Privacy and your course

Who runs this course

Robert Fischer is responsible for the personal data described in this notice. Contact hi@calibration.camera with questions or requests.

Course access and the optional newsletter

We use your email address, verification time and access records to provide the course access you request and send sign-in links. This is necessary to provide that service (GDPR Article 6(1)(b)). The first two lessons need no email address; later lessons require a verified address.

The newsletter is a separate choice, based on your consent (Article 6(1)(a)). Only checking its box when you confirm registration requests a subscription. We keep your email, the exact consent wording version and the time of that choice as evidence. Leaving it unchecked gives you the same course access. You can withdraw consent through a newsletter’s unsubscribe link or by contacting us; withdrawal does not change the lawfulness of earlier processing or remove course access.

Requests and security

Serving a page necessarily processes connection information such as your IP address. To limit repeated access emails, the course temporarily stores request counts keyed by the raw IP address or email address. These security records are separate from course-use totals. The purpose is to prevent abuse and keep access reliable, based on our legitimate interests (Article 6(1)(f)).

Cookies and learning on your device

A secure cookie proves that this browser has course access. By default it is a session cookie, with access lasting at most 12 hours. If you choose to stay signed in, it persists for up to 30 days. Browsers can restore sessions when reopened, so closing a browser is not a reliable sign-out. Use Sign out on a shared device.

Lesson progress, Python drafts and project work stay in this browser’s local storage until you reset them or clear site data. They are not linked to your email or synchronized between devices. Python runs on your device. Signing out keeps these drafts; clearing cookies may end access, and clearing site data also removes local learning.

Daily course-use totals

We count successful lesson requests, displayed access invitations, accepted requests to send access emails, new registrations, practice-ZIP requests and access-service errors. Each total contains only a day, a fixed category and, where relevant, a lesson number. Repeated visits and bots can count more than once: these are request totals, not unique learners, completed lessons or time spent.

These totals contain no emails, IP addresses, cookies, tokens, full URLs or individual event history. We add no analytics cookie, browser tracker, fingerprint or session recording, and do not collect Python code, outputs, reports or local progress for analytics. Processing requests into totals serves our legitimate interest in understanding course use and service reliability (Article 6(1)(f)); the totals remain private.

How long information is kept

Access links and sessions

Links stop working after 30 minutes or first use. Sessions end after at most 12 hours, or 30 days if remembered. Expired records become eligible for deletion.

Email request limits

Raw IP- and email-keyed counts are needed for one hour, then become eligible for deletion.

Daily totals

Totals older than 90 days become eligible for deletion.

Course membership

Your verified email is retained to provide continuing access until you request deletion or the service ends. The operator reviews whether this continued retention is still needed.

Newsletter consent evidence

Kept while consent is relied on and reviewed against subscription status at least annually. Afterwards, only evidence needed for a separately justified legal claim is retained for that claim’s applicable period.

A daily cleanup removes eligible records, normally within another day. Expiry immediately ends access or link validity; physical deletion can follow later and may be delayed by an outage. This cleanup covers the course database, not Mailjet’s contact records or provider delivery/security logs and backups. The operator reviews whether Mailjet contact records are still needed, including records from uncompleted registrations, at least annually and on deletion requests. Provider retention and backup arrangements are available from the operator.

Service providers and international processing

Cloudflare delivers the course and stores server-side access records and totals in D1. Mailjet handles access emails and, if you choose it, the newsletter. Sending an access email creates a contact record in Mailjet, even before you confirm registration. This does not subscribe you to a newsletter. Course newsletters use only the separate course list joined with your consent, never all email contacts. Access emails explicitly disable open and click tracking. These providers can process delivery, network and security information under their service arrangements.

EU placement of the D1 database does not make all processing EU-only: Cloudflare’s network and provider support or log processing can involve other countries. Where a transfer outside the EEA requires safeguards, the operator must use an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses. Contact us for the actual transfer arrangements and a copy of applicable safeguards.

Cloudflare privacy information · Mailjet privacy information

Your choices and rights

You can request access to your personal data, correction, erasure, restriction or portability where applicable. You can object to processing based on legitimate interests, including the processing used to create daily totals. Contact the operator above; we verify identity before disclosing or deleting account information. We do not use automated profiling to make decisions with legal or similarly significant effects.

Unsubscribing stops the newsletter. Deleting your course account removes its access; it does not reach into your browser to erase local drafts. Use the course’s reset control or your browser’s site-data settings for those. You can also complain to your local supervisory authority; the European Data Protection Board lists the authorities.