Privacy Policy

How we collect, use, store and share personal information when you visit memory.education, contact us or take part in our live training, and which rights you have.

1. What This Policy Covers
2. What Information We Collect
3. How We Use Information
4. Legal Bases
5. Cookies and Similar Technologies
6. How We Share Information
7. International Transfers
8. Retention
9. Security
10. Minors
11. Your Rights
12. Third-Party Sites
13. Changes
14. Contact

The memory.education website and the Memory Development Center brand are operated by Bohdan Rudenko, Großenhainer Str. 98, 01127 Dresden, Germany (“we”, “us”, “our”). You can contact us at info@memory.education.

This summary gives the key points. The numbered sections below contain the full text, and they govern.

What personal information do we process? Contact details, the content of your enquiries and questionnaires, billing records, files you send us, testimonials or reader questions you permit us to publish, comments you post on Journal articles, and technical information about your visit to the website.

Do we process health information? We do not request it. Please do not include medical records or other health information in forms, messages, or attachments.

Why do we process it? To answer your requests, arrange and deliver the services you book, issue invoices, keep backup copies of business records, run the website, and meet legal obligations. Each purpose has its own legal basis under the GDPR.

Do we use cookies and tracking? The website offers consent choices for statistics and marketing, and separate permission to load YouTube videos. Optional tracking requires your prior consent, which you can give, refuse or change in Cookie settings.

Do we share your information? With service providers that host the website, deliver form submissions and email, store backups, run live video sessions, host videos, and provide the website’s analytics and measurement tools. We do not sell personal information in the ordinary meaning of that phrase.

Is your information transferred outside the EEA? Some providers, including Zoom, Google and Backblaze, may process data outside the EEA. Their published terms provide for Standard Contractual Clauses for relevant transfers.

How long do we keep it? As long as its purpose requires, and longer only where a specific service, statutory obligation or legal need requires it. Invoices are generally retained for eight years.

Can minors take part? Group training is for people aged 16 or older. For a participant under 18, a parent or legal guardian books the place.

What are your rights? Access, correction, deletion, restriction, portability, objection, and withdrawal of consent, as well as a complaint to a data-protection supervisory authority. To exercise them, write to info@memory.education.

This Privacy Policy explains how we collect, use, store, and share personal information when you:

• visit memory.education,
• contact us,
• submit a request, questionnaire, or application through our forms, including requests to be told about a future course or to receive materials,
• inquire about coaching or corporate services,
• complete a private coaching questionnaire sent to you by email,
• provide a voluntary testimonial about your experience,
• submit a reader question that you separately agree may be published in the Journal,
• post a comment on a Journal article,
• participate in live online services that we actually provide.

We may collect the following categories of information:

• identity and contact data, such as first name, last name, age where requested for training suitability or minor-participant arrangements, email address, phone number, messenger handle, city, country, and postal billing address;
• inquiry and application data, such as comments, occupation, goals, questionnaire answers, and other information you choose to send us;
• minor-related contracting data where a parent or legal guardian contracts for a minor participant;
• billing and transaction records related to invoices, bank transfer confirmations, payment status, and accounting;
• files or attachments you choose to send to us;
• testimonial content, including any name, image, voice or video you provide for that purpose;
• reader questions and identifying credits covered by a separate publication permission;
• comments on Journal articles, with the name you give for publication;
• technical and usage data, such as IP address, browser information, device information, pages visited, and information collected through cookies and similar technologies.

We do not collect payment card data on the site. Individual coaching is arranged through manual approval, invoicing, and bank transfer. Payment methods for another service are communicated before booking. If payment methods change, this policy will be updated accordingly.

We do not request health information for our coaching questionnaires or services. Please do not include medical records or other health information in forms, messages, or attachments.

We normally receive inquiry, application and coaching information directly from you. For a minor participant, a parent or guardian may provide participation details. In corporate enquiries or training arrangements, a company contact may provide necessary information about the people concerned. Technical information is collected through website and communication-service use. Where someone else provides your information, we provide the applicable privacy information to you as required.

Required fields are marked on the relevant form. We need enough contact information to answer an initial enquiry; billing details and more detailed suitability or scheduling information are relevant at later booking stages. Phone and messenger details are optional; we use them only for urgent session logistics, such as reminders, a late connection or connection help.

Files and attachments are used to understand and answer the request or deliver the agreed service. Send only what is relevant, and avoid unnecessary information about other people. A detailed coaching questionnaire is sent privately at a later stage; you do not need to complete it to make an initial enquiry. Where necessary service information is missing, we may be unable to assess or arrange that service.

