Last updated: 1 October 2026
This Privacy Policy explains how personal data is handled when you visit thelearningstrategist.eu (the “Website”), contact its operator, or follow a link to purchase a product. It is intended to provide the information required by Articles 13 and 14 of the EU General Data Protection Regulation (“GDPR”).
1. Data controller
The controller responsible for personal data processed through this Website is:
- Name or legal business name: Luca Vettor
- Business or postal address: Via Luzzatti 29, 10151 Torino, Italy
- Email for privacy requests: contact@thelearningstrategist.eu
- VAT or company number, if applicable: VAT number 01891590091
No Data Protection Officer has been appointed unless stated here: Not applicable.
2. Data processed when you visit the Website
Server and security logs
The web server and hosting infrastructure may automatically process technical information such as IP address, date and time, requested URL, response status, browser information, and referring page. This is used to deliver the Website, maintain security, diagnose faults, prevent abuse, and protect the Website and its users.
The legal basis is the controller’s legitimate interest in operating and securing the Website (Article 6(1)(f) GDPR). Logs should be retained only for the period reasonably necessary for security and troubleshooting, normally 1 day, unless a longer period is required to investigate an incident or comply with law.
Privacy-friendly website analytics
The Website uses WP Statistics to understand aggregate traffic and page performance. Analytics data is stored in the Website’s own WordPress database. The configured analytics do not use visitor-tracking cookies, IP addresses are anonymised and hashed, full user-agent strings are not stored, and logged-in user activity is not recorded.
The processing is limited to measuring and improving the Website and is based on the controller’s legitimate interest in understanding aggregate Website use (Article 6(1)(f) GDPR). Analytics records are retained for 1 year and then deleted or aggregated. You may object to this processing by contacting the controller.
3. Cookies
The public-facing analytics described above do not use cookies. WordPress may use strictly necessary cookies for administrators who sign in, including authentication, security, and interface-preference cookies. These cookies are required to provide the requested administrative functionality and are not used for advertising.
The Website uses Complianz to display its consent banner and record the visitor’s consent preferences. Strictly necessary consent storage is used to remember those choices. You can refuse non-essential technologies, change your preferences, or withdraw consent through the Website’s “Manage Consent” control. The current categories and services are described in the Cookie Policy (EU).
LinkedIn Insight Tag
Only after you give marketing consent, the Website activates the LinkedIn Insight Tag (partner ID 9471618), provided by LinkedIn. The tag may collect the page URL, referrer URL, IP address, timestamp, and device and browser characteristics, and may use cookies or pseudonymous identifiers. The purposes are to measure LinkedIn advertising conversions, produce aggregate campaign reports and audience insights, and create website retargeting audiences.
The legal basis is your consent under Article 6(1)(a) GDPR and applicable rules on storing or accessing information on a device. The tag remains blocked unless and until marketing consent is given. Enhanced matching is disabled, so the Website does not send email addresses to LinkedIn through this implementation. LinkedIn states that remaining pseudonymised Insight Tag data is deleted within 180 days and that data is stored on its servers in the United States and Canada. See LinkedIn’s Insight Tag privacy information, Privacy Policy, and Cookie Policy.
4. Gumroad purchases and external links
The Website contains links to products sold through Gumroad. When you select a purchase link, you leave this Website and interact directly with Gumroad. Gumroad may receive technical information such as your IP address and referring URL and, if you purchase, the contact, billing, payment, tax, and transaction information required to complete the order.
Gumroad processes payment information under its own terms and privacy notice. The Website operator does not receive or store your complete payment-card details. As a seller, the Website operator may receive customer and transaction information made available by Gumroad in order to fulfil the contract, deliver products, provide support, prevent fraud, keep accounting records, and meet tax or other legal obligations.
The applicable legal bases may include steps requested before entering a contract and performance of a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c)), and legitimate interests such as fraud prevention and customer support (Article 6(1)(f)). The controller does not intentionally keep a separate copy of customer or accounting records outside Gumroad unless required for legal, tax, contractual, or dispute-resolution purposes. Where records qualify as accounting documents under applicable Italian law, they may be retained for up to 10 years from the last entry, or longer where required by an official proceeding. See Gumroad’s Privacy Policy for details of Gumroad’s processing.
5. Communications
If you contact the controller by email or another stated channel, the controller processes the information you provide, such as your name, email address, message, and related correspondence, to respond to your request.
The legal basis is taking steps at your request or performing a contract where the communication concerns a purchase (Article 6(1)(b) GDPR), or the controller’s legitimate interest in responding to enquiries and maintaining business records (Article 6(1)(f)). Enquiry records are normally retained for 1 year, unless needed for a contract, legal claim, or statutory obligation.
Reader feedback survey
The optional reader survey collects the resource you select, how far you have used it, any answers you choose to provide, and your permission choices. No name or email is needed to give feedback. An email is requested only if you allow follow-up; a display name is requested only if you allow a named quotation. Please do not include confidential information or sensitive personal data.
