Privacy Policy – Journey to Grandmaster

1. Controller and Contact Details

The controller responsible for processing personal data under this Privacy Policy is:

“Journey to Grandmaster,” “we,” “us,” and “our” refer to the controller identified above.

This Privacy Policy explains how we process personal data when you visit our website, request a free resource, create an account, purchase a course, join a community, participate in live coaching, submit chess games or exercises, contact support, or otherwise interact with Journey to Grandmaster.

This Privacy Policy provides information about data processing. It is not a contract, and simply visiting the website does not constitute consent to processing that requires consent.

Our Terms & Conditions are available at journeytograndmaster.com/terms.

---

2. Personal Data We Process

Depending on how you use our services, we may process the following categories of personal data:

2.1 Identity and Contact Data

• Name and display name
• Email address
• Billing address and country
• Account username or customer identifier
• Language, time zone, and communication preferences

2.2 Account and Purchase Data

• Products, courses, subscriptions, trials, bonuses, and credits connected to your account
• Purchase date, amount, currency, payment status, refunds, cancellations, and subscription status
• Invoices, transaction references, and tax-related information
• Course access, login history, and account-management information

Payment-card and bank-account details are generally processed directly by payment providers such as Stripe or PayPal. We normally receive transaction confirmations and limited payment information, but not complete card details.

2.3 Learning and Chess-Training Data

• Chess rating, playing level, goals, preferred openings, and training interests
• Course progress, quiz or exercise responses, challenge progress, and completion records
• Submitted chess games, PGN files, positions, annotations, calculations, and questions
• Attendance at lessons, workshops, Academy sessions, or community events
• Training reflections, feedback, and personal Endgame or Calculation Playbooks

2.4 Community, Live-Session, and User-Generated Data

• Community posts, comments, direct replies, uploaded files, and profile information
• Display name, voice, camera image, chat messages, and submitted games during live sessions
• Session participation and, where announced, lesson or workshop recordings

When a live session is recorded, participants will be informed before or at the beginning of the session. Where required, we obtain consent. You may generally keep your camera switched off and avoid sharing unnecessary personal information.

2.5 Support and Communication Data

• Emails, support requests, complaints, refund requests, and other correspondence
• Information needed to verify your identity, purchase, account, or request
• Records of consent, objections, unsubscribe requests, and privacy requests

2.6 Marketing and Engagement Data

• Newsletter subscription, consent status, and unsubscribe status
• Email delivery, opening, and clicking information where legally permitted
• Source of registration, campaign, referral, and product interest
• Chess rating or product ownership used to send more relevant training content and offers

2.7 Technical and Usage Data

• IP address
• Browser, device, operating system, and language
• Date, time, requested page, and technical server or security logs
• Session, login, checkout, and security information required to operate the website and customer account
• Fraud-prevention, error, and diagnostic information

We do not currently use Smartlook, Google Analytics, Meta Pixel, advertising pixels, heatmaps, general session recording, or similar optional website-tracking tools.

2.8 Testimonials and Public Content

If you give separate permission, we may process and publish your name, display name, image, video, chess rating, course results, and testimonial. Permission to publish a testimonial is voluntary and separate from completing a course or challenge. You may withdraw consent for future use by contacting us, without affecting processing that was lawful before withdrawal.

2.9 Special Categories of Personal Data

We do not ask you to provide sensitive personal data such as health information, religious beliefs, political opinions, or similar special-category data. Please do not post such information in community areas or send it unless it is genuinely necessary. If you voluntarily provide sensitive information, we process it only where a valid legal basis applies and only to the extent necessary.

---

3. Where Personal Data Comes From

We usually receive personal data directly from you when you:

• complete a form or checkout;
• create or use an account;
• purchase a course or subscription;
• request a free resource;
• join a community or live session;
• submit a chess game, exercise, testimonial, or support request; or
• give marketing consent.

We may also receive limited personal data from:

• payment providers, banks, and fraud-prevention services;
• our website, course, customer-management, email, and community platforms;
• referral or affiliate links;
• video-conferencing providers;
• public chess platforms or public tournament records when you ask us to review a public game, profile, or rating; and
• professional advisers or authorities where permitted or required by law.

---

4. Purposes and Legal Bases

Where processing is based on legitimate interests, our interests may include operating and improving our services, protecting accounts and content, preventing fraud, communicating efficiently with customers, measuring business performance, and providing relevant rather than indiscriminate information. We assess these interests against your rights and reasonable expectations.

