Test version: retention periods, supplier agreements and any international transfers still require verification before sales launch.
This policy explains how Liminis Education Center handles personal data when you contact us, enquire about training or use our training services.
Data controller
Summary
Liminis Education Center, a sole trader, is the controller for the processing described here. Postal address: Mor Annas väg 6, 443 51 Lerum, Sweden. Contact info@liminis.se with questions or rights requests.
Contact and quotation requests
Summary
The contact form processes your name, email, customer type, message and any company, phone, course, participant-count and programme details you provide. Requests are sent to our customer contact by email. We use this to answer questions and prepare potential orders, based on steps requested before a contract when you are the customer, or our legitimate interest in handling business enquiries and contact persons. Do not include sensitive personal data or card information in free text.
Purchases and course delivery
Summary
For purchases we process the order reference, course, language, amount, currency, payment and refund status, customer name, email, billing address and the version and time of accepted terms. Stripe collects payment details in its checkout. Our website does not collect or store full card numbers or security codes. Order details are stored in the website database for secure payment checks, delivery, payment documentation and support, based on the contract. Necessary accounting information is also processed to meet legal obligations.
Customer emails, withdrawals and complaints
Summary
We process purchase and customer email content, message references and delivery notifications such as delivered, delayed or bounced. Questions about defects and refunds are handled through our customer contact. The withdrawal function records the order reference, purchaser email, name, receipt time and acknowledgement delivery status. These support customer service, delivery checks and statutory rights, based on the contract, legal obligations and our legitimate interest in reliable, secure communication. An acknowledgement does not mean a refund has been completed.
Technical security and local storage
Summary
Cloudflare provides hosting, the database and Turnstile protection for the contact form. Verification sends a token and, when available, the IP address to Cloudflare. Network information is also needed to serve the website. Security processing is based on our legitimate interest in preventing abuse. The purchase button uses browser sessionStorage for the order reference and private status key to resume the same checkout; references are reused for up to 23 hours. This supports your requested purchase and does not track individual course progress.
Courses on Genially
Summary
The course button opens a presentation hosted by Genially. Genially receives technical information needed for the visit and may process data under its own terms and privacy information. LIMINIS does not put the purchaser name, email or order reference in the course link. The current website integration has no personal LIMINIS course account or individual record of a course being started or completed. For a course that includes a certificate, LIMINIS manually processes the participant name, course and necessary customer correspondence to issue and send the certificate after completion, based on the contract.
Suppliers and recipients
Summary
Stripe handles payments and receipts, Resend email delivery and events, Cloudflare hosting, the D1 database and form protection, and Genially course content. Suppliers receive information required for their functions. Their role as processor or independent controller depends on the service and applicable agreements. Data may also be disclosed to competent authorities where required by law.
Retention and deletion
Summary
Data should be retained only as needed for enquiries, contracts, support, legal claims or statutory duties. Six-month course access does not mean all order or accounting records are deleted after six months. The website currently has no automatic deletion of order, withdrawal or email-event records. Erasure requests are assessed individually; legal retention duties may prevent deletion. The business owner carries out a manual deletion review each quarter. Enquiries without a purchase are normally deleted 12 months after the last substantive contact unless negotiations or another documented need remain. Closed unpaid purchases and resolved technical delivery events are reviewed for deletion after 90 days; ongoing payments, retries and cases are excluded. Contract and rights documentation is reviewed after access ends and annually thereafter; only data needed for remaining legal claims or statutory duties is retained. Accounting records are retained for seven years after the calendar year in which the financial year ended. The legal duties of suppliers and verified retention terms may affect what we can delete with them.
Processing outside the EU/EEA
Summary
International cloud services require verification of storage locations, subprocessors and possible access from outside the EU/EEA. Public supplier agreements describe international processing and contractual safeguards such as EU Standard Contractual Clauses where applicable. The agreements and settings actually applying to all LIMINIS accounts have not yet been fully verified. We therefore cannot state that all data remains in the EU/EEA or that a specific transfer mechanism applies. Transfers and applicable safeguards must be verified and this information completed before card purchases open. Card purchases are currently paused. Contact info@liminis.se for information about applicable safeguards.
Your rights
Summary
You may request information and access, correction, erasure or restriction. You may object to processing based on legitimate interests. GDPR provides portability under its conditions for automated processing based on contract or consent. Where consent is the basis, you may withdraw it without affecting prior lawful processing. Rights are subject to conditions, including legal retention duties. Contact info@liminis.se. We may need to verify your identity and normally respond within one month. If a lawful extension is needed, we explain the reasons and deadline.
Complaints to IMY
Summary
You can complain to the Swedish Authority for Privacy Protection (IMY) if you believe your data is processed incorrectly. You do not have to contact us first, although you are welcome to. Information and the complaint service are available at www.imy.se.