Version: 2026-10 · Effective from: 20 October 2026
This policy explains what personal data StarTax Education collects when you visit www.startaxed.com, download a free resource, buy a course or textbook, or study in our online classroom, and what we do with it.
We have tried to keep it short and specific. If anything is unclear, email study@startaxed.com.
1. Who we are
StarTax Education is the trading name of Borys Ulanenko, a sole trader based in Poland:
- Controller: Borys Ulanenko, trading as StarTax Education
- Address: Komuny Paryskiej 2/13, 30-389 Kraków, Poland
- Email: study@startaxed.com
We are the controller of your personal data, which means we decide why and how it is used. We have not appointed a data protection officer. Please send any privacy question to study@startaxed.com. This also applies if you are in the United Kingdom: you can contact us about your personal data at study@startaxed.com.
2. The short version
- We collect only what we need to send you what you asked for, sell and deliver our courses, and run the classroom.
- Card details are handled by Stripe. We never see or store your full card number.
- We send marketing emails only if you tick the separate box asking for them. You can unsubscribe at any time.
- Our website analytics do not use cookies and show us only totals (for example page views), not individual visitors.
- The only cookies we set are the ones needed to keep you signed in to the classroom. See our Cookie Policy.
- We use a small number of service providers, some based in the USA. Section 7 explains how your data is protected when it leaves the European Economic Area.
3. What we collect and why
3.1 When you browse the website
| What | Why | Lawful basis |
|---|---|---|
| Technical request data: IP address, browser and device type, the page requested, date and time | To deliver the website, keep it secure and investigate errors or abuse. Kept in our hosting provider's logs for a short period (see section 8). | Legitimate interests: running a secure website |
| Aggregated usage statistics: pages viewed, referring website, country, device and browser type, and a few events such as clicks on "Enroll" buttons, sign-ups to free resources and plays of the intro video | To understand which pages are useful and improve the site. Our analytics (Vercel Web Analytics) do not use cookies and do not track you across other websites. Visits are counted using a short-lived code derived from the request, which is discarded after 24 hours, and we see only totals. | Legitimate interests: improving our website. You can opt out (see the Cookie Policy). |
3.2 When you ask for a free resource
Our free resources are the ADIT prep guide, the transfer pricing cheat sheet, a free textbook chapter, and the free course module (Intra-Group Services). You get them through a sign-up form on our website.
| What | Why | Lawful basis |
|---|---|---|
| Your email address and which resource you asked for. For the free module, also your name, so we can set up your free classroom account. | To send you the resource by email and give you access to it. | Contract: providing the free resource you requested |
| Whether you ticked the separate box to receive study tips and course news, and when | To know whether we may send you marketing emails, and to prove your consent. | Consent (for marketing). Keeping a record of your choice: legal obligation and legitimate interests |
| The list of resources you have requested over time | To avoid sending the same thing twice and to understand which resources are useful. | Legitimate interests |
3.3 When you buy a course or the textbook
Before you pay, our checkout page on www.startaxed.com asks you to tick two separate boxes. Payments are then processed by Stripe on its secure checkout page.
| What | Why | Lawful basis |
|---|---|---|
| Name, email address, billing address and country, what you bought, the amount and currency, date and time, payment status, and limited card details (card brand, last four digits, expiry) as shown to us by Stripe | To take payment, deliver your purchase, send your receipt and order confirmation, issue invoices and handle refunds. | Contract |
| Company name, company address and VAT number (if you buy as a business) | To issue a correct invoice. | Contract, and legal obligation (tax and accounting) |
| Your agreement to our Terms and Conditions and confirmation that you have read this Privacy Policy, your request for immediate access and your acknowledgement that your right to cancel ends when access starts (with the exact wording, date, time, terms version, and your IP address and browser details) | To show what was agreed and that we met the legal requirements for supplying digital content straight away. | Legal obligation, and legitimate interests (being able to prove what was agreed) |
| Your name and email address printed in your copy of the textbook PDF | To discourage unauthorised sharing of the textbook. | Legitimate interests (protecting our materials) |
| Order and invoice records | To keep the accounting and tax records the law requires. | Legal obligation |
Stripe uses some payment data for its own purposes, such as preventing fraud and meeting its financial regulatory obligations. For those purposes Stripe acts as a separate controller under its own privacy policy (stripe.com/privacy).