We use personal information to:

• respond to messages, questions, and requests, including telling you about a future course or sending materials, if you asked for this;
• review whether we can help with coaching or other services;
• schedule, deliver, and administer live online services;
• communicate about logistics, reminders, and service-related matters;
• issue invoices, track payment status, and maintain accounting records;
• maintain necessary backup copies for recovery and continuity of business records;
• prepare and administer business and contractual documents, using only necessary information;
• manage voluntary testimonials and publish them where permission covers the relevant use;
• publish submitted reader questions and agreed identifying details where you have expressly permitted that use;
• moderate comments on Journal articles and publish them with the name you give;
• operate, secure, and improve the website;
• comply with legal obligations and defend legal claims when necessary.

The legal basis depends on the purpose of the processing:

• Assessing a coaching or training application, including a private questionnaire, at your request: Steps before entering into a contract, Article 6(1)(b) GDPR.
• Scheduling, delivering, and administering an agreed service, including necessary service messages: Performance of a contract, Article 6(1)(b) GDPR.
• Necessary information about a child participant where a parent or guardian is the contracting client: Legitimate interests, Article 6(1)(f) GDPR: assessing suitability and organising the child’s participation in the requested training, taking the child’s interests and rights into account. Necessary contract and billing information about the contracting parent or guardian is processed under Article 6(1)(b), and Article 6(1)(c) where required by law.
• Answering general questions that are not a request to enter into a contract, including requests to be told about a future course or to receive materials: Legitimate interests, Article 6(1)(f) GDPR: answering the specific correspondence and providing requested information about our educational work.
• Managing corporate enquiries and necessary contact information about people acting for a company: Legitimate interests, Article 6(1)(f) GDPR: communicating with the company and arranging the requested training; the contractual basis applies where you are personally the contracting client.
• Preparing and administering invoices and payments: Performance of a contract, Article 6(1)(b) GDPR; legal obligations, Article 6(1)(c) GDPR, where accounting or tax law requires processing or retention.
• Delivering the website and preventing technical abuse: Legitimate interests, Article 6(1)(f) GDPR: providing a functioning website and protecting its security.
• Maintaining necessary backup copies of business records: Legitimate interests, Article 6(1)(f) GDPR: protecting the availability and recoverability of records needed for our services and business administration.
• Optional analytics or advertising-related tracking: Consent, Article 6(1)(a) GDPR; consent to non-exempt storage or access on your device is also required under Section 25(1) TDDDG.
• Optional third-party video loading and tracking where consent is required: Consent, Article 6(1)(a) GDPR; consent for non-exempt storage or access on your device under Section 25(1) TDDDG.
• Publishing a voluntary testimonial containing your personal data: Consent, Article 6(1)(a) GDPR, for the publication and channels covered by your permission.
• Publishing a submitted reader question with identifying details: Consent, Article 6(1)(a) GDPR, for the question and identifying credit covered by your permission.
• Moderating a comment you post on a Journal article and publishing it with the name you give: Legitimate interests, Article 6(1)(f) GDPR: running a moderated public comment section on our articles. You choose the name shown and can ask for removal at any time.
• Preparing and administering business and contractual documents: Legitimate interests, Article 6(1)(f) GDPR: maintaining clear contractual arrangements and administering the business, limited to necessary information.
• Establishing, exercising, or defending legal claims: Legitimate interests, Article 6(1)(f) GDPR: protecting and enforcing legal rights.

If you ask us to tell you about a future course or to send you materials, we use your email only for that request. We do not use it for other promotion without your separate consent. You can contact info@memory.education to ask us to stop following up on a request or to exercise your data rights. Where consent is given for a specific use, it can be withdrawn at that address.

An inquiry or application is not consent to unrelated marketing or tracking. This notice explains processing; it does not itself obtain consent.

We review applications manually. We do not make booking or training-eligibility decisions solely through automated processing that produces legal or similarly significant effects for you.

The website stores your consent choice in your browser. The statistics category covers Google Analytics and Microsoft Clarity; the marketing category covers Meta Pixel. Clarity can analyse website interactions and provide session playback; this is distinct from a recording of a coaching call. These tools can process technical information about your visit and use cookies or similar technologies. Tag Manager and statistics are currently disabled while their configuration is updated; Meta Pixel is paused.

Optional tracking requires prior consent. Google Tag Manager itself loads only after you consent to at least one optional category and its configuration is enabled. Reopen Cookie settings to review or withdraw your choices. YouTube players load only after you separately choose to load and play a video. See the Cookie Policy for the identified tools and available controls.

Earlier versions of this website used external chat and consent-management services. Their providers may still hold records from that use, such as conversations, visitor records or consent logs. To ask about records relating to you or exercise your rights, contact info@memory.education.

We may share information with service providers that help us operate the website and administer services, such as:

• website hosting and infrastructure providers,
• analytics and tag-management providers,
• communication and support providers,
• live-session or video-conferencing providers,
• accounting, invoicing, and banking-related service providers,
• legal, tax, or regulatory advisers where required.

