Legal
Privacy Policy
How Practical CSM collects, uses and protects your personal data. Last updated: 5 October 2026.
This policy explains what personal data Practical CSM collects when you use practicalcsm.com, why we collect it, who we share it with and what rights you have. We have tried to write it in plain English. If anything is unclear, email us at support@practicalcsm.com.
Contents
- 1. Who we are
- 2. What we collect, and when
- 3. Purposes and lawful bases
- 4. Marketing emails
- 5. Your accounts
- 6. Who we share data with
- 7. How long we keep data
- 8. Cookies and similar technologies
- 9. Security
- 10. Your rights
- 11. Complaints
- 12. Children
- 13. Changes to this policy
- 14. Contact
1. Who we are
The data controller is:
Practical CSM, a company registered in Poland
Radiowa 14 lok. 11, 01-485 Warsaw, Poland
Company Registration No. (REGON): 147136286
Email: support@practicalcsm.com
We have not appointed a Data Protection Officer because the law does not require one for a business of our size. Please send any privacy question to the email above.
The Practical CSM Academy (academy.practicalcsm.com), where certification and course learning take place, is a separate website with a separate login. When you buy a course here, we create or link your Academy account so that you can access it. The Academy is run by the same controller and follows this policy.
2. What we collect, and when
| Where you meet us | What we collect | Why |
|---|---|---|
| Downloading a free guide or resource (resource pages, guide popup, mobile slide-in) | Email address; which resource and campaign you came from; the consent text you saw; date and time; IP address (for spam protection) | To email you the download and to add you to our newsletter (see section 4) |
| Package advisor (“which package fits me”) | Email address; your advisor result; campaign; the consent text you saw | To email you your result and to add you to our newsletter |
| Saving your cart | Email address; the items in your cart; the consent text you saw | To email you a link back to your cart and to add you to our newsletter |
| Free account | Email address; password (stored hashed, so we cannot read it); your role if you choose to give it (for example individual contributor, leader, executive, job seeker); how you found the signup (for example which guide); email confirmation status; guides you have downloaded | To create and secure your account, confirm your email, and show guides that fit your role on your dashboard |
| Buying a course or certification | Name, email, billing address, country, company and VAT number (business buyers), order details, and how you reached the shop (for example the referring site or campaign). Payment is handled by Stripe or PayPal: we never see your full card number | To take payment, deliver the course, issue an invoice and meet tax law |
| Submitting an event to our events calendar | Your name and email; the event details you provide (title, date, time zone, host, link, description) | To review and publish the event. The event details are published on our calendar |
| Contacting us (contact form, email, booking a call) | Name, email, company, your message, and the booking time if you book a call | To answer you |
| Browsing the site | IP address, browser and device type, pages visited, referrer, approximate location from the IP address, and how you interact with pages (see section 8) | To keep the site secure, measure what works and improve it |
| Spam protection on forms | Data Google reCAPTCHA reads from your browser; a hidden anti-bot field | To block bots |
We do not ask for special category data (such as health or beliefs). Please do not send it to us.
3. Purposes and lawful bases (GDPR Article 6)
| Purpose | Lawful basis |
|---|---|
| Sending a guide, advisor result or cart link you asked for | Steps you asked us to take, or contract (Art. 6(1)(b)) |
| Newsletter and marketing emails | Consent (Art. 6(1)(a)), given through the consent line next to the button |
| Creating and running your free or paid account | Contract (Art. 6(1)(b)) |
| Processing orders, delivering courses and customer support | Contract (Art. 6(1)(b)) |
| Invoices, accounting and tax records | Legal obligation (Art. 6(1)(c)) under Polish tax and accounting law |
| Site security, fraud and spam prevention | Legitimate interests (Art. 6(1)(f)) in keeping the site and our users safe |
| Analytics and advertising measurement (Google Analytics, Google Ads, Microsoft Clarity) | Legitimate interests (Art. 6(1)(f)) in understanding and improving the site and our advertising (see section 8) |
| Publishing events you submit | Consent (Art. 6(1)(a)), given when you submit the event |
| Establishing or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can object at any time (section 10).
