Version 6 November 2026.
1. Controller and operator
The data controller is Centrum Edukacyjno Consultingowe CONCRET Anna Urbańska, Mieszka I 7D, 86-300 Grudziądz, Poland, NIP 8761283234, REGON 870628325. Contact for privacy rights: kontakt@kursbriantracy.pl or biuro@concret.pl, telephone +48 533 396 960, or the postal address above.
2. Information and purposes
- Account and learning: name or username, email, protected authentication information, interface language, access entitlements, last position, responses, scores, progress, points, badges and notes. Purpose: account administration and course delivery under Article 6(1)(b) GDPR (contract and pre-contract steps).
- Optional preference survey: selected answers and a result describing stated learning interests. Purpose: providing a requested learning suggestion and letting you revisit your result, under Article 6(1)(f) GDPR: the legitimate interest in operating an optional learning tool. The survey is not necessary to fulfil a purchase or use the course. You may object or request erasure of the survey answers and profile without losing purchased access; the separate record of earned points and badges is preserved.
- Orders and billing: plan, price, payment and access dates, status, transaction and subscription identifiers, refunds, address and company information and optional tax/VAT number. Purposes: contract performance (b), tax/accounting duties (c), and establishing, pursuing or defending claims (f).
- Support and complaints: contact details, messages and necessary order/problem information, for performance (b), legal customer-rights duties (c), and other enquiries or claims (f).
- Security: IP address, request time and basic request information, session/device/error information, administrative events and access corrections, for the controller’s legitimate interest in secure accounts, preventing misuse, service operation and accountability (f).
- One-time trial: account and normalised email history, including a hash of the email, linked to trial use, for fulfilling the offer and preventing repeat trials (b and f). Changing an email does not automatically erase trial-use history.
Providing necessary account and order information is voluntary but required to deliver the relevant service. A tax number is relevant to a business purchase; a private customer need not supply one. Notes and microphone use are optional. Browser recording exercises do not upload voice recordings to the platform.
The preference survey is optional and reflects stated learning interests. It is not a psychological assessment, an ability test or a medical assessment; its result does not block learning or produce legal or similarly significant effects. Module access follows purchase and course conditions. We do not sell customer data or carry out advertising profiling. Any future marketing consent must be separate and optional; an account or purchase does not constitute such consent.
3. Migrated information
To continue providing the service, we migrate account and purchase/billing history, access statuses, preferences, progress, points, badges, notes and last position from the former Brian Tracy English platforms. The sources are customers’ earlier accounts and preserved sales/access records. CONCRET Anna Urbańska now operates the platform. Technical migration is not a new purchase, marketing consent or a statement retroactively changing the seller or terms of an earlier order. Migration does not automatically start charges or emails. Identity or billing discrepancies require review rather than uncertain automatic account merging. You may ask us to check or correct your information.
4. Recipients
Necessary information may be accessed by authorised staff and contractors of CONCRET Anna Urbańska, infrastructure, email, backup and IT suppliers, and competent authorities or accounting/legal advisers where required for duties or protection of rights.
- Amazon Web Services: application servers and databases in Frankfurt (eu-central-1). A server region alone does not guarantee that no authorised supplier access ever occurs outside the EEA.
- Hostido: domain/DNS, mailboxes and messages relating to accounts, orders and customer support.
- Vimeo: external video playback. Loading a player sends connection information such as IP address, browser details and embedding site to Vimeo. Vimeo may also process information for its own purposes under its privacy policy.
- CookieYes Limited: consent banner and cookie-choice management. The provider receives technical browser/connection information; a decision record may include a consent identifier, selected categories and decision time. This manages consent, rather than invoicing or learning assessment. Provider information.
- Google Drive: a dedicated private folder containing encrypted backups. The decryption key is stored separately. Backup rotation targets approximately 30 days. Following a restore, completed erasure/correction requests must be reapplied.
- Stripe Payments Europe, Limited and Stripe Technology Europe, Limited (Ireland), with the relevant payment service providers: when processing payments, identity/contact and billing information needed for payment, amount and currency, transaction/refund/payment-method identifiers and statuses, and technical/security data. Stripe acts as an independent controller for purposes including payment services, fraud prevention and its legal obligations; other roles follow the applicable service terms. See Stripe’s privacy policy. The provider’s form sends card details directly to Stripe. The platform does not retain full card numbers or CVC codes; it may retain a payment-method token/identifier, card brand, last digits and expiry for agreed renewals. Apple Pay and Google Pay allow selecting a card from a wallet; availability depends on the device and wallet configuration. Historical PayU identifiers remain part of earlier billing records, without automatically transferring card tokens or restarting charges.