The identified services include:

• Amazon Web Services (AWS Amplify Hosting and CloudFront) for website hosting and delivery. Our hosting application is configured in the Frankfurt region.
• Bootstrap Studio Smart Forms, operated by Zine EOOD, Bulgaria, for website form submissions. Its provider states that submissions are transmitted through Postmark for email delivery and that submitter IP addresses are retained for 30 days for spam and abuse prevention.

• Google Workspace, including Gmail for business correspondence and Google Forms for the private coaching questionnaire sent after an initial inquiry. Google publishes its customer-data processing terms in the Cloud Data Processing Addendum.

• Backblaze B2 Cloud Storage, provided by Backblaze, Inc., for backup copies of our business records, such as client files (agreements, questionnaire answers and lesson notes) and invoices. The backups are stored in Backblaze’s EU Central region in the Netherlands; Section 7 explains international transfers. Backblaze describes its handling of files and account information in its Privacy Notice and Data Processing Agreement.

• Zoom for live coaching and group training. Participation transmits information such as your display name, connection details, and the audio, video or shared content you choose to provide. We do not record live sessions, provide session replays, or use Zoom’s automatic transcripts or AI meeting summaries. Zoom’s published business terms describe it as a processor for customer personal data, with specified separate purposes for which it acts as a controller; see its Global Data Processing Addendum.

• YouTube for public videos, including testimonials uploaded to our channel and displayed or linked on the website. In the EEA, its service provider is Google Ireland Limited, Ireland. The published YouTube Data Processing Terms cover applicable processing of commercial uploaded audiovisual content. Google also processes viewer and platform-use information under its Privacy Policy. Connecting to a video player can disclose technical information such as an IP address and browser details.

• Google Tag Manager, Google Analytics, Microsoft Clarity and Meta Pixel for the website functions described above and in the Cookie Policy, when enabled and with the applicable consent.

Messenger details submitted through a form are handled as part of the form submission. If you communicate with us through a messenger, that service also handles message content and contact details under its own terms. Email is available for initial enquiries.

These services do not all have the same role. Depending on the service and processing purpose, a provider may act on our instructions or be responsible for its own processing. Information about international transfers is addressed below.

We may also disclose information:

• when required by law or legal process;
• to protect rights, safety, property, or users;
• in connection with a business reorganization, if one occurs.

We do not sell personal information in the ordinary meaning of that phrase.

Publication of a testimonial is separate from providing coaching or completing an application. Specific publication permission must cover the particular testimonial, where it will appear and any identifying credit. It is voluntary and has no effect on your service. Sending a testimonial does not by itself establish permission for website or YouTube publication. A publicly available testimonial may be seen or copied by other people. You can withdraw publication consent by contacting info@memory.education; withdrawal does not affect the lawfulness of consent-based processing before withdrawal. Consent-based publication under our control must then be removed; we cannot guarantee removal of copies made independently by others. Sending a private message or questionnaire is not, by itself, permission to publish it as a testimonial.

When we ask for permission to publish a video testimonial, we name the particular video, our public YouTube channel, the intended website use and your chosen name credit. Permission for those channels does not cover other platforms or advertising. Omitting a written name does not make a recognisable face or voice anonymous.

We publish identifying details with a submitted reader question in the Journal only with your explicit permission for that publication. Sending a question does not itself grant that permission. You can withdraw publication consent by contacting info@memory.education; withdrawal does not affect the lawfulness of earlier consent-based processing.

If a comment you post on a Journal article is approved after moderation, it is published with the name you entered. The e-mail address from the e-mail field is not published. An attachment is published only when it belongs with the comment, for example an illustration; otherwise we read it for moderation only. A published comment can be seen and copied by other people. You can ask us at any time to remove the comment or the name by contacting info@memory.education.

Some providers we use process data outside Germany or the EEA. A European hosting or meeting-region setting does not mean that all account, support and operational processing stays in Europe.

For Zoom, this includes processing in the United States by Zoom Communications, Inc. Its published business data-processing terms provide for EU Standard Contractual Clauses for relevant transfers to countries without an applicable adequacy decision. Zoom explains its international processing in its Privacy Statement and publishes its data-processing terms through its legal resources.

Google Workspace’s published data-processing terms permit processing in countries where Google or its subprocessors maintain facilities, including outside the EEA. They provide for applicable transfer mechanisms, including Standard Contractual Clauses for relevant restricted transfers. See Google’s Cloud Data Processing Addendum and subprocessor information.