3.4 When you use the online classroom
| What | Why | Lawful basis |
|---|---|---|
| Account details: name, email address, and your password (stored only in scrambled, hashed form, so we cannot read it) | To create your account and let you sign in. | Contract |
| If you choose "Continue with Google" to sign in: the basic profile details Google shares with us (your name, email address, Google account ID and, if you have one, your profile picture) | To sign you in to your existing account. Google does not see what you do in the classroom. | Contract |
| Sign-in sessions: the IP address and browser details of each signed-in session, and when it expires | To keep you signed in, protect your account and spot unauthorised use. | Contract, and legitimate interests (account security) |
| Security records: short-lived records of sign-in attempts, which may include your IP address | To limit repeated sign-in attempts and protect against attacks. | Legitimate interests (security) |
| Enrolment: which course you are enrolled in, your role, and your access start and end dates | To give you the right access for the right period, including any extension. | Contract |
| Learning activity: lessons completed, where you stopped in each video, quiz and test answers and scores, the last page you viewed in the textbook, and your last activity | So you can pick up where you left off and track your progress, and to check eligibility for the exam pass guarantee. | Contract |
| Study notes you write in the classroom | To save them for you. Your notes are private. We do not read them unless you ask us to, or we need to for a technical or security reason. | Contract |
| Case-study and mock-exam submissions, and the tutor feedback on them | To give you personalised feedback. | Contract |
| 1-2-1 sessions: booking details, and anything you share during the session | To arrange and deliver the sessions. Sessions are held by video call (Google Meet or Zoom), booked by email or through a booking link, and are not recorded. | Contract |
| Your exam result and the evidence you send with a guarantee claim | To assess and pay a claim under the exam pass guarantee. | Contract, and legitimate interests (handling and defending claims) |
Please do not put sensitive personal information, such as health details, in your notes or submissions. We do not need it.
If your employer bought the course for you, your employer gives us your name and email address so we can create your account. We will not share your learning progress, notes or results with your employer unless you agree, or unless your employer needs a refund decision under the guarantee explained to them.
3.5 Emails we send you about your purchase
We send you service emails: order confirmation, account set-up and sign-in links, password resets, reminders before your access ends, notices that feedback is ready, and important changes to our terms. These are part of providing the service (contract) and are not marketing. You cannot unsubscribe from them while you have an active account.
3.6 Marketing emails
We send study tips, course news and offers only if you opted in by ticking the separate marketing box on one of our sign-up forms. Buying from us or asking for a free resource does not, on its own, sign you up. Every marketing email has an unsubscribe link, or you can email us. If you unsubscribe, we keep your email address on a "do not contact" list so that we respect your choice.
3.7 When you contact us
If you email study@startaxed.com, or message us on LinkedIn or Facebook, we use your name, contact details and message to reply and to keep a record of the conversation. The lawful basis is legitimate interests (answering questions and keeping records), or contract if your message is about an order. Messages sent through LinkedIn or Facebook are also handled by those platforms under their own policies.
3.8 Testimonials
We publish a testimonial (your words, name, job title, photo or LinkedIn post) only with your permission. You can ask us to remove it at any time. Lawful basis: consent.
3.9 Data moved from our previous platforms
Until October 2026, our classroom ran on LearnWorlds and our mailing list on Mailchimp. If you had an account or subscription there, we moved your name, email address, enrolment and access dates, any case-study submissions still awaiting feedback, and your marketing preference to our new systems. We did this so you can continue studying without interruption (legitimate interests, and contract for active students). We did not move your learning progress or your password. You set a new password when you first sign in.
4. Do you have to give us your data?
You can browse the website without giving us any personal data. To get a free resource, we need your email address (and, for the free module, your name). To buy and study, we need the details listed in sections 3.3 and 3.4. Without them we cannot take your order, give you access or meet our tax obligations.
5. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe may automatically decline a payment it considers high risk. If that happens, contact us and we will help.
6. Who we share your data with
We do not sell your personal data, and we do not share it for advertising.
6.1 Service providers who process data for us
These providers act on our instructions under data processing terms:
| Provider | What they do for us | Where the data is |
|---|---|---|
| Vercel Inc. (USA) | Website and classroom hosting, security logs, cookieless website analytics (Vercel Web Analytics) | Application servers in Frankfurt, Germany; content delivered through a global network. Vercel is a US company. |
| Supabase Inc. (USA) | Classroom database and file storage | Hosted in Frankfurt, Germany. Supabase is a US company. |
| Resend (Plus Five Five, Inc., USA) | Sending emails, and storing our email contact list | Emails can be sent from EU servers, but Resend stores account and contact data in the USA. |
| Stripe Payments Europe Ltd (Ireland) | Payment processing, receipts, invoices, refunds | EU, with transfers to Stripe group companies, including in the USA |
| GoDaddy (USA) | Email hosting for our study@startaxed.com mailbox | GoDaddy is a US company, so data may be stored or accessed in the USA (see section 7). |
| Google Meet (Google) or Zoom (USA) | Video calls for 1-2-1 sessions (not recorded) | These are US companies, so data may be processed in the USA (see section 7). |
6.2 Other organisations that receive data as separate controllers
- Stripe, for its own fraud prevention and regulatory purposes (see section 3.3).
