top of page

Privacy Policy

​

TheCursus.com • Studio 1113 EOOD

Effective date: 1 October 2026

This Privacy Policy explains how Studio 1113 EOOD, operating TheCursus.com (“TheCursus”, “we”, “us” or “our”), collects, uses, stores and shares personal data when you visit TheCursus.com, create an account, purchase or access courses, webinars, online events or other digital content, communicate with us, or otherwise use our services.

​

1. Who is the data controller?

For the purposes of the EU General Data Protection Regulation (GDPR) and applicable Bulgarian data-protection law, Studio 1113 EOOD is the data controller for personal data processed through TheCursus.com, except where another party independently determines the purposes and means of processing.

Website: TheCursus.com
Company: Studio 1113 EOOD
Country of establishment: Bulgaria
Privacy contact: please use the contact details published on TheCursus.com.

​

2. Personal data we may collect

Account and identity data: such as your name, username, account details and information you provide when registering.

Contact data: such as your email address, telephone number and information included in communications with us.

Transaction data: such as products or services purchased, amount, currency, date, payment status, refunds and transaction references. Full card details are normally processed by payment providers and are not intended to be stored by TheCursus.

Course and service data: such as enrollments, access status, webinar registrations, attendance, course progress and interactions with content.

Technical and usage data: such as IP address, device and browser information, operating system, timestamps, referring pages, pages viewed, cookie identifiers and diagnostic/security logs.

Marketing data: such as newsletter preferences, consent records and interactions with marketing communications.

Support and dispute data: such as correspondence, support requests, complaints, refund requests, fraud-prevention information and evidence required to respond to payment disputes or chargebacks.

​

3. How we use personal data and our legal bases

Purpose

Examples

Typical GDPR legal basis

Provide the service

Create accounts; process orders; provide access to courses, webinars and digital content; customer support.

Performance of a contract

Payments and accounting

Process payment status, refunds, invoicing, bookkeeping and transaction records.

Contract; legal obligation

Security and fraud prevention

Protect accounts, detect abuse, investigate suspicious activity, defend payment disputes and prevent fraud.

Legitimate interests; legal obligation where applicable

Legal and regulatory compliance

Respond to lawful requests, keep legally required records and establish or defend legal claims.

Legal obligation; legitimate interests

Service improvement and analytics

Understand site performance, diagnose errors and improve user experience.

Legitimate interests; consent where required for non-essential cookies/technologies

Marketing

Send promotional emails or similar communications where permitted.

Consent or legitimate interests, depending on applicable law and context

​

4. Payments

Payments may be processed by third-party payment service providers, acquiring banks, payment gateways or other financial-service providers. Those providers may receive payment and transaction information necessary to authorize, settle, refund, secure or investigate a transaction. Their processing may also be governed by their own privacy notices. TheCursus may retain transaction references, payment status and related records needed for customer service, accounting, fraud prevention and dispute management.

​

5. Course creators, instructors and service partners

TheCursus may work with instructors, course creators, webinar hosts, content partners and technical service providers. We disclose personal data only where reasonably necessary to deliver the purchased service, administer access, provide support, operate the platform, or meet legal and security requirements. Where a partner acts as an independent controller, that partner is responsible for its own processing.

​

6. Cookies and similar technologies

TheCursus.com may use cookies and similar technologies for essential website functions, authentication, security, preferences, analytics and, where enabled, marketing. Where EU law requires consent, non-essential cookies or similar technologies should not be activated until the user has provided the required consent. Users should be able to withdraw or change consent choices through the website’s cookie controls.

​

7. Analytics and third-party services

We may use hosting, analytics, communications, email, customer-support, security and other technology providers to operate TheCursus. These providers may process technical or account information on our behalf. We seek to use appropriate contractual and organizational safeguards when a provider acts as our processor.

​

8. When we share personal data

  • with hosting, cloud, IT, analytics, communications and customer-support providers;

  • with payment providers, banks and financial partners involved in a transaction;

  • with instructors or content/service partners where necessary to deliver the service;

  • with professional advisers, auditors, insurers or authorities where legally required or reasonably necessary;

  • in connection with a corporate transaction, restructuring or transfer of the relevant business, subject to applicable law.

We do not sell personal data as a standalone business activity.

​

9. International data transfers

Some service providers may process personal data outside Bulgaria or the European Economic Area (EEA). Where GDPR restrictions on international transfers apply, we use an available lawful transfer mechanism, such as an adequacy decision, approved standard contractual clauses, or another mechanism recognized by applicable law, together with supplementary safeguards where required.

​

10. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining account and transaction records, complying with tax/accounting or other legal obligations, resolving disputes, preventing fraud and establishing or defending legal claims. Retention periods vary depending on the type of data and applicable legal requirements. Data may be deleted, anonymized or securely archived when it is no longer required.

​

11. Data security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction. No internet service or storage system can be guaranteed to be completely secure, and users should protect their account credentials and notify us of suspected unauthorized use.

​

12. Your rights under GDPR

Subject to the conditions and exceptions in applicable law, you may have the right to:

  • request access to personal data we hold about you;

  • request correction of inaccurate or incomplete data;

  • request deletion of personal data;

  • request restriction of processing;

  • object to processing based on legitimate interests or to direct marketing;

  • receive certain personal data in a portable format;

  • withdraw consent at any time where processing is based on consent, without affecting prior lawful processing;

  • lodge a complaint with the competent data-protection supervisory authority.

We may need to verify your identity before completing a request. Rights are not absolute and may be limited where continued processing is permitted or required by law.

​

13. Bulgarian supervisory authority

Individuals may have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Commission for Personal Data Protection / CPDP) or, where applicable, another competent supervisory authority in the EEA.

​

14. Marketing communications

You can opt out of promotional email communications by using the unsubscribe mechanism included in the message or by contacting us. Service-related communications, such as purchase confirmations, security notices or material changes affecting your account, may still be sent where necessary.

​

15. Children

TheCursus is not intended to collect personal data from children in circumstances where parental or guardian authorization is legally required unless the appropriate authorization has been obtained. If you believe a child’s personal data has been provided contrary to applicable law, please contact us so that we can review the matter.

​

16. Automated decision-making

We do not intend to make decisions producing legal or similarly significant effects solely through automated processing unless permitted by applicable law and accompanied by the required safeguards. Automated tools may be used for security, fraud detection, spam prevention or transaction-risk signals.

​

17. External links

TheCursus.com may contain links to third-party websites or services. We are not responsible for the privacy practices of independent third parties. Users should review the privacy notices of those services.

​

18. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our services, technology, legal requirements or business practices. The updated version will be posted on TheCursus.com with a revised effective date. Where required by law, we will provide additional notice or request consent.

​

19. Contact us

For privacy questions or requests concerning your personal data, contact Studio 1113 EOOD using the contact details published on TheCursus.com. Please include enough information for us to identify the relevant account or transaction without sending unnecessary sensitive information.

 

Implementation note: Before publication, insert the company’s registered address, company/UIC number, dedicated privacy email address, and the actual names/categories of analytics, cookie, hosting and payment providers used by TheCursus. This document is a general GDPR-oriented template and should be reviewed against the site’s actual data flows and legal requirements.

bottom of page