This document applies
This page describes how the shop actually works and applies from the date given above. It has not been through a lawyer, by the owner’s decision.
Privacy
Privacy Policy
In force since 27 August 2026
This policy says what happens to your data when you read bigtalkclub.com, write to us through the form, sign up for Talking Point or buy a material. It opens with a ten sentence summary and puts the deadlines and the recipients in tables, so that you can read it without a lawyer.
1. In short
Ten sentences, after which you know what happens. The rest of the document expands each of them and adds the legal grounds.
- 01Your data is controlled by Natalia Tomaszewska Fix Up Studio, a sole trader business in Warsaw, and nobody else decides anything about it.
- 02When you buy a material, what stays with us is your email address, the amount, the list of items and a payment identifier, and we never see your card number, because the field with that number belongs to Stripe, not to us.
- 03You reach your purchased files through a link sent to that same address, with no password to set up, so there is no password here for anyone to steal.
- 04You sign up for the newsletter yourself, confirm the address by clicking a link in the first email, and unsubscribe with one click in the footer of every send.
- 05A message from the contact form goes to an email inbox rather than to any database, and only the owner reads it.
- 06We keep one record per person, keyed by email address, so that the history of purchases, sign ups and conversations does not drift apart across several places.
- 07We keep sales records for five years, because tax law says so, and everything else for less, according to the table in section 7.
- 08This site has no analytics, loads no traffic measurement script and carries no advertising cookie at all.
- 09Four companies process data on our behalf, Stripe, Resend, Neon and Vercel, listed in section 6 with their role, their country and exactly what goes to which of them.
- 10You have the right to see your data, correct it, delete it, take it with you and object to the processing, and we answer within one month.
2. Who is responsible for your data
The controller, meaning whoever decides why and how your data is processed, is Natalia Tomaszewska Fix Up Studio, Tarczyńska 12/18, 02-023 Warsaw, Poland, tax identification number (NIP) 7010717358, statistical number (REGON) 368312160. This is a sole trader business, entered in the Polish register on 7 November 2017 and exempt from value added tax, so it has no company court number and no share capital, because both of those apply to companies only.
For anything to do with your personal data, write to gdpr@bigtalkclub.com or use the contact form on the site. The person who answers is the same person who runs the shop, because at this scale and with this kind of data none of the three situations arises in which the regulation requires a data protection officer.
3. Who you are on this site
What we hold depends on what you do here. If you want to read only your own part, take the paragraph below and go to the sections it points at.
You buy a material
You type your email address into the Stripe checkout, and what stays with us is the order: the amount, the list of items, the currency and the payment session identifier. Access to the files runs on a link sent to that address, so the account creates itself and holds no password. Sections 5, 6, 7 and 9 apply to you.
You sign up for Talking Point
You leave your email address and nothing else. Next to it we record the exact wording of the consent you saw on screen and the moment you gave it, and the sending starts only once you confirm the address through the link in the first email. Unsubscribing is one click in the footer of every send. Sections 5, 6 and 7 apply to you.
You read the site
We create no account for you, we measure no traffic and we set no cookie that would follow you around. What remains are two technical cookies holding your own settings: the language and your choice in the consent window. The third one, the sign in, appears only in the shop or on the platform. Section 9 applies to you.
4. What data we collect
Given by you: your email address at checkout, at newsletter sign up and in the contact form, plus your name, the subject and the body of the message in the form itself, and the consents you tick together with their exact wording.
Created as you use the site: the order number, the payment session identifier, a download record for every purchased file with a counter and the date of the last download, the session after you sign in, your chosen language, the IP address of the request at the moment you send the form, and the contact stage worked out from the history of purchases and sign ups.
Received from others: from Stripe, confirmation of payment together with the buyer's email address, and from Resend, whether the email arrived. We also record where the visit came from, meaning the recognised channel and a single detail, the campaign name from the address or the domain of the referring site, as the source of the first and the last visit.
Your email address at checkout is a contractual requirement: without it there is no way to release the file or to open access, so the purchase does not happen. Signing up for the newsletter and sending a message through the form are entirely voluntary, and turning them down closes nothing in the shop.
5. Why and on what legal ground
Every purpose has its own legal ground from Article 6 of the General Data Protection Regulation. Where the ground is our legitimate interest, the same cell says what that interest actually is, because the name of the ground on its own explains nothing.
