Privacy Policy

1. Introduction, Scope and Controller Identity

This Privacy Policy explains how Lessonvale (“we”, “us”, or “our”) collects, uses, shares, and protects Personal Data when you visit our website (https://lessonvale.com), purchase our digital publications, guides, and companion resources, contact customer support, or otherwise interact with us.

The Data Controller responsible for your Personal Data under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is Lessonvale. If you have any questions regarding this policy or our data practices, contact us at: [email protected].

2. Definitions and Interpretation

In this Privacy Policy, capitalized terms have the meanings set out below:

• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on Personal Data, whether automated or not, including collection, recording, storage, retrieval, disclosure, and erasure.
• “Products” means electronic books (ebooks), digital manuals, audio recordings, diagnostic templates, and worksheets supplied electronically by Lessonvale.
• “Applicable Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and any applicable international data privacy legislation.

3. Personal Data We Collect

We collect and process the following categories of Personal Data:

• Identity and Contact Data: Name, email address, billing address country, and communication records when you reach our support desk.
• Order and Billing Data: Transaction date and time, items purchased, amount paid, currency (GBP), invoice identifiers, and payment method brand (processed securely via our Merchant of Record; we do not store full payment card numbers).
• Digital Delivery & Access Data: Electronic download timestamps, IP addresses associated with download requests, download token verification logs, and device operating environment.
• Technical & Analytical Data: Browser type, operating system, anonymous referring URL, and privacy-preserving aggregated performance metrics via Cloudflare Web Analytics (which does not collect PII or store persistent tracking cookies).
• Correspondence Data: Messages, queries, or refund requests sent via our website contact form or directly to our support desk.

4. How We Use Personal Data and Our Legal Bases

The table below sets out why we Process Personal Data and the legal basis on which we rely under Applicable Data Protection Law. Where a law does not use legal bases, the table describes the reason for the Processing.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of Processing prior to withdrawal. Where we rely on legitimate interests, you may object as described in Section 15.

5. Payments, Orders and Merchant of Record

All checkout operations and payment card transactions for Lessonvale publications are handled by our designated digital storefront and payment processing infrastructure (Blink.store / Stripe).

When you purchase a publication, you provide your billing credentials directly to the secure payment processor. The processor operates as an independent Data Controller for payment fraud screening and payment compliance. Lessonvale never receives, views, or stores full debit or credit card numbers. Your billing descriptor on bank and card statements appears neutrally (e.g. "BLNK*LESSONVALE" or "LV-READING-DECK") for domestic discretion.

6. Digital Product Delivery and Download Logs

Upon payment confirmation, digital publications (PDF manuals and MP3 audio protocols) are delivered electronically via encrypted download links sent to your designated email address and rendered on an authorized confirmation page. We log the IP address, timestamp, and asset identifier associated with each download to confirm delivery, resolve missing file inquiries, and enforce single-user personal licence parameters.

7. Licence, Anti-Piracy and Security Data

All publications are protected by United Kingdom copyright law. To prevent copyright infringement, unauthorized commercial reselling, and bot scraping, we employ server-side tokenization on download links. Any attempt to scrape, duplicate, or publicly distribute our digital publications will result in immediate termination of access and potential statutory enforcement under the Copyright, Designs and Patents Act 1988.

8. Marketing and Email Communications

We send transactional communications strictly necessary to fulfill your order (receipts, delivery tokens, customer service replies). We do not send unsolicited promotional marketing. If you voluntarily subscribe to editorial updates or author announcements, you may unsubscribe at any time using the 1-click link at the bottom of any email.

9. Cookies and Similar Technologies

Our website uses essential technical cookies necessary for core browsing functionality and session security. We use privacy-preserving Cloudflare Web Analytics, which measures human traffic patterns and page performance without reading device identifiers, setting tracking cookies, or tracking users across independent websites. Full details are set out in Schedule 1 below.

10. Disclosure and Sharing of Personal Data

We do not sell, rent, trade, or monetize your Personal Data under any circumstances. We share Personal Data strictly with vetted third-party service providers (Processors) who operate under strict contractual data protection agreements:

• Infrastructure & Security: Cloudflare, Inc. (Global CDN, DDoS mitigation, edge static hosting).
• Checkout & Merchant of Record: Blink.store / Stripe Inc. (Secure checkout, fraud detection, order fulfillment).
• Customer Support: Professional email hosting systems adhering to TLS encryption.

11. International Data Transfers

When Personal Data is transferred outside the United Kingdom (for example, to cloud infrastructure servers operated by Cloudflare or Stripe in the United States or EEA), we ensure appropriate safeguards are implemented, including UK International Data Transfer Agreements (IDTA), standard contractual clauses approved by the UK Information Commissioner's Office (ICO), or transfers to countries with formal UK adequacy regulations.

12. Data Retention Schedule

We keep Personal Data only for as long as necessary for the purposes for which we collected it, including to satisfy legal, accounting, or reporting requirements. Standard retention periods:

13. Security and Breach Notification

We maintain rigorous technical and organisational measures to safeguard Personal Data against accidental loss, destruction, alteration, or unauthorised disclosure. All data transmissions are encrypted using modern Transport Layer Security (TLS 1.3 / 256-bit SSL). In the unlikely event of a security incident affecting Personal Data, we will notify affected individuals and the ICO within 72 hours where required by law.

14. Your Statutory Rights Under UK GDPR

Under the UK GDPR and the Data Protection Act 2018, you possess the following rights:

• Right of Access: Request a copy of the Personal Data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure: Request deletion of your Personal Data where statutory retention periods no longer apply.
• Right to Restriction: Request suspension of data processing under certain legal conditions.
• Right to Data Portability: Request transfer of your data in a structured, commonly used electronic format.
• Right to Object: Object to processing based on legitimate interests.

To exercise any of these statutory rights, submit your request to: [email protected]. We respond within one calendar month and without fee.

15. Children's Privacy

Our website and publications are designed exclusively for adults (individuals aged 18 and older). We do not knowingly collect or solicit Personal Data from children. If you believe a minor has provided us with personal information, contact us immediately and we will promptly delete the data.

16. Contact, Privacy Inquiries and Complaints

For any questions, requests, or privacy concerns, please contact our Data Protection desk at: [email protected].

If you are not satisfied with our response, you have the right to lodge a complaint with the UK supervisory authority: Information Commissioner’s Office (ICO) • Website: ico.org.uk • Helpline: 0303 123 1113.

Schedule 1: Cookie Policy

This Schedule sets out our cookie policy. Strictly necessary technical cookies do not require prior consent under PECR Regulation 6. We do not use intrusive third-party behavioural ad-tracking cookies on our core information pages.

Schedule 2: Register of Main Service Providers

The table below lists the primary infrastructure providers engaged in the delivery of our digital publishing services: