Privacy Policy

1. Who we are

This website, samstoffel.com, and the services offered through it are operated by Stoffel Media Group Limited ("we", "us", "our"), a company registered in England and Wales under company number 16101813, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are the "data controller" responsible for your personal data under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or about how we handle your personal data, you can reach us at:

• Email: sam@samstoffel.com
• Post: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

2. What this policy covers

This policy explains what personal data we collect about you, how and why we use it, who we share it with, how long we keep it, and the rights you have. It applies when you:

• visit or interact with our websites, landing pages, and funnels;
• sign up for a free resource, guide, scorecard, quiz, waitlist, or newsletter;
• register for or attend one of our webinars, workshops, or live events;
• message us or interact with us through direct messages or automated chat flows on social media, or through WhatsApp;
• buy a product, programme, subscription, or event ticket from us;
• otherwise contact us or engage with our marketing.

Our websites and services are intended for people aged 18 and over. See section 11.

3. The personal data we collect

Depending on how you interact with us, we may collect and process the following categories of personal data.

Identity data. Your name and any username or social media handle you use to interact with us.

Contact data. Your email address, telephone or mobile number, and, where relevant, your postal address or country.

Marketing and communications data. Your preferences for receiving marketing from us, your consent records, and your interaction history with our emails, messages, and content (for example whether an email was opened or a link was clicked).

Registration and event data. Information you give us when you register for a webinar, workshop, or event, and information about your attendance, including whether you attended live or watched a replay.

Quiz, survey, and application data. The answers you provide when you complete a quiz, scorecard, assessment, application form, or survey, including information about your business, audience, revenue range, goals, and challenges.

Transaction data. Details of products, subscriptions, or tickets you have purchased from us, and records of payments. We do not store your full card details. Payments are processed by our payment providers (see section 6).

Technical and usage data. Your IP address, browser type and version, device information, time zone setting, operating system, the pages and content you view, and how you move through our site. We collect some of this through cookies and similar technologies (see section 7).

Social media and messaging data. When you interact with us through comments, direct messages, story replies, automated chat flows, or WhatsApp, we receive the content of those interactions and the profile information the platform makes available to us.

We do not intentionally collect any special category data (such as health, race, religion, or political opinions). Please do not send us this kind of information.

4. How we collect your personal data

We collect personal data:

• Directly from you, when you fill in a form, opt in to a resource or newsletter, register for an event, complete a quiz or application, make a purchase, or contact or message us.
• Automatically, when you use our websites, through cookies and similar technologies, and through tracking pixels and analytics tools (see section 7).
• From third parties, such as social media and messaging platforms when you interact with our accounts or automated flows, our payment providers when you make a purchase, and our advertising and analytics providers.

5. How we use your personal data and our legal bases

Under the UK GDPR we must have a lawful basis for each way we use your personal data. The bases we rely on are: your consent; the performance of a contract with you or steps taken at your request before entering a contract; our legitimate interests (where these are not overridden by your rights); and compliance with a legal obligation.

Where we rely on consent, you can withdraw it at any time (see sections 8 and 10). Where we rely on legitimate interests, you can object at any time (see section 10).

6. Who we share your personal data with

We do not sell your personal data. We share it only with the following categories of recipient, and only as far as necessary.

Service providers who process data on our behalf. These act on our instructions under contract. Depending on which systems are live, they include:

• our funnel, checkout, course, and community platform, Subspot;
• our email marketing platform, Kit, used to send and manage emails, run our marketing automations, and store your contact and marketing data;
• ManyChat, which powers our automated direct-message and chat flows and captures details such as your email address;
• WhatsApp / Meta Platforms, where you contact us or receive utility or marketing messages through WhatsApp;
• Zoom, used to host and run our webinars and to manage registration and attendance;
• our SMS providers, used to send text-message reminders and updates where you have opted in;
• Stripe, our payment processor, and Klarna, where you choose to pay in instalments, which handle your payment information directly;
• connector and automation tools that pass data between the systems above;
• our scheduling and call-booking tool and our online form and quiz tools, used to book calls and collect the information you submit;
• analytics, advertising, and hosting providers, including Meta Platforms (see section 7 on the Meta Pixel and Conversions API).

