Privacy notice

1. Who is responsible

The data controller is Sebastian Don Maria Lenders, trading as Speak with Sebastian, Rua Dr. António Manuel Dias da Silva 62, Nesperal - 6100-459 Sertã, Portugal. NIF: 313644594. Email: hello@speakwithsebastian.com. Telephone: +351 923 076 661 (national mobile network).

2. What is collected

Lesson form: your name, email address, age, the language you want to learn and the language for explanations, goals, level, preferred frequency, availability, time zone, chosen package and a reference number.

Payment: Stripe processes your payment and gives Sebastian your name, email address, billing country or address, the package, the amount and the payment status. Card details stay with Stripe.

Booking: when you book a call through Cal.com, your name, email address, the chosen time and your answers on the booking page are shared with Sebastian. The call itself takes place on Google Meet.

Contact and withdrawal forms, and email: what you write to Sebastian, with your name and email address.

Invoices: your name, and your tax number (NIF) and address if you ask for them on the invoice. Invoices are communicated to the Portuguese Tax Authority (Autoridade Tributária) as required by law.

The website itself uses no analytics, advertising cookies or tracking. Cloudflare, which hosts the site, processes technical data such as IP addresses to deliver the site and protect it from abuse.

3. Why, and on what legal basis

To answer your questions, prepare and give your lessons, book calls, take payment and handle withdrawals and refunds: because it is needed to take steps at your request before a contract and to perform the contract (Article 6(1)(b) GDPR).

To issue invoices and keep accounting records: because the law requires it (Article 6(1)(c) GDPR).

To keep the website secure, prevent spam and handle disputes: Sebastian’s legitimate interest in running a safe, working business (Article 6(1)(f) GDPR).

4. Who helps process your data

Your data is never sold. These service providers process it on Sebastian’s behalf, each only for its own task: Cloudflare (website hosting and delivery of form messages to Sebastian’s inbox), Fastmail (email), Stripe (payments), Cal.com (call booking), and Google (Google Calendar for scheduling and Google Meet for calls and lessons).

Stripe also acts as an independent controller for some data, for example to prevent fraud and meet its own legal obligations. Data may also be given to authorities or courts where the law requires it.

5. Data outside the EU

Some of these providers are based in, or use servers in, the United States or other countries outside the European Economic Area. Transfers are protected by the EU–US Data Privacy Framework, where the provider is certified, or by the European Commission’s standard contractual clauses.

6. How long data is kept

Invoices and accounting records: 10 years, as required by Portuguese tax law.

Learner details and lesson notes: for as long as you take lessons, and then up to 2 years after your last package ends, in case of questions or disputes.

Enquiries and forms that do not lead to a purchase: up to 12 months.

7. Your rights

You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. Some data, such as invoices, must be kept by law even if you ask for deletion.

To use a right, email hello@speakwithsebastian.com. You will get an answer within one month. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt/, or to the authority in your country.

8. Security and age

Only Sebastian has access to your data. Accounts at the providers above are protected with strong passwords and two-factor authentication, and data travels over encrypted connections.

The service is only for adults aged 18 and over. Data from people under 18 is not knowingly collected; if the lesson form shows that someone is under 18, nothing is sent.

9. Changes

This notice is updated when the way data is handled changes. The date at the top shows the latest version.