4.1 Data Required to Provide a Product or Service

Certain information, such as your email address, purchase details, and payment confirmation, is required to create an account, deliver a product, manage a subscription, or respond to a request. If you do not provide required information, we may be unable to provide the requested product or service.

---

5. Email Communications

5.1 Transactional and Service Emails

We may send emails necessary to provide a requested resource or purchased service, including access instructions, receipts, subscription notices, event information, important account updates, support responses, and legally required notices.

5.2 Promotional and Educational Emails

Requesting a free resource does not by itself create unlimited permission to send promotional emails. Where marketing consent is required, we request it through a clear affirmative action and record the wording of the consent, the date and time, the source page, and available technical evidence. We may use additional confirmation measures where appropriate.

Where legally permitted, we may send existing customers information about our own similar products or services, provided the applicable legal requirements are met and the customer was informed of the right to object when the email address was collected and in every message.

You can unsubscribe from promotional emails at any time by using the unsubscribe link in an email or by contacting support@journeytograndmaster.com. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Unsubscribing from marketing does not prevent us from sending necessary transactional or service-related emails.

---

6. Cookies, Local Storage, and Media Content

6.1 Strictly Necessary Technologies

Our website and service providers may use cookies, local storage, and similar technologies that are technically necessary to provide functions expressly requested by you.

These necessary technologies may be used for:

• account login and session management;
• checkout and payment processing;
• security, fraud prevention, and load balancing;
• remembering settings needed for the service to work; and
• delivering pages, forms, courses, videos, and customer-account functions.

Where the legal requirements are met, strictly necessary technologies may be used without consent under Section 25(2) TDDDG.

6.2 No General Analytics or Session Recording

We do not currently use Smartlook, Google Analytics, Meta Pixel, advertising pixels, heatmaps, general session recording, or similar optional website-tracking tools. We therefore do not currently display a general cookie-consent banner solely for such tools.

6.3 Directly Hosted Videos and Native Testimonials

Some pages contain testimonial or training videos hosted through our website, course platform, or associated content-delivery network. These videos are delivered without loading a YouTube player or Testimonial.io review wall.

Customer testimonials displayed on our pages are stored and presented as ordinary page content. Where a testimonial includes a name, rating, image, video, or other identifying information, we use it only where we have an appropriate legal basis, normally the contributor’s permission.

Our hosting and content-delivery providers may receive technical information such as your IP address, browser information, requested file, and access time when delivering pages, images, or videos. This processing is used to provide the requested website content, maintain security, and ensure reliable delivery.

If we introduce optional analytics, advertising, automatic third-party embeds, session recording, or similar technologies in the future, we will update this Privacy Policy and obtain any consent required before activating them.

---

7. Community Areas and Live Coaching

Information you post in course communities, Academy groups, comments, chats, or live sessions may be visible to other members or participants. Do not share information that you do not want other members to see.

We may moderate, restrict, or remove content to operate the community, enforce our Terms, protect participants, or comply with law.

Where a session is recorded, the recording may be made available to eligible students or members as part of the relevant product. We will provide notice of recording. Where required by law, we will request consent. Public use of a recording or testimonial outside the relevant course or membership requires a separate legal basis, normally separate permission.

---

8. Recipients and Service Providers

We share personal data only where necessary and with an appropriate legal basis. Recipients may include:

• website hosting, course-platform, customer-management, community, and email-service providers;
• payment providers such as Stripe and PayPal;
• website hosting, media-hosting, and content-delivery providers used to deliver pages, images, downloads, and videos;
• video-conferencing providers identified in the relevant event invitation;
• security, fraud-prevention, hosting, and technical-support providers;
• bookkeepers, tax advisers, legal advisers, insurers, and other professional advisers;
• banks and payment institutions;
• contractors who provide editing, customer support, administration, or technical services and are bound by confidentiality and data-protection obligations;
• authorities, courts, regulators, or law-enforcement bodies where disclosure is legally required; and
• a purchaser, successor, or adviser involved in a genuine business transfer, subject to applicable confidentiality and data-protection requirements.

Service providers acting on our behalf may process personal data only under our instructions and for the agreed purposes, subject to applicable data-processing agreements.

We do not sell or rent personal data.

---

9. International Data Transfers

Some service providers may process personal data outside Germany or the European Economic Area, including in the United States.