| Why | What data | Legal ground |
|---|---|---|
| Selling a material and releasing the files | Email address, order items, amount, currency, payment session identifier | Performance of a contract, Article 6(1)(b) |
| Tax settlement and sales records | Order data, amount, date | Legal obligation, Article 6(1)(c), arising from the Polish Tax Ordinance and the Accounting Act |
| Letting you into your Big Talk Club account | Email address, one time link from the email, session cookie | Performance of a contract, Article 6(1)(b) |
| Making sure a purchased file does not travel further | Download record: the counter and the date of the last download on the account | Legitimate interest, Article 6(1)(f). The interest: a file sold to one person is not to become a file handed out to a whole school, and the counter shows when that happens |
| The Talking Point newsletter | Email address, wording of the consent and the moment it was given, date the address was confirmed, language of the sign up | Consent, Article 6(1)(a), and for the sending itself also the consent required by electronic communications law |
| Answering a message from the form | Name, email address, subject and body of the message | Legitimate interest, Article 6(1)(f). The interest: writing back to a person who wrote to us first and is waiting for an answer |
| Protecting the contact form, the sign in request and the newsletter sign up from being flooded | IP address of the request | Legitimate interest, Article 6(1)(f). The interest: five submissions an hour from one address is enough for a human being and not enough for a machine sending spam |
| One record per person, with the owner's notes and tasks | Email address, stage worked out from the history, source of the first and the last visit, history of emails sent, notes and tasks | Legitimate interest, Article 6(1)(f). The interest: remembering what the last conversation was about, and not asking the same question twice |
For each of the four purposes based on legitimate interest we weighed that interest against your privacy, and we will send you the result of that weighing on request. The contact stage in the last row is worked out automatically from the history of purchases and sign ups, but it changes no price, opens and closes no access to materials, and nobody makes any decision about you on the strength of it.
6. Who we pass data to
Four companies process data on our behalf, each one only as far as its service needs and each one under a data processing agreement with us. The table shows what goes to which.
| Category of data | Stripe | Resend | Neon | Vercel |
|---|---|---|---|---|
| Email address | goes there | goes there | goes there | goes there |
| Payment card number | goes there | does not go there | does not go there | does not go there |
| Order amount and items | goes there | goes there | goes there | goes there |
| Sign in link and session | does not go there | goes there | goes there | goes there |
| Purchased files and download records | does not go there | does not go there | goes there | goes there |
| Newsletter sign up and consent wording | does not go there | goes there | goes there | goes there |
| Body of the message from the form | does not go there | goes there | does not go there | goes there |
| Person record, notes and tasks | does not go there | does not go there | goes there | goes there |
| IP address of the request | goes there | does not go there | does not go there | goes there |
Stripe runs the checkout and the payment, and our contract is with the Irish company Stripe Payments Europe. Resend sends the emails and holds the newsletter recipient list. Neon runs the database and belongs to the American company Databricks. Vercel hosts the site, runs the application code and stores the lesson files, so everything you see and send on this site passes through Vercel.
We do not sell your data, do not trade it and do not hand it to anyone for their own purposes. Beyond those four companies, data goes only where the law orders it to go, meaning to the tax authorities inside sales records.
7. How long we keep it
Every category has its own deadline. Where the deadline comes from a statute, the statute is named in the last column. Where a number cannot be given in advance, what stands there is the condition on which the data disappears.
| What | How long | Where the deadline comes from |
|---|---|---|
| The order: email address, amount, items, payment session identifier | Five years, counted from the end of the calendar year in which the tax payment deadline fell | The Polish Tax Ordinance and the Accounting Act. We are not allowed to delete it any earlier |
| The Big Talk Club account and its purchase history | For as long as you use the access. On your request we delete it within one month | A purchased file stays yours with no time limit, so the account disappears only when you give it up yourself |
| Download record: the counter and the date of the last download | As long as the account it sits on | Deleting the account takes the download records with it, because without the account they mean nothing |
| The btc_session cookie | Thirty days from signing in | After that you ask for a new link. Signing out deletes it straight away |
| The one time sign in link from the email | Thirty minutes from the moment you ask for it, and seven days for the link in the email that follows a paid order | Short, because it is the key to purchased files. Longer after a purchase, because nobody asked for that email at any particular moment and post gets read the next day |
| Newsletter sign up: address, consent wording, moment of consent, date of confirmation | Until you unsubscribe | Consent lasts exactly as long as you do not withdraw it |
| The trace left after unsubscribing: address, consent wording and both dates | Three years from unsubscribing | That is how long we hold proof that the sending had a ground, and how long we make sure the address does not return to the list by mistake |
| A message from the contact form | Until the matter is closed, at the longest one year from the last email in that conversation | The message sits in an email inbox rather than in a database, and once the matter is settled there is nothing to wait for |
| The IP address when you send the form | One hour, which is the window we count the submission limit in. It never reaches the database at all | After an hour the counter clears itself, and the address goes with it |
| Person record: stage, visit sources, email history, notes and tasks | Three years from the last event involving that person, unless you ask for deletion sooner | After three years of silence the record stops being any use to anyone |
| The settings and consent cookies | The lifetime of each one is in the table in section 9 | Each of them can also be deleted by hand, in your browser settings |
Deletion from the database happens as soon as we have dealt with the request. Backups of the database are run by Neon on its own cycle, which we do not set, so a deleted record leaves the backups when the oldest of them is overwritten, not at the moment it is deleted from the database.
