[ LEGAL · 01 ]
Privacy policy.
This policy explains what personal data RIZZ UPSKILL collects, why we collect it, who processes it on our behalf and what rights you have under the General Data Protection Regulation (EU) 2016/679.
Last updated · 31 August 2026
01
Who we are
The data controller is SIA "RIZZ GROUP", a Sabiedrība ar ierobežotu atbildību (SIA), a limited liability company under the laws of Latvia, registration number 40203589324, entered in the Commercial Register (Komercreģistrs) of the Republic of Latvia on 18 September 2024, VAT number LV40203589324, registered office Strēlnieku iela 1A-7, Rīga, LV-1010, Latvia. We operate the RIZZ UPSKILL school and platform.
For anything about your data, write to privacy@rizzgroup.org. For general support, write to support@rizzgroup.org.
02
What data we collect
Account data
Email address, name and surname where you provide it, password credentials handled by our authentication provider, language choice, and your account activity such as sign in times.
Lead and waitlist data
Name, surname, email, occupation or company, the plan or product you were interested in, and the message you send us through a contact or community form.
Payment data
Order details, plan, amount, currency, billing country, VAT status and payment status. Card numbers never reach our servers. Card data is captured and stored by Stripe as an independent payment processor.
Usage and technical data
IP address, device and browser type, pages viewed, referrer and approximate region. Analytics data is only collected after you allow analytics cookies.
Learning data
Lectures accessed, progress, submitted work where a lecture requires it, and certificate records.
03
Lawful bases and purposes
| Purpose | Data | Lawful basis |
|---|---|---|
| Create and run your account, deliver lectures and materials | Account, learning | Contract, Art. 6(1)(b) |
| Process payments, invoices, VAT and refunds | Payment, account | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Answer contact, waitlist and community requests | Lead data | Contract steps and consent, Art. 6(1)(b) and (a) |
| Marketing email about the school and new lectures | Email, name | Consent, Art. 6(1)(a), withdrawable at any time |
| Analytics and product improvement | Usage data | Consent, Art. 6(1)(a) |
| Security, fraud prevention, service integrity | Technical, payment | Legitimate interest, Art. 6(1)(f) |
| Accounting and tax records | Payment, invoice | Legal obligation, Art. 6(1)(c) |
04
Processors and sub-processors
These are the providers that process personal data on our instructions.
| Provider | Role | Location |
|---|---|---|
| Stripe | Payments, subscriptions, invoices, fraud checks | EU and USA |
| Supabase | Authentication, database, file storage | EU region |
| Resend | Transactional and account email | EU and USA |
| DeepL | Translation of site copy into Russian and Latvian | EU, Germany |
| Plausible Analytics, only if enabled and only after consent | Privacy friendly usage analytics with no cross site tracking | EU, Germany |
| Cloudflare edge network | Application hosting and content delivery | EU with global edge caching |
We do not sell personal data. We share data with authorities only where the law requires it.
05
International transfers
Some providers process data outside the European Economic Area, mainly in the United States. Those transfers rely on the European Commission Standard Contractual Clauses, and where applicable on the EU to US Data Privacy Framework, together with additional technical measures such as encryption in transit and at rest. You can request a copy of the transfer safeguards from privacy@rizzgroup.org.
06
How long we keep data
- Account and learning data: for as long as your account exists, then 12 months after closure.
- Payment, invoice and tax records: 5 years from the end of the financial year, as Latvian accounting law requires.
- Lead, waitlist and contact data: 24 months from the last interaction, or until you ask us to erase it.
- Marketing consent records: for the life of the consent plus 3 years as proof of consent.
- Analytics data: 14 months, in aggregated form afterwards.
- Support correspondence: 24 months.
07
Your rights
Under the GDPR you can ask us to:
- Access the personal data we hold about you and receive a copy.
- Rectify data that is wrong or incomplete.
- Erase your data where we no longer need it or where you withdraw consent.
- Restrict processing while a dispute is resolved.
- Receive your data in a portable, machine readable format, or have it sent to another controller.
- Object to processing based on legitimate interest, including any profiling.
- Withdraw consent at any time, without affecting processing that happened before.
Write to privacy@rizzgroup.org. We answer within one month, and we may extend that by two further months for complex requests, telling you why.
You can also complain to the Latvian supervisory authority, Datu valsts inspekcija (DVI), Elijas iela 17, Riga, LV 1050, Latvia, or to the authority in your country of residence.
08
Cookies
Essential cookies keep you signed in and keep payments secure. Analytics and preference cookies only run after you allow them. See the cookie notice for the categories and how to change your choice at any time.
09
Children
RIZZ UPSKILL is for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to privacy@rizzgroup.org and we will erase it.
10
Security and changes
We use encryption in transit, access controls, row level security on our database and least privilege access for staff. No system is perfect, so we also keep an incident process and will inform you and the supervisory authority where the law requires it.
When this policy changes we update the date at the top of this page and, for material changes, we notify account holders by email.
11
Language of this policy
This page is published in English, Russian and Latvian. The English version is the authoritative and governing version, the Russian and Latvian versions are provided for convenience only, and in case of any conflict the English version prevails.