Privacy Policy

1. Who is responsible for your data

That's Rhythm decides why and how your personal data is used when you browse this site and sign up for its courses. Under the General Data Protection Regulation it is the data controller for that data.

ZVR 1787997399 · ZVR 1787997399 · Feriensiedlung 3, 2460 Bruckneudorf, AT

For anything concerning your personal data, write to [email protected].

This site is operated for That's Rhythm by SWNG (66 rue de Rome, 75008 Paris, France), acting as a data processor: it handles your data only on That's Rhythm's documented instructions and never for its own purposes.

2. What we collect, and why

You can browse this site without telling us who you are. To sign up for a course we need the following, and we collect nothing beyond what each purpose requires:

• Identity and contact details (first name, last name, email address, and where a course requires it a phone number), to create your account, process your sign-up and contact you about it.
• Sign-up details (the courses you apply for, your answers to the school's questions, your level or role where relevant), to decide on your application and run the class.
• Payment records (amounts, dates, method, invoices), to take payment and to keep the accounting records the law requires. Card details are entered directly on Stripe's systems and are never seen or stored by us.
• Technical data (IP address, browser, pages visited), to keep the site working and secure.
• Marketing preferences (newsletter subscription and cookie choices), only where you have given them.

3. On what legal basis

Every use of your data rests on one of the following:

• Performance of a contract: creating your account, processing your sign-up, taking payment and supporting you afterwards.
• Legal obligation: keeping invoices and accounting records, and being able to demonstrate the consent you gave.
• Legitimate interest: keeping the site secure and preventing fraud and abuse. You may object to processing on this basis.
• Consent: advertising and audience-measurement cookies, and the newsletter. You give it freely and may withdraw it at any time, without affecting what was lawful before you did.

4. Who else receives it

Your data is used by That's Rhythm and by the providers below, each bound to process it only on instruction and to keep it confidential.

Neither That's Rhythm nor any of these providers sells your personal data. None of them may use it for their own purposes, except the advertising services listed below where you have consented to them.

• SWNG, operator of this site, on That's Rhythm's instructions.
• Scalingo (Scalingo SAS), France, hosting & database provider https://scalingo.com/data-processing-agreement
• Postmark (AC PM LLC), United States, transactional email provider https://postmarkapp.com/dpa
• Amazon Web Services (S3) (Amazon Web Services EMEA SARL), France, file storage provider (photos and documents) https://aws.amazon.com/compliance/gdpr-center/
• Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.), United States, card payment provider https://stripe.com/legal/dpa
• Google (sign-in) (Google Ireland Limited / Google LLC), United States, sign-in provider (only if you choose to sign in with Google) https://policies.google.com/privacy

5. Transfers outside the European Union

Some providers process data outside the European Union. Where that happens the transfer relies on a European Commission adequacy decision or on standard contractual clauses. The providers concerned are:

You can obtain a copy of the safeguards covering these transfers by writing to [email protected].

• Postmark (AC PM LLC), United States, standard contractual clauses https://postmarkapp.com/dpa
• Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.), United States, adequacy decision https://stripe.com/legal/dpa
• Google (sign-in) (Google Ireland Limited / Google LLC), United States, adequacy decision https://policies.google.com/privacy

6. How long we keep it

We keep your data only as long as the purpose requires:

The 10-year retention of transaction records is a legal obligation, not a choice. A request to erase your data therefore cannot remove invoices or payment records within that period; everything not needed as proof of the transaction is erased or anonymised.

Records of the consent you gave or refused are kept so that That's Rhythm can demonstrate it asked you and honoured your answer. They contain your choice, when you made it, the wording you were shown, and the page, IP address and browser the choice was made from. The last three are kept because a record of consent that cannot be tied to a request proves nothing.

• Account and sign-up data: for as long as your account is active. If it has not been used for 18 months it is anonymised: the account is closed and the email address can no longer identify you.
• Payment records, invoices and anything evidencing a transaction: 10 years, as commercial and tax law require.
• Proof of consent: for as long as the processing lasts, and afterwards for as long as it may have to be demonstrated.
• Technical logs: twelve months at most.

7. Your rights

You have the following rights over your personal data:

To exercise any of them, write to [email protected]. We may ask you to confirm your identity where answering would otherwise risk disclosing your data to someone else, and we may decline requests that are manifestly unfounded or excessive.

We answer within one month of receiving your request. Where a request is complex we may extend that by two further months, and will tell you why within the first month.

• Access: obtain a copy of the data held about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted, except where it must be kept as set out above.
• Restriction: have processing limited while a dispute is resolved.
• Portability: receive the data you provided in a machine-readable format.
• Objection: object to processing based on legitimate interest, and to any use for marketing.
• Withdrawal of consent: withdraw at any time, as easily as you gave it.
• Instructions after death: set directions on what becomes of your data.

8. Complaining to a supervisory authority

If you believe That's Rhythm has not met its obligations, you may lodge a complaint with the supervisory authority where you live, where you work, or where the problem occurred. For That's Rhythm that is:

• Österreichische Datenschutzbehörde https://dsb.gv.at/

9. Cookies

Cookies strictly necessary to make the site work (keeping you signed in, remembering your cart, recording your cookie choice) are set without asking, because the site cannot function without them.

No advertising or audience-measurement cookies are used on this site.

Every cookie this site sets, and every cookie the services you may accept set, is listed below with its purpose and how long it stays on your device.

10. Changes to this policy

This policy may change to reflect legal, technical or organisational developments. The version identifier below changes whenever the text does, and the version you accepted is recorded with your account.

Version en-0cf3686038de