4. Marketing emails and unsubscribing
When you download a guide, use the package advisor, save your cart or create a free account, the form shows a line next to the button such as: “We email it to you. You join the Practical CSM newsletter; unsubscribe any time.” By submitting the form you agree to this. We use single opt-in: you join straight away and we do not send a second confirmation email for the newsletter. Free accounts do need a separate email confirmation before you can log in. At checkout you can choose whether to join the newsletter.
We send newsletters and short email series through Mailchimp. We add tags to your contact (for example which guide you downloaded, your advisor result, or that you saved a cart) so that we can send you relevant emails. We do not sell or rent your email address.
To unsubscribe: click “unsubscribe” in the footer of any of our emails, or email support@practicalcsm.com. Unsubscribing from marketing does not close your account or stop service emails about your orders.
Mailchimp records whether you open our emails and click the links in them, so that we can see what is useful. If you sign up on our site, it may set the pcsm_sub cookie (section 8) so that we stop showing you sign-up popups.
5. Your accounts
Your practicalcsm.com account and your Academy account are separate logins. You can update most of your profile in My account. To change anything you cannot edit yourself, or to close an account, email support@practicalcsm.com.
6. Who we share data with, and international transfers
We use the service providers below. They process data for us under data processing terms. Payment providers also act as independent controllers for their own legal duties (for example anti-money-laundering checks). Some providers are based in, or use sub-processors in, the United States. Where data leaves the European Economic Area (EEA), we rely on the safeguard shown.
| Provider | What for | Location | Transfer safeguard |
|---|---|---|---|
| Our web hosting provider | Hosting the website, forms, accounts and orders | Ireland (EEA) | Not needed (EEA) |
| Mailchimp (Intuit Inc. and The Rocket Science Group LLC) | Newsletter and marketing email | USA | EU-US Data Privacy Framework (DPF) certification, and Standard Contractual Clauses (SCCs) in Mailchimp’s data processing addendum |
| Stripe (Stripe Payments Europe Ltd, Stripe, Inc.) | Card and wallet payments | Ireland, with transfers to the USA | EU-US DPF certification (Stripe, Inc.) |
| PayPal (PayPal (Europe) S.Ã r.l. et Cie, S.C.A.) | PayPal payments | Luxembourg, with transfers within the PayPal group | PayPal Binding Corporate Rules and SCCs |
| Google (Google Ireland Ltd, Google LLC): Analytics, Ads, Tag Manager, reCAPTCHA, YouTube | Analytics, advertising measurement, tag management, spam protection, embedded videos | Ireland and USA | EU-US DPF certification (Google LLC) and SCCs |
| Microsoft Clarity (Microsoft Corporation) | Heatmaps and session recordings to improve the site | USA | EU-US DPF certification and SCCs |
| Vimeo (Vimeo.com, Inc.) | Embedded course and marketing videos | USA | EU-US DPF certification and SCCs |
| Fakturownia (Fakturownia sp. z o.o.) | Invoices, receipts, refunds and accounting records for orders | Poland (EEA) | Not needed (EEA) |
| Calendly (Calendly LLC) | Booking calls with a training specialist | USA | Standard Contractual Clauses in Calendly’s data processing addendum |
| Practical CSM Academy (academy.practicalcsm.com) | Course access and certification | Same controller | Not a third party |
Our forms (Gravity Forms) and shop (WooCommerce) are software installed on our own server, so the data you enter there stays on our server. We also share data when the law requires it (for example with the tax authorities), and with our accountant and professional advisers, who are bound by confidentiality. We do not sell personal data.
Videos: our YouTube videos load in privacy-enhanced mode (youtube-nocookie.com) and only after you click to play. Once a video plays, YouTube or Vimeo may set their own cookies under their own policies.
