← Payment from abroad

Privacy Policy

Protocol 42 Limited · Version 1.0 · Effective from 1 September 2026

Русская версия

1. Who we are

Protocol 42 Limited, a company registered in England and Wales under number 15407925, registered office 7 Bell Yard, London, England, WC2A 2JR (“we”, “us”).

For questions about your personal data: info@bibikov.pro

We are the data controller for personal data processed when you buy or take part in the Storyteller programme in euro.

This policy applies to purchases made in euro and to participation in the international programme. Purchases made on the same website in another currency are made from a different seller, who is a separate and independent controller and publishes its own privacy notice. This policy does not cover those purchases.

We have not appointed a Data Protection Officer; we are not required to.

We have not appointed a representative in the European Union. Our processing of EU residents’ data is occasional, is not carried out on a large scale, does not involve special categories of data, and is unlikely to result in a risk to the rights and freedoms of individuals, so the exemption in Article 27(2)(a) of the EU GDPR applies. EU residents can contact us directly at info@bibikov.pro, and may complain to their local supervisory authority.

2. What data we collect

You give us directly

  • Forms on the website: name, email address, phone number, promotional code.
  • Your account on lk.bibikov.pro: email address, password (stored hashed), two-factor authentication settings, intake questionnaire responses, homework submissions including voice recordings, messages you post in session chat.
  • Premium Tier: your postal address, to send you the printed certificate.
  • Correspondence: emails you send to info@bibikov.pro, messages you exchange with our Telegram bot (Telegram ID, username, message content).

Generated when you use the service

  • Order data: product and tier purchased, amount, currency, payment and refund status, Stripe payment reference. We never receive or store your full card number.
  • Login sessions and access logs for your account.
  • Attendance and progress records.
  • Recordings of lectures and sessions in which you appear: your image, voice and the name shown.
  • Where you have consented: analytics about how you use the website, and the source of your visit (utm parameters, referrer, landing page).
Purpose Legal basis
Taking your order, giving you access, running the programme, sending service emails Performance of a contract
Keeping accounting and tax records Legal obligation
Support, security, fraud prevention, defending legal claims Legitimate interests
Website analytics and non-essential cookies Consent
Marketing emails about our other programmes Consent, or soft opt-in if you already bought from us
Recording sessions and making recordings available to their participants Performance of a contract
Using short fragments of recordings on our social media and in promotional materials Legitimate interests — you can object at any time

You can withdraw consent at any time. Every marketing email has an unsubscribe link. Withdrawing consent does not affect processing carried out before you withdrew it.

Voice recordings are used only to give you feedback on your assignments. We do not use them to identify you, and they are not biometric data.

4. Who we share it with

Recipient What they receive Where Safeguard
Stripe Payment data, name, email UK / US Their data processing terms; UK Extension to the EU SCCs
Supabase Account and programme data Data centre in Frankfurt (EU) Their DPA; EU adequacy; UK Extension to the EU SCCs for support access from the US
Netlify Website hosting and functions US Their DPA; UK Extension to the EU SCCs or an IDTA
Email delivery provider Name, email, message content EU or US DPA; adequacy (EU) or UK Extension / IDTA (US)
Analytics provider Website usage data EU DPA; EU adequacy. Loaded only after you consent
Zoom Name, email, session participation EU / US Their DPA; UK Extension to the EU SCCs
Kinescope B.V., Emmen, Netherlands (KvK 84154799) Live broadcasts and session chat: the name shown in chat, an internal participant ID, chat messages, viewing data (IP address, device) Netherlands (EU) GDPR; EU adequacy
Namecheap Private Email Email correspondence US Their DPA; UK Extension to the EU SCCs
Postal or courier service Name and postal address (Premium Tier only) UK and your country Used only to deliver your printed certificate
Telegram Bot messages, Telegram ID Outside the UK and EU Governed by Telegram’s own terms; see section 5
People who help us deliver the Programme and support participants (teachers, curators, support team) Name, contact details, assignments, recordings, progress, messages UK, EU and other countries Access limited to what their role needs; they must keep it confidential
Social media platforms Short fragments of recordings that we publish on our accounts Worldwide Published only on our own accounts; you can object — see section 7

We do not sell your personal data and we do not share it for advertising purposes.

We disclose data to public authorities only where the law requires it.

5. Transfers outside the United Kingdom

Where we transfer personal data outside the UK, we rely on one of the following:

  • Adequacy — for the EU and other countries recognised by the UK as providing adequate protection.
  • UK Addendum to the EU Standard Contractual Clauses, or an International Data Transfer Agreement, together with a transfer risk assessment — for other countries, including the United States.

If you use our Telegram bot, your messages are processed by Telegram outside the UK and EU under Telegram’s own terms. If you would rather not use it, contact us by email instead.

6. How long we keep it

Data Retention
Account and programme data, assignments, voice recordings For the duration of your access period, then 12 months
Session chat messages 12 months after the end of your cohort
Recordings of lectures and sessions For the access period of your cohort, then 12 months; fragments published on social media until you object or we remove them
Order and payment records, invoices 6 years from the end of the relevant financial year (HMRC requirement)
Support correspondence 3 years
Marketing contact data Until you unsubscribe, then 2 years for suppression purposes
Analytics data 14 months

After these periods we delete the data or irreversibly anonymise it.

7. Your rights

You have the right to:

  • ask for a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have data erased, in certain circumstances;
  • restrict how we use your data, in certain circumstances;
  • receive data you gave us in a portable format;
  • object to processing based on our legitimate interests, including the use of recordings in which you appear;
  • withdraw consent at any time.

To exercise any of these, email info@bibikov.pro. We respond within one month. We may ask you to confirm your identity first.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you are in the EU, you may complain to your local supervisory authority.

8. Where data comes from, if not from you

We may receive your payment confirmation and billing details from Stripe, and, where a company buys a place for you, your name and contact details from that company.

9. Automated decision-making

We do not make any decisions about you by purely automated means, and we do not carry out profiling that produces legal or similarly significant effects.

10. Participants under 18

The Programme is intended for adults. A person under 18 may take part only if a parent or guardian purchases the Programme for them; the parent or guardian gives us the participant’s details and is responsible for their taking part. We do not verify age. A parent or guardian can exercise the participant’s rights by contacting us.

11. Do you have to give us this data

You do not have to, but we need your name, email address and payment details to enter into and perform the contract with you. Without them we cannot give you access to the programme. Everything else is optional.

12. Changes to this policy

We may update this policy. The current version is always published on this page with the date at the top. If a change materially affects you, we will tell you by email.

14. Contact

Protocol 42 Limited
7 Bell Yard, London, England, WC2A 2JR
Company number 15407925
info@bibikov.pro