Privacy Policy

Controller

No data protection officer has been appointed, as there is no legal requirement to do so.

In short

• Visiting the site: your request is logged by our hosting provider for delivery and security. We do not analyse those logs to learn about you.
• Sending a contact enquiry: we receive what you type, plus your email address, and use it to answer you.
• Measurement: a cookieless counter records page views for everyone. Google Analytics, which does set cookies, runs only if you accept it in the banner — and stops the moment you withdraw.
• Watching the video testimonial: the video file is served from our own domain like any other file. No third-party video platform is involved and nobody else learns that you watched it.
• That is the complete list. No advertising networks, no remarketing pixels, no social plugins, no profiling.

1. Visiting this website (server logs)

• IP address of the requesting device
• Date and time of the request
• Requested URL and HTTP status
• Referring URL, where your browser sends one
• Browser type, version and operating system
• Amount of data transferred

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website reliably and protecting it against attacks and abuse. This data is not combined with other sources and is not used to identify individual visitors. Retention is governed by our hosting provider's log retention, which is short-term and operational.

2. Contact form and email enquiries

• Your name
• Your email address
• Your website or social profile, if you choose to provide one (optional)
• The type of product you are considering
• The stage you are currently at
• Your message
• The time the enquiry was received
• Your IP address, held briefly in server memory to limit automated submissions

Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to a possible contract, and Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries) otherwise. Providing the data is voluntary, but without it we cannot reply.

3. Who we share data with

Vercel Inc. (United States) — hosting and content delivery

Serves this website and processes the server log data described above. Transfers outside the EEA are covered by the EU Standard Contractual Clauses and the provider's certification under the EU-US Data Privacy Framework.

Vercel Web Analytics — measurement, no consent needed

Counts page views and produces aggregate statistics. It sets no cookies, stores nothing on your device and does not identify you or follow you between sites. It is served from our own domain, so no third-party connection is made. Same controller and processing region as the hosting above.

Google Ireland Limited / Google LLC — Google Analytics 4, only with your consent

Measures how the site is used: pages viewed, navigation paths, whether a visit is a return. Nothing is loaded, requested or stored until you accept analytics, and withdrawing deletes the cookies immediately. IP addresses are anonymised, and every advertising feature — ad storage, ad personalisation, ad user data — is set to denied. Google may process data outside the EEA; those transfers rely on the EU Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time via "Cookie preferences" in the footer.

Resend — email delivery

Transmits contact enquiries from this website to our inbox, and processes the content of your enquiry solely for that delivery. Our Resend account is configured to send from their EU region (Ireland), so the message itself is processed inside the European Union. Resend is a US-incorporated company, so access from the United States cannot be ruled out; that possibility is covered by the EU Standard Contractual Clauses.

Enquiries then sit in our email inbox with our email provider, in the same way any email to us would.

4. What we do not use

• No advertising or remarketing pixels (no Meta, TikTok, LinkedIn or similar), and no Google advertising features
• No embedded YouTube, Vimeo, Instagram or TikTok content — the testimonial video is hosted by us and embeds nothing
• No embedded scheduling or chat widgets
• No fonts or stylesheets loaded from third-party servers, and no third-party script of any kind unless you accept analytics
• No user accounts, no database of visitors, no newsletter
• No cookies at all unless you accept analytics; two browser-storage entries that only remember your own choices (see the cookie policy)

If any of this changes, this policy will be updated before the change goes live.

5. How long we keep things

• Enquiries: kept for as long as needed to deal with your request, and afterwards where a legal retention period applies to business correspondence. Otherwise deleted once the matter is closed.
• Rate-limiting records: held in server memory only and discarded within minutes.
• Server logs: retained short-term by our hosting provider for operational and security purposes.
• Analytics: aggregate Vercel figures are retained for the life of the project. Google Analytics data is held for 14 months, after which Google deletes it. Your consent record stays in your own browser until you change it.

6. Your rights

• Request access to the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Have processing restricted
• Receive your data in a portable format
• Object to processing based on legitimate interests, on grounds relating to your particular situation
• Withdraw consent to analytics at any time, via "Cookie preferences" in the footer, without affecting the lawfulness of processing before you did
• Lodge a complaint with a supervisory authority

To exercise any of these, email info@courslly.com. You can also complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es) or to the supervisory authority where you live or work.

7. Security

8. Children

9. Changes