Rubelis OÜ
Privacy Notice
Last updated: 19 August 2026
1. Who we are
Rubelis OÜ ("Rubelis", "we", "us", "our") is the data controller responsible for your personal data in connection with your use of rubelis.com and the Rubelis Beyond, Rubelis Beyond Instructor, Rubelis Beginners, and Beyond Junior programmes (together, the "Services").
| Company name | Rubelis OÜ |
| Registry code | 17579501 |
| Registered address | Tartu mnt 67/1-13b, 34149 Tallinn, Estonia |
| Legal form | Osaühing (OÜ) — private limited company, Estonia |
| Contact (general) | [email protected] |
| Contact (privacy) | [email protected] |
2. Scope of this notice
This notice applies to the English-language version of rubelis.com and to Stripe-based purchases of Rubelis Beyond, Rubelis Beyond Instructor, Rubelis Beginners, and Beyond Junior. It does not apply to the Turkish-language version of rubelis.com, which is operated by a separate entity under separate terms.
3. What personal data we collect and why
We collect only the personal data necessary to provide the Services, and we process it on the legal bases set out below.
| Data | Purpose | Legal basis |
|---|---|---|
| First name, last name | Creating and administering your account | Performance of a contract |
| Email address | Account access, service communications, sending your course access | Performance of a contract |
| Phone number (where provided) | Support, where you have asked us to contact you this way | Performance of a contract / legitimate interest |
| Programme purchased and course progress | Delivering the Services you purchased | Performance of a contract |
| Certificate / access-code data | Issuing and verifying your Rubelis Beyond certificate | Performance of a contract |
| Payment confirmation data (name, email, order reference — never full card details) | Processing your payment via Stripe | Performance of a contract |
| Billing/invoice data | Accounting and tax compliance | Legal obligation |
| IP address, device/browser data, login records | Security, fraud prevention, keeping the Service working correctly | Legitimate interest |
| Marketing email address (only if you opt in) | Sending you news, offers and updates | Consent |
| Analytics data (via Google Analytics, only after consent) | Understanding how the Service is used, improving it | Consent |
| Advertising data (via Meta Pixel, only after consent) | Measuring and improving our advertising | Consent |
We do not ask for or knowingly collect health information. We do not collect date of birth for our adult programmes. Beyond Junior processes the child's date of birth for age-group determination as described in the Children's Privacy Notice. If you send us health-related information voluntarily (for example, in a support message), we use it only to respond to you and do not retain it as part of your permanent profile.
4. Where your data goes — recipients and international transfers
Personal data may be shared with service providers and third-party technologies where necessary to operate and deliver the Services, and, where applicable and subject to the user's consent, for analytics and advertising measurement purposes. The categories and purposes of such processing are described below. We do not sell personal data.
| Provider | Role | Data involved | Location / transfer basis |
|---|---|---|---|
| Stripe | Payment processing | Name, email, order/payment reference (never full card number) | EU and US — Stripe participates in the EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| SendGrid (Twilio) | Transactional email delivery | Name, email, email content | EU and US — Standard Contractual Clauses |
| Google Analytics | Website analytics (only after your consent) | IP address, device/browser data, usage data | EU and US — Standard Contractual Clauses |
| Meta Pixel | Advertising measurement (only after your consent) | Device/browser data, usage data | EU and US — Standard Contractual Clauses |
| Hosting/infrastructure provider | Hosting the platform and database | All account and course data | Hosted on third-party cloud infrastructure |
Where personal data is transferred outside the European Economic Area, we rely on the European Commission's adequacy decisions, the EU-US Data Privacy Framework, or Standard Contractual Clauses, as applicable to each provider.
5. How long we keep your data
| Data | Retention |
|---|---|
| Active account data | For as long as your account remains active |
| Deleted account data | Deleted within a reasonable period following your deletion request, subject to Section 8 |
| Server and security logs | Up to 180 days |
| Support correspondence | Up to 3 years |
| Marketing consent records | Until you withdraw consent, plus a minimum record kept to demonstrate that consent was given |
| Invoices and accounting records | As required by Estonian accounting and tax law |
| Certificate verification data | For as long as needed to allow verification of a genuine Rubelis Beyond certificate |
6. Cookies
We use strictly necessary cookies to operate the Service, and — only with your consent, given through our cookie banner — analytics cookies (Google Analytics) and advertising cookies (Meta Pixel). You can withdraw or change your consent at any time through the cookie settings link in the website footer. For more detail, see our separate Cookie Policy.
7. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with a supervisory authority
To exercise these rights, contact us at [email protected]. We will respond within one month of a verified request.
8. Supervisory authority
If you are not satisfied with our response, you have the right to lodge a complaint with:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia — [email protected] — www.aki.ee
You may also contact the data protection authority in your own EU/EEA country of residence.
9. Children
Except for Beyond Junior, our Services are intended for individuals aged 18 and over. Beyond Junior is available to children aged 8-14 through registration and consent by a parent or legal guardian. Children's data is processed in accordance with the Children's Privacy Notice.
10. Security
We apply appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), hashed password storage, restricted administrative access, and access logging. No system is completely secure, and we cannot guarantee absolute security.
11. Changes to this notice
We may update this notice from time to time. The "last updated" date at the top of this page reflects the most recent version. Material changes will be communicated to registered users by email.
12. Contact us
Rubelis OÜ, Tartu mnt 67/1-13b, 34149 Tallinn, Estonia
[email protected]