Privacy Policy

§1. Who is responsible for your data

1. The controller of personal data collected on the truelife.school website (the "Website") is Tutlo spółka z ograniczoną odpowiedzialnością (Tutlo sp. z o.o.) with its registered office in Warsaw, ul. Nowogrodzka 42/501, 00-695 Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register under KRS number 0001021377, NIP (tax ID) 7011130879, REGON 524550960 — the company developing the True Life School project. Below we simply say "we".
2. For anything concerning your data, write to hello@truelife.school or by post to the registered address. One mailbox for everything — no special addresses to hunt for.

§2. What data we collect

Only what you leave with us — plus a technical minimum:

• Waitlist and interest forms (such as "Join" and "Start"): the parent's first and last name, e-mail address, phone number (if you provide one), city, and your answers to a short questionnaire — including the child's age (range only, e.g. 7–9 years), what school the child attends now, when you would like to join, which exam track interests you, what bothers you about school today, how you heard about us, and any question you leave for us.
• Property submission: name, e-mail, phone, city, the property's address or location, its type and area, and any additional information you enter.
• Consent records: which consents were ticked, when, and which version of the wording — so we can demonstrate we have your consent (the GDPR requires this of us).
• Technical data: standard infrastructure logs (IP address, browser type, request time), recorded automatically by our hosting provider. They serve the security and stability of the Website.
• How you found us: if you arrive through a link from one of our campaigns, we attach that link's parameters (source, campaign and ad name) and the page where your visit started to your submission.
• Advertising data — only with your consent: information collected by the Meta Pixel and shared with Meta when you join the list. We describe it in §4 and §6.

Providing your data is voluntary — but without it we cannot put you on the waitlist or evaluate a submitted property. We would simply have no way to reach you.

§3. Why, and on what legal basis

Purpose	Legal basis (GDPR)	For how long
Running the waitlist and updating you on True Life School's progress in your city	Art. 6(1)(a) — your consent	Until consent is withdrawn, at most 3 years from your last activity
Sending information about our products and services (e-mail, phone)	Art. 6(1)(a) — your consent	Until consent is withdrawn
Evaluating a submitted property and contacting you about it	Art. 6(1)(b) — pre-contractual steps taken at your request	Until the evaluation ends, at most 2 years
Responding to your messages and complaints	Art. 6(1)(f) — our legitimate interest	For the duration of the matter and up to 12 months after it closes
Website security and stability (technical logs)	Art. 6(1)(f) — our legitimate interest	Up to 12 months
Demonstrating consents and defending against claims	Art. 6(1)(f) — our legitimate interest	For the limitation period of claims
Checking which campaign or ad a submission came from (link parameters)	Art. 6(1)(f) — our legitimate interest in assessing how well our communication works	As long as the submission itself
Measuring how well our ads on Facebook and Instagram work and choosing who sees them (Meta Pixel and Conversions API)	Art. 6(1)(a) — your consent to "Advertising" cookies	Until consent is withdrawn; Meta cookies expire after 90 days

Withdrawing consent is as easy as giving it: write to hello@truelife.school or click the opt-out link in a message. Withdrawal does not affect the lawfulness of processing before that moment — and carries no consequences.

§4. Who we may share data with

We share your data only with these recipients:

• Trusted IT providers — hosting and infrastructure (including Cloudflare) and tools for sending e-mails and handling submissions. They act on our instructions, under data processing agreements.
• Meta Platforms Ireland Limited (Facebook, Instagram) — only if you consent to "Advertising" cookies. The Meta Pixel then shares information about your visit. When you join the list, our server shares that signup with Meta together with your e-mail address, phone number, first and last name and city as a one-way hash (SHA-256), plus your IP address, browser details and identifiers from Meta cookies. We are jointly responsible with Meta for collecting and transmitting this data (joint controllership, Art. 26 GDPR). After that, Meta processes it as a separate controller under the Meta Privacy Policy. Meta may transfer data to Meta Platforms, Inc. in the USA on the basis of the European Commission's decision on the EU-U.S. Data Privacy Framework or standard contractual clauses.
• Public authorities — only where the law requires it.

