Privacy Policy

Last updated: February 2026

At Unitary Workshops, your privacy matters to us as much as your growth. This policy explains transparently what data we collect, why we need it, and how we protect it. It was written to be read, not just to tick a box.

1. Data controller

The controller responsible for processing your personal data is:

• Foundation: Stichting Science Unitaire de l'Intra-Univers
• RSIN no.: 854505210
• Address: Weena 505, 3013 AL Rotterdam, Netherlands
• Contact email: contact@unitary-science-foundation.org
• Data Protection Officer (DPO): loic.thijssen@unitary-science-foundation.org

When we refer to "we", "our" or "Unitary Workshops" in this document, we mean this entity, which is responsible for determining how and why your data is processed.

2. What data we collect and why

We only collect data that is strictly necessary for each purpose. Below we explain each case in detail.

2.1. Contact form

When you write to us through the website contact form, we collect:

• First and last name
• Email address
• Message subject
• Message content

Purpose: To manage and respond to your enquiry.

Legal basis: Your explicit consent when submitting the form (Art. 6(1)(a) GDPR).

Important: The form content is sent directly to our email address through the WordPress mailing system. We do not store these messages in any website database.

2.2. Payment and workshop registration

When you register for one of our workshops and make a payment, the data required to complete the transaction (name, email address, and payment information) is processed directly by our secure payment providers: Stripe and PayPal.

We receive only the payment confirmation and the basic order identification data (name and email) needed to manage your registration.

We do not store any credit card details, bank account numbers, or PayPal credentials at any time. All such processing takes place entirely on Stripe's and PayPal's PCI-DSS certified servers.

Purpose: To manage your registration, confirm your payment, and send you the workshop access details (Zoom link, venue address, materials).

Legal basis: Performance of the service contract to which you are a party (Art. 6(1)(b) GDPR).

2.3. Newsletter

If you choose to subscribe to our newsletter, we collect your email address.

Purpose: To send you information about new workshops, personal development content, and occasional special offers for subscribers.

Legal basis: Your free and explicit consent (Art. 6(1)(a) GDPR). You may unsubscribe at any time by clicking the "Unsubscribe" link included in every email.

2.4. Language preference cookie

We use a single first-party functional cookie called uw_lang that stores your language preference (possible values: es, en, or fr).

Purpose: To remember the language you selected so you don't have to choose it again on every visit.

Legal basis: Legitimate interest in providing you with a consistent browsing experience (Art. 6(1)(f) GDPR). This cookie contains no personal identifier, does not track your behaviour, and is not shared with third parties.

We do not use analytics, tracking, advertising, or any other type of third-party cookies.

2.5. Server logs (technical records)

Like any website, our server automatically records standard technical information when you visit:

• Source IP address
• Browser type and version (user agent)
• Operating system
• Pages visited and time of visit
• HTTP response code

Purpose: Server security, detection of unauthorised access, technical error diagnosis, and operational site maintenance.

Legal basis: Legitimate interest in ensuring the security and integrity of the service (Art. 6(1)(f) GDPR).

These logs are kept for a maximum of 30 days and are not used for any other purpose, such as behavioural analysis or profiling.

3. Legal basis for processing

Here is a summary of the legal bases that support each processing activity:

• Consent (Art. 6(1)(a) GDPR): contact form, newsletter. You have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Contractual performance (Art. 6(1)(b) GDPR): management of workshop registrations and payments.
• Legitimate interest (Art. 6(1)(f) GDPR): language cookie, server logs. In both cases, we have assessed that our interest does not override your fundamental rights and freedoms.

4. Who we share your data with

We do not sell, rent, or transfer your personal data to third parties for commercial or advertising purposes. We only share it when necessary to provide the service you have contracted, with the following data processors:

4.1. Stripe

Card payment processing provider. Stripe acts as a data processor certified under PCI-DSS Level 1. You can view their privacy policy at stripe.com/privacy.

4.2. PayPal

Alternative payment processing provider. PayPal independently manages the payment data you enter on its platform. You can view their privacy policy at paypal.com.

4.3. Zoom

Video conferencing platform used for delivering online and hybrid workshops. When you take part in an online workshop, your name and email address are shared with Zoom to generate your session access. You can view their privacy policy at explore.zoom.us/en/privacy.

4.4. Web hosting provider

Our website is hosted on a server whose hosting provider has technical access to stored data as a normal part of providing the hosting service. This provider acts as a data processor and is subject to GDPR obligations.

Outside the cases above, we will only disclose your data if legally required to do so (for example, in response to a court order or a request from a competent authority).

5. International data transfers

Some of our service providers — in particular Stripe, PayPal, and Zoom — are headquartered in the United States and may process data on servers located outside the European Economic Area (EEA).

These international transfers are supported by adequate safeguards in accordance with the GDPR:

• Stripe: participates in the EU-U.S. Data Privacy Framework and uses Standard Contractual Clauses approved by the European Commission.
• PayPal: uses Standard Contractual Clauses and is subject to the EU-U.S. Data Privacy Framework.
• Zoom: implements Standard Contractual Clauses and additional technical and organisational measures to protect data transfers from Europe.
• Groq Inc. / OpenRouter Inc.: machine-translation providers (United States) used to translate public workshop content into multiple languages.

Machine-translation services

To translate public workshop content (titles, descriptions, programmes, benefits, FAQs) into multiple languages we use AI services provided by Groq Inc. and/or OpenRouter Inc., both companies based in the United States.

