1. Introduction
Secrets2Discover ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This policy explains how we collect, use, disclose, and safeguard your data when you visit our website, create an account, purchase digital products, subscribe to emails, or claim a purchase you made in our Skool community.
We process data in accordance with the GDPR (EU) 2016/679, the Dutch GDPR Implementation Act (AVG), and the Dutch Telecommunications Act.
2. Data controller
Secrets2Discover is the data controller responsible for your personal data.
Registered in: The Netherlands
Email:
3. What we collect
Your name and email when you buy something or create an account, your order details, and the usual technical data a website needs to work (IP address, browser, pages visited). In detail:
- Purchase and billing data: first name, last name, billing address, email, optional phone number.
- Account data (only if you choose to make an account): email address, encrypted password.
- Skool access data: when you claim a Skool purchase on our Access page: your Skool handle, the tour you claimed and the time you claimed it.
- Communication data: contact form messages, emails, support correspondence.
- Technical data: IP address, browser type, device info and pages visited, which our hosting needs to deliver and protect the website.
4. What stays in your browser
The website has a small game: the rooms you explored, your demo coins, the ghosts you caught, your familiar and your puzzle progress. All of that is saved only in your own browser (in localStorage, under the name s2d_house_v1). It is never sent to our server and we cannot see it.
You can wipe it any time with the "Make the house forget me" button at the bottom of every page, or by clearing your browser data. The demo coins have no money value.
5. Why we use your data, and the legal bases (Article 6 GDPR)
To deliver what you bought, to send you the unlock link, to answer your messages, and to keep the site running and safe. We do not sell your data. Mr. Sterces would never allow it.
- Contractual necessity: processing your order, payment processing, sending your unlock link, giving you access to your products, managing your account if you have one.
- Legal obligation: compliance with Dutch tax and accounting requirements.
- Legitimate interest: keeping the website working, fraud prevention, system security.
- Consent: promotional emails. You may withdraw consent at any time.
6. Payments
Payments go through WooPayments (Stripe) and PayPal. They handle your card details; we never see them.
7. Email marketing
If you create an account or purchase a product, we may send promotional emails. You can unsubscribe at any time via the link in any marketing email, or by contacting us directly.
We do not and will never sell your email address or personal data to third parties.
8. Who else sees your data
We share personal data only where necessary: payment providers, hosting providers, email service providers, and IT and security providers. All third parties operate under appropriate data processing agreements.
Some parts of the website load things from other services. Like any web request, these services receive your IP address:
- Videos in the Cinema: YouTube videos load only after you click play, through youtube-nocookie.com (YouTube's privacy enhanced mode). Before that click, nothing is loaded from YouTube. After it, YouTube's own privacy policy applies.
- The map in the Library: the map tiles come from OpenFreeMap (tiles.openfreemap.org). OpenFreeMap receives your IP address, like any web request. It sets no cookies.
- Fonts: the website's fonts load from Adobe Fonts and Google Fonts.
We do not sell personal data and never will.
9. What we do not use
No advertising cookies, no tracking pixels, no selling anything about you.
10. International data transfers
Any transfers outside the EEA are covered by Standard Contractual Clauses, adequacy decisions by the European Commission, and additional technical and organisational safeguards where necessary.
11. How long we keep it
- Purchase and billing data: minimum 7 years (Dutch tax law).
- Account data: until you delete your account.
- Skool access claims: as long as the account they are saved with exists. [Kim: check]
- Marketing data: until consent is withdrawn.
- Technical logs: a few weeks.
- Website game memory: in your browser only, until you clear it.
When data is no longer necessary, it is securely deleted or anonymised.
12. Your rights under GDPR
You have the right to: access your data, rectify inaccurate data, request erasure, restrict processing, object to processing, data portability, withdraw consent, and lodge a complaint. Email us and it happens.
Supervisory authority (NL): Autoriteit Persoonsgegevens
To exercise your rights:
13. Data security
We implement SSL encryption, secure hosting, encrypted passwords, access controls, and regular software updates (WordPress and plugins). No system can be guaranteed completely secure.
14. Children's privacy
Our website and digital products are not intended for individuals under 18. We do not knowingly collect personal data from minors.
15. Changes and contact
We may update this policy from time to time. The latest version will always be published here with an updated date.
Questions?
Looking for cookies? Read the Cookie Policy.