1. Controller and contact
Egor Maraev, a sole trader established in Portugal and trading as Robot & Sons, is the controller of personal data described in this policy.
Legal name: Egor Maraev
Tax identification number (NIF): 309 650 461
Business address: Rua Maestro Lacerda, 1-1, 2765-239 Estoril, Portugal
Privacy contact: e@robotandsons.tech
2. Data we collect
Depending on how you interact with us, we may collect:
- Identity and contact data: name, email address, organisation and any details you provide in an enquiry;
- Purchase and billing data: course purchased, price, currency, payment status, Stripe customer or payment references, billing name and address, and limited card information such as brand and last four digits. Stripe processes full payment credentials; we do not receive them;
- Course and support data: enrolment, access status, questions, messages, feedback, attendance and materials you choose to share in a Q&A or support request;
- Technical data: IP address, browser, device, timestamps, requested pages, security logs and necessary cookie information; and
- Marketing preferences: only where you separately choose to receive promotional communications.
Please do not share sensitive personal data, client secrets or confidential production data in course exercises or live sessions unless it is genuinely necessary and you are authorised to do so.
3. Why we use data and our legal bases
- To form and perform a contract: take payment, confirm an order, deliver course access, organise Q&A sessions and provide support;
- To comply with legal obligations: maintain tax and accounting records, respond to lawful requests, handle consumer rights and prevent unlawful transactions;
- For legitimate interests: secure and troubleshoot the website, prevent fraud, improve the course and respond to business enquiries, provided those interests do not override your rights; and
- With consent: send optional marketing or use non-essential cookies, where applicable. You may withdraw consent at any time.
We do not use your data for solely automated decisions that produce legal or similarly significant effects.
4. Payment processing
Payments are handled through Stripe Checkout. Stripe acts as an independent controller or processor for parts of the transaction and may collect identity, contact, device and payment data to process payments, prevent fraud and comply with financial law. See Stripe's Privacy Policy for details.
5. Who receives data
We disclose data only where necessary to:
- payment providers, including Stripe and relevant banks or payment networks;
- hosting, email, course delivery, video conferencing and technical service providers acting under appropriate terms;
- professional advisers such as accountants or lawyers where necessary; and
- public authorities, courts or regulators where disclosure is legally required.
We do not sell or rent personal data. If a provider processes data outside the European Economic Area, we rely on an adequacy decision, standard contractual clauses or another lawful transfer safeguard where required.
6. Retention
We keep personal data only for as long as needed for the purpose collected. Purchase, invoice and accounting records are generally retained for 10 years to meet Portuguese tax and accounting requirements. Contract and support records may be kept for the period needed to provide the service, resolve disputes and establish legal claims. Security logs are kept for a shorter period unless an incident requires investigation. Marketing data is kept until you withdraw consent or object.
When data is no longer required, we delete or anonymise it unless the law requires continued retention.
8. Security
We apply reasonable technical and organisational measures designed to protect data, including access controls, secure connections, minimisation and restricted access to payment information. No internet service can promise absolute security. If a personal data breach creates a legal notification duty, we will notify the competent authority and affected people as required.
9. Your rights
Under the GDPR and applicable Portuguese law, you may have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- request deletion or restriction of processing;
- receive certain data in a portable format;
- object to processing based on legitimate interests or to direct marketing;
- withdraw consent at any time, without affecting earlier lawful processing; and
- complain to a data protection authority.
Send requests to e@robotandsons.tech. We may need to verify your identity. We normally respond within one month, subject to extensions permitted by law.
Our lead supervisory authority is Portugal's Comissão Nacional de Proteção de Dados (CNPD). You may also contact the authority in the EEA country where you live or work.
10. Children
The website and course are intended for adults and are not directed to children. We do not knowingly collect personal data from children through this service.
11. Changes and contact
We may update this policy when our services, providers or legal duties change. We will publish the new version and effective date here and provide additional notice if a change materially affects your rights.
Questions or requests can be sent to e@robotandsons.tech.