- Google, if you choose "Continue with Google" to sign in (you sign in on Google's own page, under Google's privacy policy), and when you play a YouTube video on our website. Our YouTube videos use YouTube's privacy-enhanced mode and load only when you press play. Until then, only the preview image is fetched from Google's servers.
- Vimeo, if a page includes a Vimeo video and you press play. The player loads from Vimeo only after you click.
- LinkedIn and Facebook, only if you follow a link to our pages there or message us. We do not use their tracking pixels.
- Professional advisers (accountant, lawyer), tax authorities, courts, police or regulators, where the law requires it or where needed to establish or defend legal claims.
- A buyer of our business. If StarTax Education is sold or transferred, your data may pass to the new owner, who must use it in line with this policy. We will tell you beforehand.
6.3 Former providers
LearnWorlds (our previous course platform) and Mailchimp (our previous mailing-list provider) still hold data from before the move in October 2026. We will close those accounts and ask for the data to be deleted within 3 months of the move.
7. International transfers
We are based in Poland, in the European Union. Some of our providers are in, or are owned by companies in, the USA, so your data may be accessed from or stored outside the European Economic Area (EEA) and the UK. When that happens, we rely on one of these safeguards:
- the EU-U.S. Data Privacy Framework (and its UK Extension), for providers certified under it (for example Vercel, Resend and Stripe), and/or
- the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), which are built into our providers' data processing terms (for example Supabase).
For a copy of the relevant safeguard, email study@startaxed.com.
8. How long we keep your data
| Data | How long |
|---|---|
| Classroom account and learning data (progress, quiz answers, notes, submissions, feedback) | While your access is active, then 12 months after it ends, so you can return, ask for an extension or make a guarantee claim. After that we delete it or make it anonymous. You can ask us to delete it sooner (see section 9). |
| Sign-in session records | Until the session expires (7 days without use) or you sign out, then deleted within 30 days. |
| Sign-in attempt (rate-limit) records | Minutes to hours. They are overwritten automatically. |
| Order, payment and invoice records | 5 years from the end of the calendar year in which the related tax was due, as Polish tax law requires (longer if a longer period applies to us, for example 10 years for EU VAT One-Stop-Shop records). |
| Guarantee claims, complaints and disputes | 6 years after the matter is closed, to deal with any legal claims. |
| Free-resource contacts without marketing consent | 24 months after your last request, then deleted. |
| Marketing contacts | Until you unsubscribe. After that we keep only your email address on a "do not contact" list. |
| Emails and messages with us | 3 years after our last contact, unless they relate to an order or claim (see above). |
| Hosting security logs | The short period set by our hosting provider (typically days). |
| Backups | Deleted data can stay in encrypted backups for up to 7 days until they are overwritten. |
9. Your rights
Depending on where you live, you have rights under the EU General Data Protection Regulation (GDPR) and, if you are in the UK, the UK GDPR. You can ask us to:
- give you a copy of your personal data (access);
- correct data that is wrong or incomplete;
- delete your data (for example, if we no longer need it);
- restrict how we use it while a concern is resolved;
- send your data to you or another provider in a commonly used format (portability), for data you gave us under a contract or consent;
- stop using your data where we rely on legitimate interests (you can object at any time, and we will stop unless we have compelling grounds);
- stop marketing. This right is absolute. Use the unsubscribe link or email us;
- withdraw consent at any time, where we rely on consent. This does not affect what we did before.
To use any of these rights, email study@startaxed.com from the address linked to your account (or tell us how to verify that you are you). It's free. We will reply within one month. If your request is complex, we may extend that by up to two more months and will tell you why.
Some rights have limits. For example, we cannot delete invoices we are legally required to keep.
10. Complaints
We'd like the chance to sort out any concern first, so please contact us at study@startaxed.com. You also have the right to complain to a data protection authority:
- Poland (our lead authority): Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl
- Elsewhere in the EU/EEA: the authority in the country where you live or work, or where the issue happened
- United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk
11. Security
We protect your data with encryption in transit (HTTPS), hashed passwords, access limited to people who need it, database access rules, and providers that hold recognised security certifications. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
12. Children
Our courses are designed for tax professionals and are not intended for anyone under 18. We do not knowingly collect data from children. If you think a child has given us data, please tell us and we will delete it.
13. Changes to this policy
We will update this policy when our services or the law change. The version and date at the top show the latest version. If a change significantly affects you, we will email you before it takes effect.
14. Contact
StarTax Education · Borys Ulanenko · Komuny Paryskiej 2/13, 30-389 Kraków, Poland · study@startaxed.com