We do not sell your data. To anyone. As a rule, we process data within the European Economic Area. If any provider (such as global infrastructure) also processes data outside the EEA, we ensure the safeguards required by the GDPR — in particular the standard contractual clauses approved by the European Commission.

§5. Your rights

The GDPR gives you a full set of rights — and we make exercising them easy:

• Access — you can ask what data we hold about you and get a copy.
• Rectification — you can correct outdated or inaccurate data.
• Erasure — you can ask us to delete your data (the "right to be forgotten").
• Restriction — you can ask us to do nothing with your data beyond storing it.
• Portability — you can receive your data in a machine-readable format.
• Objection — you can object to processing based on our legitimate interest.
• Withdrawing consent — at any time, no reason needed.

An e-mail to hello@truelife.school is enough. We respond within a month at the latest.

If you believe we process data unlawfully, you can lodge a complaint with the President of the Polish Data Protection Authority (PUODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). We'd appreciate it if you wrote to us first, though — most matters can be sorted out right away.

§6. Cookies and browser storage

1. Advertising cookies run only with your consent. We show no ads on this site and we never sell your data. Without consent to the "Advertising" category we load no Meta code at all.
2. Essential — always on: infrastructure cookies needed for security and performance, and the browser's storage, where we save things like the progress of a form you are filling in and, until your visit ends, the parameters of the campaign link you came from. That data stays on your device. Campaign parameters reach us only together with a form you send.
3. Analytics — only with your consent (we ask with a banner on your first visit; nothing runs before you agree):
   • PostHog (servers in the European Union) — shows us how the site is used: which pages you visit, what you click and where in a form people get stuck. We also record sessions in which form fields are masked — we cannot see what you type into them.
4. CRM and contact — only with your consent:
   • HubSpot (our CRM) — connects your form submission with your visit history on this site, so we know what mattered to you before we get in touch.
5. Advertising — only with your consent:
   • Meta Pixel (Facebook, Instagram) — sets the _fbp and _fbc cookies (valid for up to 90 days) and shares with Meta which pages you visit, whether you came from one of our ads and whether you joined the list. When you join, we also share that signup with Meta from our server (Conversions API) — details in §4. This tells us which ads bring signups, and lets Meta show them to the people most likely to be interested. If no choice was made in the banner, we also ask for this consent with a single question on the thank-you screen after you join the list. After a refusal in the banner we do not ask again.
6. You can withdraw consent at any time — with the button below. Withdrawal applies going forward: from that moment we stop collecting data in that category. When you withdraw consent to "Advertising", we also delete Meta cookies from your browser.

   Change cookie settings

§7. Children's data

The forms on the Website are meant for adults — parents and guardians. About the child we ask only for an age range (e.g. 7–9 years); we collect no names or any identifying data of children. If the Project reaches the stage of actual school enrollment, we will describe the rules for processing pupils' data separately — with the safeguards children deserve.

§8. How we protect data

We apply measures appropriate to the project's scale and stage, including:

• encrypted data transmission (SSL/TLS);
• access to data only for people who genuinely need it;
• minimisation — we collect only the data needed for a specific purpose;
• vetted infrastructure providers.

§9. Changes to this Policy

The Website will evolve, so this Policy may change too. The date at the top of the page always shows the version in force. We will announce material changes on the Website — and if we have your address, also by e-mail. If a change required new consent, we would simply ask you for it.

§10. Contact

For anything concerning your data:

• E-mail: hello@truelife.school
• Address: Tutlo sp. z o.o., ul. Nowogrodzka 42/501, 00-695 Warsaw, Poland

Doubts, a question, or want to check something? Write to us — we reply quickly, and like humans.