Privacy Policy

1. Controller

The controller for personal data processed via Vitalis Academy is Intelligent Revenue OÜ, Ahtri 12, 15551 Tallinn, Estonia (company number 17452798). Contact: info@irevs.co.

2. What we process and why

We process personal data for the following purposes:

• Account and authentication — name, email, password hash, sign-in metadata. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
• Course access and progress — enrolments, lesson progress, completion. Legal basis: performance of contract.
• Coaching bookings — selected slots, goals you share, payment status. Legal basis: performance of contract.
• Payments — order details processed by our payment provider; we receive confirmation and metadata, not full card numbers. Legal basis: performance of contract and legal obligation.
• Communications — emails you send us and support correspondence. Legal basis: legitimate interest in responding to enquiries.
• Analytics and product improvement — aggregated usage information. Legal basis: consent, where required (see cookie banner).
• Legal compliance — invoices and tax records. Legal basis: legal obligation.

3. Recipients and processors

We rely on carefully selected processors to run the Services: our hosting and database provider, our payment processor, our email/transactional-mail provider, and analytics tooling where enabled. Processors act on our instructions under GDPR-compliant data processing agreements.

4. International transfers

Where processors are located outside the EEA, transfers are protected by Standard Contractual Clauses or an adequacy decision of the European Commission.

5. Retention

Account data is kept for as long as your account is active. Purchase and invoice records are kept for the statutory retention period (typically 7 years under Estonian accounting law). Progress and analytics data are deleted or anonymised when no longer needed.

6. Your rights

Under the GDPR you have the right to:

• access your personal data,
• rectification of inaccurate data,
• erasure ("right to be forgotten"),
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time (without affecting past processing),
• lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon).

Send requests to info@irevs.co.

7. Cookies

We use strictly necessary cookies to run the site and, with your consent, analytics cookies. See our Cookie Policy for details and how to change your choices.

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and regular reviews. No online service can be guaranteed fully secure; we ask that you use a strong password and keep your device up to date.

9. Changes

We may update this policy to reflect changes in our processing or the law. The current version is always available on this page.