With your consent (Article 6(1)(a) GDPR), Luca Vettor uses your response to understand readers’ experiences and improve the books and resources. Separate optional consent is requested for follow-up by email and for publishing an excerpt on this Website or its Gumroad book listings. Skipping either choice means no permission is given for that purpose. Feedback does not subscribe you to the newsletter. Excerpts are reviewed before publication and may be shortened without changing their meaning.
Responses and submission dates are stored in the Website’s WordPress database using Forminator, on the hosting described above. The form has no external service integration and does not send response emails automatically. Raw survey responses are scheduled for deletion after 365 days. Forminator’s submission IP addresses are scheduled for anonymisation after one day; the separate server and security logs described above may also apply. Approved published excerpts and the record of permission for them may be retained for as long as the excerpt is used.
You can withdraw any survey permission or request deletion by emailing contact@thelearningstrategist.eu. Withdrawal does not affect processing already lawfully carried out. For feedback sent without contact details, include the approximate submission date and enough of your response to help locate it. No excerpt is published automatically.
6. Newsletter and customer email
The Learning Strategist Newsletter is the public newsletter, managed through Substack. Newsletter buttons on this Website take you to Substack, where you enter your email and complete your subscription. The Website does not collect your email through a public MailPoet newsletter form.
Substack processes the information you provide and technical information associated with your use of its service. It makes subscriber information, including your email address and subscription status, available to the publication operator so the requested newsletter can be delivered and your subscription managed. See Substack’s Privacy Policy for its own processing, cookies, and international transfers.
The operator uses subscriber information to send the requested newsletter, manage preferences, document consent, process unsubscribes, and protect the mailing list from abuse. The legal basis for the operator’s newsletter processing is your consent under Article 6(1)(a) GDPR. You may withdraw consent using the unsubscribe link in an email or by contacting the controller. Withdrawal does not affect processing carried out before it.
MailPoet remains installed for legacy subscription records and customer lifecycle email, such as book onboarding and relevant product updates. These communications are separate from the newsletter. Existing legacy newsletter subscribers have not been automatically transferred to Substack or classified as customers. Buying a book or submitting reader feedback does not automatically subscribe you to the newsletter.
MailPoet records are stored in the Website’s WordPress database. The MailPoet Sending Service, operated by Automattic, may process delivery logs and information needed for emails sent through that service. See Automattic’s Privacy Policy and MailPoet’s data-processing information.
Subscriber records are retained only for the relevant subscription and limited suppression, consent, security, or legal-record purposes where necessary to honour your choices and demonstrate compliance. You can request deletion of legacy records by contacting the controller. Public comments and public user registration remain disabled.
7. Recipients and processors
Personal data may be processed by service providers only where necessary to operate the Website and business, including:
- Website hosting provider: OVHcloud, headquartered in Roubaix, France — OVHcloud Privacy Policy
- Gumroad: ecommerce, payment, product-delivery, fraud-prevention, and tax-related services
- Substack: public newsletter subscriptions and newsletter delivery
- MailPoet / Automattic: legacy subscription records and customer lifecycle email
- LinkedIn: advertising measurement, conversion tracking, aggregate campaign reporting, and website-audience services, only after marketing consent
- Professional advisers and public authorities: where necessary for legal, accounting, security, or regulatory purposes
Processors are expected to act only on documented instructions, apply appropriate safeguards, and process no more data than necessary for the relevant service.
8. International transfers
Some service providers, including Substack, Gumroad, Automattic/MailPoet, and LinkedIn, may process data outside the European Economic Area. LinkedIn states that Insight Tag data is stored in the United States and Canada and that it participates in the EU-U.S. Data Privacy Framework for relevant transfers. Where the GDPR requires it, transfers must rely on an adequacy decision, approved Standard Contractual Clauses, or another lawful safeguard. Contact the controller to request information about the safeguard relevant to your data.
9. Data retention
Personal data is kept only as long as necessary for the purpose for which it was collected, including security, contractual, accounting, tax, and legal-claims requirements. The specific periods are stated above where known. The controller should periodically review retained data and securely delete or anonymise data that is no longer required.
10. Your GDPR rights
Subject to the conditions and exceptions in applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.
To exercise a right, email contact@thelearningstrategist.eu. The controller may request information reasonably necessary to verify your identity. You also have the right to lodge a complaint with the supervisory authority in the EU country where you live or work, or where the alleged infringement occurred. In Italy, the supervisory authority is the Garante per la protezione dei dati personali.
11. Security
The controller applies reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, or disclosure. No internet service can guarantee absolute security.
12. Automated decision-making
The Website does not use personal data to make solely automated decisions that produce legal or similarly significant effects. Third-party payment and fraud-prevention services may use automated tools under their own notices and responsibilities.
13. Changes to this policy
This policy may be updated when the Website, service providers, or legal requirements change. The latest version will be published on this page with a revised “Last updated” date. Material changes should be communicated where required by law.