Privacy & Cookie Policy

Last updated: 19 October 2026

This policy explains how SFCC Learning handles personal data when you browse this website, contact us, purchase learning materials or access your downloads. It also explains your choices about analytics and advertising.

1. Who is responsible for your data?

The data controller is Jonatan Jumbert, operating as SFCC Learning, located in 08911 Badalona, Spain.

For privacy enquiries or to exercise your rights, email us at learnmore [at] sfcclearning [dot] com. Replace [at] with @ and [dot] with a full stop. You can also use our contact form.

2. Data we process and why

• Enquiries: your name, email address and the message you submit, to answer questions and help with purchases. The legal basis is taking steps at your request before a contract, performing a contract, or our legitimate interest in responding to other enquiries.
• Orders and access: your email address, the product, price, currency, email verification, payment references and delivery status, to process orders and provide access to paid or free materials. This processing is necessary to provide the service you request. We also retain records needed to meet applicable legal obligations and address disputes.
• Payments: Stripe processes payment details on its hosted checkout. Our application receives payment status and transaction references; it does not store your full card details.
• Operation and security: technical request data, which may include IP addresses, browser information and access logs, is processed to serve the website and files, prevent abuse and investigate failures. Our legitimate interest is maintaining a secure, reliable service. Rate limits use derived identifiers rather than storing raw IP addresses in the application's rate-limit records.
• Regional pricing: when enabled, a country code supplied by Cloudflare selects the applicable currency. This does not require precise device location or an advertising profile.
• Optional analytics and advertising: these services operate as described below, with consent where required. Refusing optional analytics or advertising consent does not prevent a purchase.

Your email is needed to verify your request and deliver materials. Without it, we cannot provide the email-based purchase and download service. Contact details and a message are needed to reply to an enquiry.

3. Providers and recipients

Data is shared with providers as needed to operate the service: hosting and database infrastructure; Stripe for payments; email services and our n8n automation workflows for verification, order messages and enquiries; Cloudflare for network services and private R2 file delivery; and Google for reCAPTCHA security verification and enabled analytics and advertising. Data may also be disclosed where required by law or to establish, exercise or defend legal claims.

Some providers may process data outside the European Economic Area. Such transfers must rely on an applicable adequacy decision or other appropriate safeguards, such as standard contractual clauses where required. Contact us for information about the safeguards applicable to your data.

Provider information: Stripe privacy policy, Cloudflare privacy policy and Google privacy policy.

Public forms on our development and production domains use Google reCAPTCHA Enterprise to help prevent automated abuse. When you submit a protected form, Google may process technical information such as your IP address, browser and device signals, and interaction data to assess the request. This security check is separate from optional analytics and advertising. Google’s Privacy Policy and Terms of Service apply.

4. Cookies and local storage

The site uses browser storage to remember choices and support its interface. Your analytics preference is stored under sfcc-analytics-consent-v1. The announcement banner can remember when you dismiss it. Private download links and signed file links are used to authorise access to your purchased materials. Treat your personal access link as private.

You can clear cookies and local storage through your browser settings. Doing so may remove remembered choices and cause consent messages to appear again. Blocking storage may affect some website features.

5. Google Analytics

When enabled, Google Analytics 4 is loaded only after you accept analytics. It helps us understand page usage. Google can process technical information such as browser and device details, IP addresses and cookie identifiers. Analytics may use cookies such as _ga and _ga_….

Our page-view integration removes query strings and URL fragments and replaces private checkout and download paths with generic paths. We do not send your email, form messages, personal access tokens or signed download URLs as analytics event data. Google Signals and advertising personalisation are disabled in this analytics integration.

You can review or withdraw analytics consent below. Choose “Reject analytics” in the banner to stop analytics, clear the accessible Google Analytics cookies and reload the page. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Google AdSense and advertising choices

When advertising is enabled, Google AdSense can display ads on the home page and blog listing. Google and other advertising partners may use cookies, local storage, web beacons, IP addresses and other identifiers to deliver and measure ads, limit repeated ads and prevent fraud. Advertising cookies can allow personalised ads based on visits to this and other websites. Other vendors may also place or read cookies as part of ad serving.

For visitors in the EEA, the United Kingdom and Switzerland, Google's consent message, when configured and published, presents the relevant partners, purposes and choices. Accepting analytics does not constitute advertising consent. Depending on your choices and Google's settings, ads may be personalised, non-personalised, limited or unavailable.

To change or withdraw advertising consent, use Google's “Privacy and cookie settings” link at the bottom of a page displaying its consent message. Visit the home page or blog listing to access advertising choices when advertising is active. Google manages this control independently of our analytics banner.

For visitors in supported US states, Google's US state privacy message provides a “Do Not Sell or Share My Personal Information” link when applicable. Use that link on pages with advertising to review the message and opt out of the sale or sharing of personal information for advertising purposes.

You can also manage Google ad personalisation in My Ad Center. Learn how Google uses information from sites that use its services and review other companies' choices at Your Online Choices.

7. How long we keep data

We keep enquiry records for as long as needed to answer and follow up the enquiry and handle related claims. Order, payment and delivery records are kept as needed to provide access, reconcile payments and comply with applicable accounting, tax and limitation periods. Expired verification links cannot be used to confirm an order; this does not mean every related record is immediately deleted. Records connected with payments or granted access are retained separately from abandoned attempts. Security logs, workflow histories and backups may have separate retention periods according to their operational purpose and the provider's settings. Contact us for information about a particular record.

Analytics and advertising storage depend on the service configuration, your choices and browser controls. Our analytics preference remains in local storage until replaced or cleared. You can remove it using your browser settings or update your choice using this page.

8. Your rights

Subject to the conditions in applicable law, you can request access, correction, erasure, restriction and portability of your personal data. You can object to processing based on legitimate interests and withdraw consent at any time. We may need proportionate information to verify your identity before handling a request.

Contact learnmore [at] sfcclearning [dot] com or use our contact form. You can lodge a complaint with the Spanish Data Protection Agency ( AEPD) or another competent data protection authority. We do not use the website data described here to make solely automated decisions producing legal or similarly significant effects on you.

9. Changes to this policy

We will update this page when the service or its data practices change. The date above identifies the latest version.