Our Backblaze B2 backup bucket is configured in the EU Central region, which Backblaze locates in Amsterdam, the Netherlands. This describes the backup-storage region; it does not establish that all provider account, support or other processing remains in the EEA. Backblaze, Inc. is a US-headquartered provider. It processes the backups on our behalf under its Data Processing Agreement, which is part of its Terms of Service and includes Standard Contractual Clauses for transfers outside the EEA.

For commercial audiovisual hosting, the published YouTube Data Processing Terms, Section 10, permit processing in the United States and other countries where Google or its subprocessors maintain facilities. They provide for Standard Contractual Clauses for qualifying transfers. These are separate from the Workspace terms; Google’s own platform processing is also explained in its Privacy Policy.

For information about the safeguards applicable to your data, including how to obtain a copy of relevant contractual safeguards, contact info@memory.education.

Retention depends on the category and its actual purpose:

• Enquiries and ordinary coaching information: we retain identifiable information while it is necessary to respond, provide the agreed service or support an ongoing coaching relationship. After that purpose ends, continued retention needs a specific ongoing service, statutory obligation or legal need. This also applies to unsuccessful applications, enquiries that do not lead to a booking, and attachments; a closed enquiry does not justify keeping every detail indefinitely.
• Requests about future courses or materials: contact details and individual replies are subject to the same purpose-based limits as other enquiries. Keeping an old request does not permit further promotion. A particular requested follow-up can justify keeping the necessary contact and request details while that purpose remains current; contract or claim evidence is considered separately.
• Form delivery and technical records: emailed submissions and attachments follow the purpose of the request. Smart Forms states a 30-day period for submitter IP addresses used for abuse prevention; that period does not describe mailbox copies, Postmark delivery records or all website logs. Provider retention depends on the relevant service and configuration.
• Invoices and statutory business records: invoices are generally retained for eight years from the end of the year in which they were issued. Other required records have their applicable statutory periods, including six years for specified business correspondence and ten years for specified books and accounting records. Legal extensions may require longer retention.
• Contract and claim evidence: necessary evidence is kept for applicable limitation periods and statutory duties. The ordinary civil claim period is generally three years, with its start and any longer period depending on the relevant legal rules. An unresolved dispute or legal retention requirement can justify retaining necessary records longer.
• Testimonials, published reader questions and permission records: publication follows the agreed purpose and permission. If permission is withdrawn, we address publication under our control separately from any minimal records needed to establish the permission history or handle legal claims.
• Journal comments: a published comment stays until you ask for its removal or the article is taken down. A comment we do not approve, and the details sent with it, are deleted within 30 days of the decision; a comment awaiting moderation is kept until it is decided.
• Anonymous learning history: we may retain genuinely anonymised teaching and learning records indefinitely. Removing a name or retaining a lookup key is not enough if a person can still be identified from the remaining information.

These limits also apply to identifiable business records stored on our computers, network storage and backups. Local storage does not create an exception for indefinite retention.

Backup versions can outlast a source file. Deleting a source record does not immediately erase every backup version.

We use reasonable technical and organizational measures to protect personal information. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

We may work with minors only where a parent or legal guardian is involved as the contracting party or has otherwise validly authorized participation. We do not knowingly enter into paid service arrangements directly with minors without appropriate parent or guardian involvement.

Group training is for people aged 16 or older. If you are under 18, ask a parent or legal guardian to book your place. We use your application details to review your request and arrange training. You or your parent can ask us how we use your details, or ask about your data rights, by emailing info@memory.education. Please do not include health information in an application.

If you believe we collected personal information from a minor in a way that violates applicable law, contact us at info@memory.education.

Under the GDPR, you have rights to access your personal data, correct inaccurate data, request deletion or restriction where the legal conditions apply, and receive data you provided in a portable format where processing is automated and based on consent or a contract. Deletion does not require us to erase records we must retain by law.

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. For website tracking, reopen Cookie settings; for other consent-based processing, contact info@memory.education.

Where we process data on the basis of legitimate interests, you can object on grounds relating to your particular situation. We must then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims. If your data is processed for direct marketing, you can object at any time without giving a reason, and that use must stop.

To exercise your rights, contact info@memory.education. We normally respond within one month. If a request is complex or numerous requests require an extension permitted by law, we will explain the extension within that first month. We may request proportionate information to verify your identity where necessary.

You may complain to a data-protection supervisory authority, including the authority in the country where you live or work, or where an alleged infringement occurred. The authority for our establishment in Saxony is the Saxon Data Protection and Transparency Commissioner: datenschutz.sachsen.de.

The site may link to third-party websites or services. Their privacy practices are governed by their own policies, not this one.

We may update this Privacy Policy from time to time. The updated version will be identified by a revised “Last updated” date.

Bohdan Rudenko
Memory Development Center / memory.education
Großenhainer Str. 98
01127 Dresden
Germany
info@memory.education