8. Where your data sits
The database, the application code and the lesson files sit in Frankfurt. The rest looks different, and we say so plainly instead of writing that the data stays in the Union.
| Service | What is in the EU | What is outside the EU |
|---|---|---|
| Stripe, payments | The contract with the Irish company Stripe Payments Europe | All payment processing in the United States, and the panel sign in data also in India |
| Resend, email | Emails are sent out from Ireland | The account, the recipient list, the logs and the content of sent messages in the United States |
| Neon, database | The database in Frankfurt | The contract with the American company Databricks, and the documentation names no region for the backups |
| Vercel, hosting and files | The application code and the lesson files in Frankfurt | The account, the billing and the logs in the United States, and the site itself travels through a network buffer in 94 cities around the world |
In all four cases the transfer of data outside the Union rests on the standard contractual clauses approved by the European Commission and on the data protection framework between the European Union and the United States. We will send you a copy of the clauses a given transfer rests on if you ask for it.
9. Cookies
We set three cookies. Each of them remembers a choice of yours, or your sign in to the shop and the platform, and none of them serves advertising or tracking.
| Cookie | What for | How long | Consent |
|---|---|---|---|
| btc_session | Holds your sign in, so that every file download does not start with asking for a new link. Invisible to scripts on the page and sent over an encrypted connection only | Thirty days | Strictly necessary, no consent required |
| NEXT_LOCALE | Remembers your chosen language for the site | Until you close the browser | Strictly necessary, no consent required |
| cc_cookie | Records your choice in the consent window together with its date, so that the question does not come back on every visit | One hundred and eighty two days | Strictly necessary, no consent required |
There is no analytics on this site. No Google script loads, no other traffic measurement tool loads, there is no advertising pixel, and nothing about your visit leaves the site. The consent window has a separate analytics category, switched off by default, and once traffic measurement does start, the table above will gain a new row before that measurement goes live.
The basket is the only thing we leave in the browser's own storage, under the name btc-cart. It holds the addresses of the materials you picked and the dates you added them, it never reaches the server, and it disappears when you clear the site data.
You can change your choice in the consent window at any time with the Manage cookies button in the site footer. All three cookies can also be deleted by hand in your browser settings, and everything keeps working afterwards, you simply pick the language again and sign in once more.
10. Your rights
You exercise each of these rights with a plain email to the address in section 2. There is no form to fill in, no reason to give and no charge for it.
- Access. We will tell you what data about you we hold, where we got it and who we pass it to, and we will send you a copy.
- Rectification. We will correct what is wrong and fill in what is missing.
- Erasure. We will delete everything a statute does not force us to keep. We will not delete sales records before five years have passed, because tax law forbids it, and we say that plainly instead of promising something we will not do.
- Restriction. On your request we will freeze the data: it stays in the database, but nobody uses it until the matter is settled.
- Portability. We will send you your data in a file another program can read, or send it straight to whoever you point us at.
- Withdrawal of consent. You withdraw your newsletter consent with one click in the footer of every send. The withdrawal works from the moment you make it and does not undo the sends that came before it.
The right to object
You have the right to object to the four purposes based on our legitimate interest, listed in the table in section 5. You raise it with a plain email, with no justification and no charge. Once you object we stop processing your data for that purpose, unless we can show a ground that outweighs your interests and rights. Against direct marketing there is no such exception and we stop immediately.
We answer within one month of receiving your request. Where the matter is complicated, or where several requests arrive at once, we extend the deadline by two further months, but then we tell you within that first month and say why.
If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). A complaint is lodged in writing or through the authority's electronic inbox, and its current contact details are on its own site.
11. Security
The site runs over an encrypted connection only, and so does the connection to the database. The account has no password, so there is nothing to steal and nothing to crack: getting in works through a one time link from an email, and the sign in is held by a cookie that scripts on the page cannot see. The lesson files sit in a private store with no public address and have no link that could be passed on, because every download goes through our application and passes three checks: the session, a paid order on that address, and whether the file belongs to that material. Your card number is nowhere in our database in any form, because the field holding it is a Stripe page. The person records, the notes and the tasks are visible to the owner alone, after signing in, from a closed list of addresses.
If a breach did happen and put your rights at risk, we will tell you by email and report the matter to the President of the Personal Data Protection Office within seventy two hours of discovering it.
12. Children
The shop and the newsletter are addressed to adults: a material is bought by a teacher or by an adult learner, at levels B1 to C1. We collect no data about the people in your lessons, so whoever you work with on our material leaves not a single record here. If we learn that we hold data about a person under sixteen, we will delete it without delay and without asking permission.
13. Changes to this policy
When we change this policy, we change the date at the top of the page along with it. About a change that touches your data we will write a separate email to the address we have, at the latest fourteen days before it takes effect, and we will not attach that email to any marketing send.
This is the first version of the document, so the archive of earlier ones is empty. Every later version will stand here next to the current one, together with the date it applied from, so that anyone can check which rules were in force on the day of a purchase.
14. Contact
Questions about these rules and every request about your data go to gdpr@bigtalkclub.com or through the contact form on the site. We answer in Polish and in English.
Other legal documents