7. How long we keep data
| Data | How long |
|---|---|
| Newsletter contact and tags | Until you unsubscribe or ask us to delete it. After that we keep only your email address on a suppression list, so that we do not email you again |
| Form entries (guide, advisor, cart, contact) | Up to 2 years, then deleted |
| Free account | Until you ask us to close it |
| Orders, invoices and accounting records | 5 years from the end of the calendar year in which the related tax payment was due, as Polish tax law requires (Tax Ordinance, Articles 70 and 86), and longer only if a tax proceeding is still open |
| Certification records (Academy) | For as long as the certification remains valid, so that it can be verified |
| Email correspondence and support | 1 year after the matter is closed, unless it relates to an order or a legal claim |
| Event submissions | While the event is listed, then up to 2 years in our events archive |
| Analytics data (Google Analytics) | No longer than 14 months |
| Server and security logs | For a short period, unless needed to investigate an incident |
8. Cookies and similar technologies
Cookies are small files that a website stores in your browser. We also use browser storage (localStorage and sessionStorage), which works in a similar way.
Please note: at the moment the site does not show a cookie banner or offer a cookie settings panel. Analytics and advertising tags load when you visit. You can block or delete cookies in your browser settings, use Google’s opt-out add-on (tools.google.com/dlpage/gaoptout), or use a tracker-blocking extension. Blocking cookies may stop parts of the site (login, cart) from working. We plan to add a consent tool and will update this section when we do.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
wordpress_logged_in_*, wordpress_sec_* (cookies) |
Keep you logged in | Session, or 14 days with “Remember me” | Practical CSM |
wordpress_test_cookie (cookie) |
Checks that your browser accepts cookies | Session | Practical CSM |
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* (cookies) |
Remember your cart | Session to 2 days | Practical CSM |
sbjs_* (cookies) |
Record how you reached the shop (referrer, campaign) so that it can be stored with an order | Session | Practical CSM (WooCommerce) |
pcsm_sub (cookie) |
Remembers that you have already signed up, so that we stop showing sign-up popups | 365 days | Practical CSM |
pcmp (localStorage) |
Limits how often our popups and offers are shown (for example not again for 30 days after you close one) | Until you clear it | Practical CSM |
pcmp_s (sessionStorage) |
Shows at most one popup per visit | Until you close the tab | Practical CSM |
_ga, _ga_1H980EEZW0 (cookies) |
Google Analytics: counts visits and measures how the site is used | Up to 400 days | |
_gcl_au (cookie), _gcl_ls (localStorage) |
Google Ads: measures whether our ads lead to sign-ups or purchases | 90 days | |
| Google Tag Manager (script) | Loads the Google and Microsoft tags listed here | No cookie of its own | |
_clck, _clsk (cookies, if set) |
Microsoft Clarity: heatmaps and session recordings | Up to 1 year (_clck), 1 day (_clsk) |
Microsoft |
_GRECAPTCHA (cookie) |
Google reCAPTCHA spam protection on forms | Up to 6 months | |
Payment cookies, for example __stripe_mid, __stripe_sid |
Fraud prevention during checkout | Up to 1 year | Stripe, PayPal |
| YouTube and Vimeo cookies | Video playback and the provider’s own analytics, set only when you play a video | Set by the provider | Google (YouTube), Vimeo |
Our pages also load a small Mailchimp script that connects our shop to Mailchimp.
9. Security
We use HTTPS across the site, hashed passwords, spam protection, restricted administrator access and regular backups. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the supervisory authority as the law requires.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- rectify data that is wrong or incomplete;
- erase your data, unless we must keep it (for example invoices);
- restrict how we use your data;
- data portability: receive the data you gave us in a common machine-readable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time (for example by unsubscribing). This does not affect what we did before you withdrew.
How to use them: email support@practicalcsm.com and tell us what you want. A member of our team handles each request by hand. We may ask you to confirm that the email address is yours. We reply within one month. For complex requests this can be extended by two more months, and we will tell you if we need the extension. It is free unless a request is clearly unfounded or excessive.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Showing you guides that match the role you chose is personalisation, not such a decision.
11. Complaints
Please contact us first so that we can try to put things right. You also have the right to complain to the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl
If you live elsewhere in the EEA, you can also complain to the authority in your own country.
12. Children
Our services are for working professionals. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.
13. Changes to this policy
We will update this page when our services or the law change, and change the “Last updated” date. If a change is significant (for example a new use of your data), we will tell account holders and subscribers by email.
14. Contact
Practical CSM Marek Malinowski, Radiowa 14 lok. 11, 01-485 Warsaw, Poland
Email: support@practicalcsm.com
See also our Terms and Conditions.