Global providers, especially AWS, Google, Vimeo, CookieYes and Stripe, may use subprocessors or process information outside the EEA. Transfers require an appropriate basis under GDPR Chapter V, such as an applicable adequacy decision or standard contractual clauses and necessary safeguards. Contact the controller for the mechanism used for a particular supplier and how to obtain a copy of safeguards. We do not claim these services process everything exclusively in Poland or the EU.
5. Retention periods and criteria
| Category | Retention period or end criterion |
|---|---|
| Account, learning progress, answers, points, badges, notes and last position | While the account is maintained for continued learning, including gaps between paid periods. Access expiry does not delete the account. Following an effective account-closure or specific erasure request, learning information is erased or anonymised except for limited evidence needed for billing, contract performance or specific claims under the periods below. |
| Optional survey and result | Until replaced by new answers, an effective objection, a request to erase the survey or account closure. Changing the result does not itself erase earned points and badges. |
| Tax records and invoices | Until the relevant tax obligation becomes time-barred: generally 5 years from the end of the calendar year in which the tax payment deadline fell; longer where a period is suspended/interrupted or other legislation requires it. |
| Contract, payment, complaint and access-correction evidence | Until settlement and resolution of enquiries, then the applicable limitation period. Generally, Polish law provides 3 years for business-related and periodic claims and 6 years for other claims, with statutory end-of-period rules. Proceedings, suspension or interruption may extend this. An entire learning profile is not kept where limited evidence of a specific matter is sufficient. |
| One-time trial history | While the once-per-customer trial is offered, until the offer is permanently discontinued or an effective objection where no overriding ground remains. Only information needed to check prior trial use is retained. An email hash is pseudonymised, not anonymous. |
| Sessions | A course session is valid for 120 minutes of inactivity; expired entries are cleared through the session mechanism. Shop login is generally valid for 2 days, or 14 days with remember-me; signing out invalidates the corresponding session. Session validity is separate from order-record retention. |
| Technical logs | Application error logs rotate over up to 30 daily files. The course web server’s request logs overwrite the oldest entries at a limit of 3 files of 10 MB each. Low traffic may make the calendar period longer. Evidence isolated for a specific incident follows the claim-protection periods above. |
| Backups | Approximately 30-day rotation. Erased information may remain in a protected backup until expiry and is not used for routine service. Completed erasure/rectification requests are reapplied after a restore. Preserving specific incident/legal evidence is separate from ordinary backup rotation. |
6. Your rights
Subject to GDPR conditions, you may request access and a copy, rectification, erasure, restriction and portability of information processed automatically on the basis of consent or contract. You may object to legitimate-interest processing on grounds relating to your particular situation, and object to direct marketing at any time. Where consent applies, you may withdraw it without affecting earlier lawful processing.
Contact the controller to exercise your rights. Proportionate identity verification may be required to protect another person’s information. We normally respond within one month; any permitted extension for complexity or request volume will be explained within that period. Erasure does not cover information still needed for legal duties or claims. You may complain to the President of Poland’s Personal Data Protection Office.
7. Cookies, browser storage and Vimeo
The service uses cookies and browser storage for secure sessions, login, forms, cart and the transition from shop to course. We do not run our own advertising or marketing-analytics tools. Whether a mechanism is necessary depends on its actual purpose.
- Language: bte_lang remembers the choice for up to one year; a localStorage copy remains until you clear the site’s browser storage.
- Shared sign-in: the one-time shop-to-course sign-in state expires after 120 seconds. Course and shop sessions are described in section 5.
- Additional team-preview gate, where used: bte_preview_access lasts up to 12 hours and the bte_preview_csrf form protection up to 30 minutes. These apply to the team preview.
Videos are embedded from Vimeo. Loading a player connects to Vimeo and sends your IP address, basic browser and embedding-page information, and may involve Vimeo cookies. We use dnt=1 to limit tracking. It does not exclude all cookies, especially player-security cookies, or transmission of cookies previously stored by Vimeo. See Vimeo player cookies.
Managing your choice: CookieYes operates on both the shop and the /kurs application, sharing one choice for this domain. Its banner allows acceptance, rejection of optional categories and saving custom preferences. The banner and its cookie list are displayed in Polish, including when you use the English shop or course interface. The cookieyes-consent cookie stores an identifier and category decision for 365 days under the current configuration; this necessary choice record also respects rejection. Change your decision earlier using “Cookie settings” in the footer or next to a blocked video.
The course Vimeo player requires functional consent. Until that consent is saved, we do not create the player iframe or connect it to Vimeo. Withdrawing consent removes the player from the current lesson. If CookieYes is unavailable or browser-blocked, the video remains blocked. The whole Vimeo service is not labelled unconditionally necessary. Withdrawal cannot undo earlier connections; cookies already stored by an external domain can be removed through browser settings.
