Privacy Policy
Last updated: 22 September 2026
1. Who we are
This Privacy Policy explains how UX Advisors OU (“we”, “us”, or “our”) processes personal data when you visit learn.uxestonia.ee, create an account, use our free or paid courses, purchase a course, contact us, submit a withdrawal request, or subscribe to our newsletters.
We are the controller responsible for the processing described in this policy, except where a service provider processes data independently for its own purposes.
UX Advisors OU
Registry code: 14132248
Address: Keevise 10, 11415 Tallinn, Estonia
Email: [email protected]
You can contact us at this email address about privacy or to exercise your data protection rights.
2. What personal data we collect
Depending on how you use our services, we process:
Account information: your name, email address, account identifiers, and profile information you choose to provide.
Course information: enrolments, access periods, learning progress, completion records, and any answers, assignments, feedback, or discussion contributions you submit through available course features.
Purchase information: the courses purchased, order references, prices, billing details, payment status, and refund records. This may include company information where you buy on behalf of a business.
Communications and form responses: information you provide when contacting us or submitting a form, including withdrawal requests.
Marketing preferences: your newsletter subscription, consent records, and unsubscribe preferences.
Technical and usage information: IP address, browser and device information, access times, pages visited, and interactions with our website. The information collected depends on the service involved and your cookie choices.
Payment credentials are handled by our payment providers. We receive transaction information needed to administer purchases and refunds, rather than your full payment card details.
We receive information directly from you, through your use of the platform, and from providers supporting our services. If an organisation purchases course access for you, it may provide your name and email address so that we can arrange your enrolment.
Please do not include sensitive personal information in assignments, discussions, or forms unless it is specifically necessary and requested.
3. Why we process personal data
Purpose | Legal basis |
Creating and managing your account; providing free or paid courses; recording progress; administering purchases and contractual refunds | Performance of our contract with you, or steps requested before entering a contract |
Providing access purchased for you by an employer or another organisation | Our legitimate interest in delivering the training purchased for its intended learners |
Maintaining accounting and tax records; complying with applicable consumer protection obligations | Compliance with legal obligations |
Responding to general enquiries; protecting accounts; preventing fraud; investigating misuse; establishing or defending legal claims | Our legitimate interests in running a secure service, assisting users, and protecting our rights |
Sending newsletters and promotional emails | Your consent |
Using optional website analytics and advertising technologies | Your consent |
Where we rely on legitimate interests, we consider the effect on your rights and use only data reasonably necessary for the purpose.
Account and transaction information is necessary to provide the relevant service. If you do not provide required information, we may be unable to create your account, fulfil your order, or identify the purchase concerned by your request. Optional fields are identified as such.
4. Our learning platform and payments
We use Thinkific to host our learning platform and administer accounts, enrolments, course delivery, and learning progress. Thinkific processes learner data on our behalf for these activities under its applicable data processing terms.
We use Thinkific Payments, which uses payment partners including Stripe, to process payments and refunds. Relevant billing and transaction information is shared with these providers.
Payment providers may also process information independently for purposes such as fraud prevention and compliance with financial regulations. Thinkific may process certain information independently as described in its own privacy policy.
Further information:
5. Forms and customer communications
We use Google Forms through our company account to collect and manage submissions, including withdrawal requests.
When you submit a form, we process the information you enter and the submission details needed to handle your request. Google provides the form service and processes information in connection with its operation.
Please provide only information relevant to your request. We do not ask you to submit full payment card details or passwords through these forms.
Submitting a withdrawal request does not subscribe you to marketing communications.
Further information: Google Privacy Policy.
6. Newsletters
We use Mailchimp to manage newsletter subscriptions and send course news, offers, and other promotional emails to people who have opted in.
We share the information needed for this service with Mailchimp, including your email address, name if provided, and subscription preferences.
You can unsubscribe at any time using the link in a marketing email or by contacting [email protected]. Unsubscribing does not affect access to your courses.
We may still send necessary service communications, such as purchase confirmations, account security messages, and important information about a course you use.
Further information: Mailchimp’s privacy information.
7. Cookies, analytics, and advertising
Our website uses cookies and similar technologies.
Necessary technologies support functions such as signing in, maintaining sessions, processing purchases, remembering privacy choices, and protecting the service.
With your consent, we also use:
Google Analytics to understand how visitors find and use our website and to improve its content and usability. Information may include pages viewed, interactions, device and browser details, identifiers, and approximate location derived from technical information.
Meta Pixel to measure advertising results and support relevant advertising on Meta services, including Facebook and Instagram. Information may include pages visited, actions taken on the website, device information, and online identifiers. Meta may associate this information with information it holds about you.
