Privacy Policy

Last updated: 23 June 2026

1. Who we are (data controller)

The controller of your personal data is VARVICO, a practitioner-run project based in Romania. You can reach us at contact@varvico.com.

We have not appointed a Data Protection Officer; our processing does not meet the threshold that would require one under GDPR Art. 37.

2. What personal data we collect

  • Email address — when you request the free guide, scope wizard, checklist or join a waitlist/launch list (collected via our capture form).
  • Name, email and payment details — when you buy a kit. These are collected and processed at checkout by our merchant of record (Lemon Squeezy); we do not see or store full payment-card data.
  • Order data — what you bought and your purchase history, received from the merchant of record.
  • Usage & device data — only if you consent to analytics (none currently in use).
  • Cookies / consent — see section 9.

3. Why we use it, and our legal basis

  • Delivering the kit or free resource you requested — performance of a contract / pre-contractual steps, GDPR Art. 6(1)(b).
  • Sending marketing & nurture emails — your consent, Art. 6(1)(a); withdrawable at any time via the unsubscribe link.
  • Security, fraud prevention and service improvement — our legitimate interests, Art. 6(1)(f).
  • Analytics — your consent, Art. 6(1)(a), only after you accept analytics cookies.
  • Accounting & legal obligations — compliance with law, Art. 6(1)(c).

4. Email marketing

If you opt in, we send a practitioner-written nurture sequence and occasional updates via Buttondown (our email service provider). Every email includes an unsubscribe link; unsubscribing stops marketing email immediately.

5. Processors & sub-processors

We share data only with providers that process it on our behalf under a data-processing agreement:

  • Lemon Squeezy LLC (US) — merchant of record: checkout, payment, invoicing and EU VAT. As seller of record, it is an independent controller for parts of the transaction.
  • Buttondown (US) — email capture, list management and delivery of marketing/nurture emails.
  • Vercel Inc. (US) — website hosting and server logs.
  • None — no analytics provider is currently in use; if one is added, it will be named here and loaded only after you consent.

6. International transfers

Lemon Squeezy and Vercel are US-based, so some data is transferred outside the EEA. These transfers rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as set out in each provider's data-processing agreement. Buttondown is also US-based; its transfers rely on the EU Standard Contractual Clauses under its data-processing agreement.

7. How long we keep it

We keep marketing-list data until you unsubscribe (your email is removed within 30 days of unsubscribing); purchase and accounting records for as long as required by Romanian/EU accounting and tax law (typically up to 10 years); and customer-support correspondence for up to 2 years after your last interaction. Analytics are held only in anonymous, aggregate form.

8. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these, email contact@varvico.com. You may also lodge a complaint with your supervisory authority — the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest; www.dataprotection.ro; anspdcp@dataprotection.ro; +40 318 059 211.

9. Cookies & consent

We use a single strictly-necessary cookie to remember your consent choice, so the banner doesn't reappear on every visit. It contains no personal data and is not shared with anyone. No analytics or advertising cookies are set unless and until you accept them in the cookie banner; declining keeps them off, and you can change your choice at any time via the banner.

10. Changes

We may update this policy; the effective date above reflects the latest version.

11. Contact

Questions about this policy or your data: contact@varvico.com.