Where personal data is transferred to a country without an applicable adequacy decision, we use legally recognised safeguards where required, such as the European Commission’s Standard Contractual Clauses and appropriate supplementary measures. Where a provider participates in an applicable adequacy framework, such as the EU-U.S. Data Privacy Framework, we may rely on that framework for covered transfers.

You may request information about applicable transfer safeguards by contacting support@journeytograndmaster.com.

---

10. Data Retention

We retain personal data only for as long as necessary for the relevant purpose, including providing contractual access, complying with legal obligations, handling disputes, and protecting legal rights.

Typical retention criteria include:

• Account and course-access data: while your account or purchased access remains active, and afterwards for a limited period needed for support, fraud prevention, and legal claims.
• Purchase, invoice, and accounting records: for the applicable statutory commercial and tax retention periods, which may generally be up to 8 or 10 years depending on the document.
• Subscription and cancellation records: for the duration of the subscription and afterwards as needed for accounting, disputes, and legal claims.
• Marketing consent records: while we rely on the consent and afterwards for a limited period needed to demonstrate compliance.
• Marketing suppression records: as long as necessary to ensure that an unsubscribe or objection continues to be respected.
• Support and complaint records: for the time needed to resolve the matter and afterwards for a limited period based on potential legal claims.
• Community content: while the community or account remains active. Where necessary to preserve discussions, a post may be anonymised instead of deleted.
• Course progress and challenge records: while needed to provide the course, challenge, credit, support, or proof of completion, and afterwards for a limited period.
• Technical and security logs: for a limited period appropriate to website operation, security, diagnostics, and fraud prevention, unless a longer period is required to investigate an incident.
• Testimonials: until consent is withdrawn or the agreed use ends, subject to copies already lawfully produced or published and any legal retention needs.

Data may remain temporarily in restricted backup systems until the relevant backup cycle completes.

---

11. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Measures may include access controls, password protection, encryption in transit where supported, restricted administrative access, backups, provider security controls, and staff or contractor confidentiality obligations.

No internet service can guarantee absolute security. Please use a strong, unique password, protect your login information, and contact us promptly if you suspect unauthorised access.

---

12. Your Data-Protection Rights

Subject to the legal requirements and exceptions, you may have the right to:

• Access your personal data and receive information about its processing;
• Correct inaccurate or incomplete personal data;
• Delete personal data where there is no continuing legal basis for retention;
• Restrict processing in certain circumstances;
• Receive or transfer data in a structured, commonly used, machine-readable format where the right to portability applies;
• Object to processing based on legitimate interests for reasons relating to your particular situation;
• Object to direct marketing at any time, including related profiling;
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and
• Lodge a complaint with a data-protection supervisory authority.

To exercise a right, email support@journeytograndmaster.com. We may request information reasonably necessary to verify your identity and protect your account.

We normally respond without undue delay and within one month. Where legally permitted, this period may be extended for complex or numerous requests, and we will inform you of the extension.

12.1 Right to Object to Direct Marketing

---

13. Automated Processing and Segmentation

We may use information such as chess rating, course ownership, stated interests, and email engagement to organise contacts into segments and send more relevant training content or offers.

We do not currently use solely automated decision-making that produces legal effects or similarly significant effects on you within the meaning of Article 22 GDPR.

---

14. Children and Young Players

Our chess content may be relevant to young players, but children’s personal data requires special protection.

Where processing is based on consent in connection with an online service offered directly to a child, a child below the legally applicable age may not provide valid consent alone. In Germany, parental or guardian authorisation is generally required for consent-based online processing where the child is under 16.

If you are under 16, ask a parent or legal guardian to create or manage the account, approve optional marketing, community participation, testimonials, and any other consent-based processing.

If we learn that personal data was collected from a child without the required authorisation, we will take reasonable steps to delete or restrict the data.

---

15. External Links and Third-Party Websites

Our website may link to external websites or services. When you leave our website, the third party’s own privacy information applies. We encourage you to review it before providing personal data.

This section does not limit any responsibility we may have for third-party services that we select and use to process personal data on our behalf.

---

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, providers, or legal requirements. The current version and revision date will be published on this page.

Where a change is material and legally required, we will provide an additional notice. An updated Privacy Policy does not retroactively create consent or remove rights that already apply.

---

17. Supervisory Authority

You may lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or the place of an alleged infringement.

Where the controller is established in Bavaria and the competent authority is responsible for the private sector, the relevant authority is:

---

18. Contact Us

For privacy questions, requests, objections, or complaints, contact: