Privacy Policy
The short version. We collect the minimum amount of personal data needed to send you what you asked for — a book update, a free lesson, a course you bought. We don't sell your data. We don't track you across the web. You can ask to see, change, or delete your data at any time by emailing riley.duarte.ccp@pm.me.
1. Who we are
CryptoPages Press is an independent publishing imprint operated by Esmael BV (hereafter "we", "us", "CryptoPages Press"), a Belgian private limited company registered under company number 0463.690.088, VAT number BE 0463.690.088, with a registered address at Liersesteenweg 175, 3200 Aarschot, Belgium.
For any question about this policy or your personal data, write to us at riley.duarte.ccp@pm.me.
2. What data we collect
We only collect data you actively give us, and only for a specific purpose.
When you sign up for the free intro lesson or newsletter
- First name (optional)
- Last name (optional)
- Email address (required)
- The date and time you signed up
- The consent you gave (i.e. "yes, send me the lesson and updates")
When you buy the book or the course
- Billing name and address (as required for a valid invoice under Belgian VAT law)
- Email address (for order confirmation and course access)
- Payment reference from our payment processor — we never see or store your card number
- Country, for EU VAT One-Stop-Shop reporting
When you contact us
- Whatever you choose to tell us in your message (name, email, question)
When you visit the website
Our website is hosted by Squarespace. Squarespace records standard server logs (IP address, browser type, pages visited) for security and site-analytics purposes. See our Cookie Policy for details.
3. Why we collect it (legal basis under GDPR)
- Consent (Art. 6(1)(a) GDPR) — for the newsletter and the free lesson. You said yes; you can say no at any time by clicking "unsubscribe" in any email or emailing us directly.
- Contract (Art. 6(1)(b) GDPR) — to fulfil an order for the book or course, including delivery, invoicing, and customer support.
- Legal obligation (Art. 6(1)(c) GDPR) — to keep VAT invoices and accounting records for the period required by Belgian tax law (currently seven years).
- Legitimate interest (Art. 6(1)(f) GDPR) — to run and secure our website, prevent fraud, and reply when you contact us.
4. Who we share your data with
We share personal data only with service providers who help us run the imprint. Each is bound by a written data-processing agreement.
- Squarespace, Inc. — website hosting and forms (EU–US Data Privacy Framework certified)
- Thinkific Labs Inc. — course platform, when you enrol in the course (Canada; adequate under GDPR)
- Our email delivery service provider — newsletter delivery (details available on request)
- Mollie B.V. — payment processing for orders (they act as an independent data controller for card data; based in the Netherlands, EU)
- Amazon KDP / IngramSpark — book distribution, if you order the paperback
- Our accountant and tax advisor — for invoices and legal compliance
We do not sell your data. We do not share it for advertising. We do not send it to any party outside the list above without your explicit consent.
5. How long we keep it
- Newsletter subscribers — until you unsubscribe, plus 30 days for our records
- Customer orders — seven years from the invoice date (Belgian tax-law retention period)
- Support emails — three years from the last exchange, then deleted
- Website server logs — as retained by Squarespace under their standard policy (typically 12 months)
6. International transfers
Some of our service providers (Squarespace, Thinkific, our email provider) are based outside the European Economic Area. Where that is the case, we rely on the European Commission's adequacy decisions, the EU–US Data Privacy Framework, or Standard Contractual Clauses to make sure your data is protected to a level essentially equivalent to that guaranteed by the GDPR.
7. Your rights under the GDPR
Because we process personal data of people in the EU, you have the following rights. To exercise any of them, email riley.duarte.ccp@pm.me. We will respond within 30 days.
- Access — a copy of the personal data we hold about you
- Rectification — corrections to inaccurate or incomplete data
- Erasure — "right to be forgotten" (subject to legal retention obligations, e.g. tax records)
- Restriction — pause our processing while a dispute is resolved
- Portability — your data in a structured, machine-readable format
- Objection — to processing based on our legitimate interest
- Withdraw consent — at any time, for anything you consented to
- Complaint — with the Belgian Data Protection Authority (Autoriteit voor Gegevensbescherming / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels
8. Security
We use industry-standard technical and organisational measures to protect your data: HTTPS on every page, strong passwords, two-factor authentication on all admin accounts, and encrypted storage on our providers. No system is perfectly secure; if we ever suffer a data breach that puts your rights at risk, we will notify you and the Belgian DPA within 72 hours, as required by Art. 33–34 GDPR.
9. Children
Our website, book, and course are not directed at children under 16. We do not knowingly collect personal data from anyone under that age. If you believe a minor has provided us with personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy occasionally — to reflect a new service provider, a legal change, or a clearer wording. When we do, we update the "Last updated" date at the top. For material changes (e.g. a new category of data collected), we will notify subscribers by email at least 14 days before the change takes effect.
11. Contact
CryptoPages Press · Esmael BV · Liersesteenweg 175, 3200 Aarschot · Belgium · KBO 0463.690.088
Email: riley.duarte.ccp@pm.me