Analytics and advertising technologies are activated only after you give consent to the relevant category. You can decline optional categories and still access our courses.
You can change or withdraw your cookie consent at any time through “Cookie settings” on our website. Withdrawal does not affect processing that was lawful before you withdrew consent.
You can accept or reject all optional cookies, or make separate choices for analytics and advertising, through our cookie controls. Optional categories are off until you select them. Continuing to browse does not count as consent, and refusing optional cookies does not prevent you from registering, purchasing, or using our courses.
Necessary cookies support Thinkific account sessions, checkout and security, and the storage of your privacy choices. Google Analytics cookies support audience measurement. Meta Pixel cookies support advertising measurement and relevant advertising. Cookie lifetimes are separate from the retention periods for data held by these services.
For the collection and transmission of certain Meta Pixel data, we and Meta Platforms Ireland Limited act as joint controllers under Meta’s applicable Business Tools terms. Meta is responsible for its subsequent processing under its own privacy policy. You can contact us or Meta to exercise your rights concerning the joint processing.
Further information:
8. Who can receive your data
Personal data may be accessed by authorised members of our team and service providers supporting the activities described in this policy.
Recipients include our learning platform, payment providers, form and communication providers, newsletter provider, and—subject to your consent—analytics and advertising providers.
We may also disclose relevant information to accounting or legal advisers, competent authorities where legally required, or other parties where necessary to establish, exercise, or defend legal claims.
Providers acting on our behalf are subject to appropriate contractual requirements. Providers acting independently are responsible for their own processing.
If you contribute to a course discussion or another shared space, your name and contribution may be visible to its participants. Check the audience before posting.
9. International data transfers
Our providers may process personal data outside Estonia and the European Economic Area, including in the United States and Canada.
For example, Thinkific identifies US infrastructure for its platform, and Mailchimp processes data in the United States.
Where required, transfers are supported by an applicable European Commission adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where necessary.
You can contact us for information about the safeguards relevant to your data and how to obtain a copy, subject to appropriate redactions.
10. How long we retain data
We retain personal data according to its purpose and applicable legal requirements.
Data | Retention period |
Account details and learning records | While your account remains active and the records are needed to provide your courses. Following account closure, deletion or anonymisation within 90 days, except for records retained below |
Inactive accounts with no remaining course access | Deletion or anonymisation after 24 months without account activity, following advance notice |
Accounting source documents and related information required by law | Seven years from the end of the financial year in which the transaction was recorded |
General customer enquiries | Up to two years after the enquiry is resolved |
Withdrawal, refund, and complaint records | Up to three years after resolution, except where longer retention is required for accounting or an ongoing legal claim |
Newsletter subscription data | Until you unsubscribe or we discontinue the newsletter |
Evidence of marketing consent | Up to three years after withdrawal of consent |
Minimal unsubscribe records | While we continue the relevant marketing activity, solely to honour your opt-out |
Google Analytics user and event data | Two months for user-level and event-level data, without extending user-level retention when a user returns. Aggregated reports that do not identify individuals may be retained longer. |
Cookie and advertising identifiers | According to the lifetimes disclosed in our cookie settings and the relevant provider’s applicable retention information |
A course’s five-year access period does not mean that every category of personal data is retained for exactly five years.
Records needed for an ongoing dispute or legal obligation may be retained until the matter is concluded and the applicable retention requirement ends. We restrict their use accordingly.
Deleted information may remain temporarily in protected backups until those backups are overwritten under the relevant provider’s retention cycle.
11. Your rights
Subject to the applicable legal conditions, you may request access to your personal data, correction, deletion, restriction of processing, or a portable copy.
You may object to processing based on legitimate interests. You can object to direct marketing at any time.
Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
Contact [email protected] to exercise your rights. We may request proportionate information to verify your identity.
We normally respond within one month. If a lawful extension is necessary because of the complexity or number of requests, we will explain this within that month.
You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee, or to another competent supervisory authority, including in the country where you live or work.
12. Security
We use appropriate technical and organisational measures to protect personal data, including restricting access to people who need it for their work.
Please keep your account credentials confidential and contact us if you suspect unauthorised access.
13. Automated decisions and advertising profiles
Analytics and advertising services may group visitors or infer interests from their interactions to measure campaigns and select advertisements.
We do not use solely automated decision-making that produces legal or similarly significant effects on you.
14. Changes to this policy
We may update this policy when our services, processing activities, or legal requirements change. The date above identifies the latest revision.
We will provide additional notice of material changes where appropriate. If a new activity requires consent, we will obtain it before starting that activity.