Refusing optional mechanisms does not disable the account, notes or text materials, but can prevent external video playback. Change your choice through cookie settings. A public scanner does not automatically cover lessons behind sign-in; technical Vimeo cookies must also be checked during playback. The provider inventory is supplemented after that check. An empty automatic inventory does not mean no processing takes place. Optional-cookie consent is separate from email-marketing consent.
The “Wideo Vimeo (opcjonalne)” (optional Vimeo video) category covers the entire external player, including its security mechanisms and possible transmission of earlier Vimeo identifiers. It does not enable the platform’s own advertising or marketing analytics. The inventory below was supplemented from playback tests, not an automatic scan of signed-in lessons.
| Mechanism and domain | Purpose and circumstances | Duration |
|---|---|---|
| __cf_bm — .vimeo.com | Vimeo / Cloudflare bot protection. The course player loads after saving consent to Vimeo video. | Up to 30 minutes of inactivity. |
| cf_clearance — .vimeo.com | Records the outcome of a security check to reduce repeated checks. Observed during playback; in the test it was partitioned to the embedding site. | Up to 1 year, according to provider configuration. |
| __cf_ob — player.vimeo.com | A session cookie observed at /cdn-cgi/challenge-platform. The context indicates Cloudflare protection; its detailed purpose is not independently confirmed in the referenced documentation. It is not treated as unconditionally necessary for the whole site. | Session. |
| vuid — .vimeo.com | A Vimeo analytics identifier that may originate from an earlier visit to Vimeo. In tests, dnt=1 did not create a new vuid, but the player transmitted a previously stored identifier. This does not establish its subsequent use on Vimeo’s servers. | According to Vimeo, up to 2 years from creation; an earlier cookie may expire sooner. |
| _cfPre_tabId — sessionStorage of the player.vimeo.com player | A session-storage key observed in the Cloudflare security context. This is browser storage, not a cookie. Its value is not retained in our audit reports. | Browser-tab session. |
Provider documentation: Vimeo and Cloudflare. Security mechanisms may vary by browser and connection-security assessment. The current list of the site’s own session, language, sign-in and consent-choice cookies is available from “Cookie settings”.
8. Stripe payment security
Stripe’s external form loads on payment and card-management screens, not in lessons or on offer and legal pages. Connections send information including IP address, browser/device details, form interactions and transaction data to process and protect payments. The provider may use fraud detection, bank authentication and CAPTCHA protection. Mechanisms necessary to perform a requested payment or protect its form are not consent to advertising or optional Vimeo video.
Stripe distinguishes essential, functional and advertising cookies. We do not classify its entire domain or all services as unconditionally necessary. Apple Pay and Google Pay depend on a compatible device and active wallet. We do not add Stripe advertising tools. WooCommerce Sourcebuster order attribution is also disabled; this change does not erase historical order records.
The following mechanisms were observed on 5 November 2026 in an isolated browser while testing the form and 3D Secure in Stripe Sandbox. Durations come from expiry dates in that test and may depend on the provider’s configuration. This is a manual form audit, not an automated CookieYes scan or a guarantee of an identical set in every browser. Their use is limited to processing and protecting the requested payment, without advertising consent.
| Cookie and domain | Purpose | Observed lifetime |
|---|---|---|
| __stripe_mid — our site’s domain | A browser identifier for risk detection and protection of the Stripe payment form. | Up to 1 year. |
| __stripe_sid — our site’s domain | A Stripe payment-security session identifier. | Up to 30 minutes. |
| m — m.stripe.com | Device recognition and risk signals for Stripe’s fraud-prevention mechanisms. | Up to 400 days in the tested profile. |
| __cf_bm — .hcaptcha.com | Bot protection for hCaptcha loaded by Stripe. This is separate from the identically named cookie in Vimeo’s player. | Up to 30 minutes. |
Sources: Stripe’s cookie policy and fraud-prevention information. Stripe states that fraud-prevention signals are not used for advertising. The inventory must be checked periodically, especially after changing the provider, configuration or payment methods; any additional mechanism beyond processing and protecting payments requires a separate assessment. Refusing optional Vimeo does not block card payment itself.
Apple Pay and Google Pay: the form may check the availability of a compatible wallet on your device. Selecting a wallet connects to its provider (Apple or Google) and transmits information needed for wallet identification, authentication and payment tokenisation. The store may receive the billing and contact details you share. We do not receive your Apple/Google password or biometric data. Wallets are optional; the regular card form remains available. The same acceptance of terms and subscription schedule is required. Provider information: Apple Pay and Google Payments. Wallet cookies and storage depend on the device and prior provider sign-in. If a compatible wallet is unavailable, you can use the card form.
9. Updates
Policy changes will show a version date. Material changes in purposes or processing requiring additional information or consent will be communicated before taking effect. Contact support for an earlier version relating to your order.