What we send: only public workshop text that the site administrator chooses to translate. We never send personal data of users, customers, or buyers (name, email, IP address, payment information).

What we do not send: no data that could identify an individual, nor the content of messages, contact forms or payments. Translations are stored in a local memory in our database to avoid sending the same text twice.

Safeguards for international transfer: the transfer is carried out under Standard Contractual Clauses (SCC) approved by the European Commission. You may request information about the specific safeguards by writing to the contact email.

You may request information about the specific safeguards applicable to these transfers by writing to us at contact@unitary-science-foundation.org.

6. Cookies

A cookie is a small text file stored on your device when you visit a website. Below we explain exactly which cookies we use on unitaryworkshops.com.

6.1. Cookies we use

6.2. What we do NOT do with cookies

• We do not use Google Analytics cookies or any other analytics tool.
• We do not install advertising tracking cookies (Facebook Pixel, Google Ads, etc.).
• We do not use third-party cookies to build behavioural profiles.
• We do not share cookie data with advertising networks.

6.3. Cookie management

Since we only use the functional cookie uw_lang, a cookie consent banner is not required. However, you can delete or block cookies at any time from your browser settings. If you block the uw_lang cookie, the site will continue to work correctly but will not remember your preferred language between visits.

7. Data retention

We only retain your data for the time strictly necessary for each purpose:

• Contact form enquiries: the time needed to manage and respond to your enquiry. Since messages are not stored in a database, there is no active retention period beyond email inboxes.
• Registration and payment data: 6 years from the date of the transaction, in compliance with Spain's tax and commercial obligations (Art. 30 Commercial Code, General Tax Law).
• Newsletter subscription: until you unsubscribe. Once your unsubscription is processed, we will delete your email address within a maximum of 30 days.
• uw_lang cookie: renewed on each visit and does not contain personally identifiable data.
• Server logs: maximum 30 days from generation.

After these periods, data is securely deleted or irreversibly anonymised.

8. Your rights

As a data subject, the GDPR grants you the following rights over your personal data. They are here for you to exercise, not just to read.

Right of access

You have the right to know whether we process your data and, if so, what data it is, for what purpose, to whom it has been disclosed, and how long we retain it.

Right to rectification

If your data is inaccurate or incomplete, you can ask us to correct it.

Right to erasure ("right to be forgotten")

You may request that we delete your data when, among other reasons, it is no longer necessary for the purpose for which it was collected, you withdraw your consent, or you object to the processing.

Right to object

You may object to the processing of your data when it is based on our legitimate interest or when your data is used for commercial communications. In the latter case, we will stop immediately.

Right to restriction of processing

You may ask us to temporarily suspend the processing of your data while we verify a rectification request, during the assessment of an objection, or when you do not want us to delete data that you need for the establishment or defence of legal claims.

Right to data portability

When processing is based on your consent or on the performance of a contract, you have the right to receive your data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.

Right not to be subject to automated decisions

We do not make automated decisions or carry out profiling with your personal data.

9. How to exercise your rights

To exercise any of the above rights, send us an email at contact@unitary-science-foundation.org stating:

1. Your first and last name.
2. A copy of your national ID card, passport, or other valid identity document (to verify your identity).
3. The specific right you wish to exercise and, if you consider it necessary, your reasons.

We will respond to your request within one month of receipt. In cases of particular complexity or a high volume of requests, we may extend this period by up to two additional months, notifying you in advance.

Exercising these rights is free of charge, unless the requests are manifestly unfounded or excessive.

10. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction, or damage:

• Encrypted transmission via HTTPS/TLS protocol on all pages of the site.
• Payment data is processed exclusively in the PCI-DSS certified environments of Stripe and PayPal; at no point does it pass through our servers in a sensitive format.
• Access to the administration panel is restricted by a strong password and, where possible, two-factor authentication.
• Regular updates of server software, WordPress, and installed plugins.
• Regular backups stored securely.

However, no data transmission system over the internet is 100% secure. If we detect a security breach that may pose a risk to your rights and freedoms, we will notify the Spanish Data Protection Agency within 72 hours and you, if the risk is high, without undue delay.

11. Minors

Our services are intended for persons over 18 years of age. We do not knowingly collect personal data from minors without the verifiable consent of a parent or legal guardian.

If you are a parent or guardian and believe that a minor has provided personal data through our website without your consent, please contact us at contact@unitary-science-foundation.org and we will proceed to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable regulations. When we do:

• We will update the "Last updated" date at the top of this document.
• If the changes are significant and affect processing based on your consent, we will notify you by email (if you are a subscriber or have an active registration) before they take effect.

We recommend that you review this page periodically.

13. Contact and complaints

If you have any questions or concerns about how we handle your data, the first option is always to contact us directly — we prefer to resolve it with you:

• General email: contact@unitary-science-foundation.org
• Data Protection Officer: loic.thijssen@unitary-science-foundation.org
• Postal address: Weena 505, 3013 AL Rotterdam, Netherlands

If you are not satisfied with our response, or believe that the processing of your data does not comply with current regulations, you have the right to lodge a complaint with the competent supervisory authority in Spain:

Spanish Data Protection Agency (AEPD)
C/ Jorge Juan, 6, 28001 Madrid
www.aepd.es
Phone: +34 901 100 099 / +34 912 663 517

You may also lodge a complaint with the supervisory authority of the EU Member State in which you have your habitual residence or place of work.