set for error monitoring.
  • Session replay (only after consent to analytics): if you consent to analytics cookies, Sentry may record a sample of sessions (and sessions in which an error occurs) as a replay of the page so we can reproduce errors. Text and form inputs are masked and media is blocked by default. Without your consent, no session replays are created.
  • Place of processing: Sentry's EU data region (data centres in Germany).
  • Legal basis: legitimate interests (Art. 6(1)(f)) in the secure and error-free operation of the Website; for session replay, consent (Art. 6(1)(a)).
  • Retention: at most 90 days.
  • Sentry acts as a processor pursuant to Art. 28 GDPR and does not use the data for its own purposes.

g) Product analytics (PostHog)

We use PostHog (PostHog Inc., USA; data stored in the EU, Frankfurt) to understand how visitors use the Website and course platform. With your consent to analytics, PostHog sets cookies/local storage (ph_*) to recognise you across visits. Without consent, PostHog only performs cookieless, anonymous counting: no cookies are set or read and no persistent identifiers are stored on your device. PostHog acts as a processor pursuant to Art. 28 GDPR.

h) Analytics and advertising partners (only after consent)

  • Google Analytics (GA4) for website analytics.
  • Google Ads for conversion tracking and campaign measurement/remarketing.
  • Meta Pixel and Meta Conversions API for conversion measurement and campaign optimization.
  • TikTok Pixel and TikTok Events API for conversion measurement and campaign optimization.

Server-side conversion reports (Meta Conversions API, TikTok Events API, Google Analytics Measurement Protocol) for purchases and sign-ups are only sent if you consented to the corresponding category in the cookie banner.

7. International data transfers (outside the EEA)

Some providers listed above (including Supabase, Vercel, Paddle, Resend, and Cloudflare) may process data in the United States.
Where required, we rely on appropriate safeguards such as:

  • Standard Contractual Clauses (SCCs) and/or
  • adequacy mechanisms available for specific providers (where applicable),
    plus additional technical/organizational measures as appropriate.

Important note: Our database is hosted in the United States (Supabase region us-east-2), meaning account/order data is stored and processed there.

8. How long we keep your data (retention)

We keep personal data only as long as necessary for the purposes described:

  • Website/server logs: typically for a short period for security and troubleshooting (unless needed longer for incident investigation).
  • Newsletter data: until you unsubscribe or we no longer need it for the newsletter purpose.
  • Course access/account/order data: for as long as needed to provide the course and manage the customer relationship.
  • Accounting/legal records: for the retention periods required under applicable law.

9. Security

We apply technical and organizational measures to protect personal data (e.g., access controls, principle of least privilege, encryption where available, and vendor DPAs where applicable). No method of transmission or storage is 100% secure, but we work to protect your data to the best of our ability.

10. Your rights (GDPR)

If you are in the EU/EEA, you have the following rights, subject to legal requirements:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)
  • Right to withdraw consent at any time (Art. 7(3)) — this does not affect processing done before withdrawal.

To exercise your rights, contact us at: hello@candlemakingcourse.com

11. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In Austria, this is:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Austria

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing, tools, or legal requirements. The “Last updated” date at the top shows the latest version.

Links to vendor legal pages

Vercel DPA: https://vercel.com/legal/dpa

Supabase DPA: https://supabase.com/legal/dpa

Paddle Privacy & DPA: https://www.paddle.com/legal/privacy

Paddle DPA: https://www.paddle.com/legal/data-processing-addendum

Resend Privacy: https://resend.com/legal/privacy-policy

Cloudflare Privacy: https://www.cloudflare.com/privacypolicy/

Cloudflare DPA: https://www.cloudflare.com/cloudflare-customer-dpa/

Sentry Privacy: https://sentry.io/privacy/

Sentry DPA: https://sentry.io/legal/dpa/

PostHog Privacy: https://posthog.com/privacy

PostHog DPA: https://posthog.com/dpa

TikTok Business Products Terms: https://ads.tiktok.com/i18n/official/policy/business-products-terms

Meta Business Tools Terms: https://www.facebook.com/legal/technology_terms

Google Measurement Controller terms (re: GA sharing settings): https://support.google.com/analytics/answer/9012600

Austrian DSB contact page: https://dsb.gv.at/ueber-die-datenschutzbehoerde/kontakt