Advertising and analytics partners. We use Meta (Facebook and Instagram) to advertise and to measure results. This may involve sharing limited data, such as a hashed version of your email address, so that Meta can match it to accounts and help us reach relevant audiences and measure conversions. See section 7.

Professional advisers and authorities. We may share data with our accountants, lawyers, insurers, and, where required by law, with regulators, courts, or law enforcement.

Business transfers. If our business is sold, merged, or reorganised, your data may be transferred to the new owner, subject to this policy.

7. Cookies and tracking technologies

Our websites use cookies and similar technologies (including local and session storage) to make the site work, to remember your preferences, and to measure and improve performance.

Essential cookies are needed for the site to function and do not require consent.

Analytics and advertising technologies are used only where you consent through our cookie banner (where a consent banner is shown to you based on your location). These include:

• the Meta Pixel, and where enabled the Meta Conversions API, which record actions such as viewing a page, registering for an event, starting a checkout, and completing a purchase, and which allow us to measure and optimise our advertising. This may involve sharing hashed identifiers, such as your email address, with Meta;
• UTM parameters and similar link tags, which help us understand which campaigns and sources bring people to us.

You can manage non-essential cookies through our cookie banner, and you can control cookies through your browser settings. Blocking some cookies may affect how the site works.

8. Marketing communications

If you have opted in, or where the law otherwise permits, we may send you marketing by email, SMS, and WhatsApp about our products, offers, events, and content.

You can opt out at any time:

• Email: click the "unsubscribe" link at the bottom of any marketing email.
• SMS: reply STOP to any marketing text (standard message and data rates may apply).
• WhatsApp: reply STOP, or tell us you wish to opt out.
• Or contact us directly using the details in section 1.

Opting out of marketing does not stop us sending you service messages, such as confirmations, receipts, or important information about a product or event you have signed up for.

9. International transfers

Some of the providers we use are based outside the United Kingdom, including in the United States. Where we transfer your personal data outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law, such as UK "adequacy" regulations, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

You can ask us for more detail about the safeguards we use by contacting us at the address in section 1.

10. Your rights

Under UK data protection law, you have the right to:

• access the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to erase your data in certain circumstances;
• ask us to restrict how we use your data in certain circumstances;
• object to our processing where we rely on legitimate interests, and to object to direct marketing at any time;
• request the portability of data you provided to us, in certain circumstances;
• withdraw consent at any time, where we rely on consent (this does not affect processing carried out before you withdrew it).

To exercise any of these rights, contact us using the details in section 1. We will respond within the time limits set by law, normally within one month. We may need to verify your identity first. Exercising your rights is free in most cases.

11. Children

Our websites, products, and services are intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. How long we keep your data

We keep your personal data only for as long as we need it for the purposes set out in this policy, and to meet legal, accounting, or reporting requirements.

• Marketing and lead data: we keep this while you remain subscribed and for up to 24 months after your last engagement with us, after which we review and delete or anonymise it.
• Customer and transaction records: we keep these for 6 years after your last purchase, to meet our legal and tax obligations.
• Support and correspondence: we keep this for up to 24 months after your query is resolved.

When we no longer need your data, we securely delete or anonymise it.

13. How we keep your data secure

We use appropriate technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access, and we require the providers who process data on our behalf to do the same. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

14. Third-party links

Our websites and content may link to third-party websites and platforms that we do not control. This policy does not apply to those sites, and we are not responsible for their privacy practices. Please read their policies before providing them with your data.

15. Changes to this policy

We may update this policy from time to time. When we do, we will change the "last updated" date at the top, and where the changes are significant we will take reasonable steps to let you know. Please check back periodically.

16. How to contact us and how to complain

If you have any questions, requests, or concerns about this policy or your personal data, contact us at sam@samstoffel.com or by post at the address in section 1.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you are unhappy with how we have handled your data. You can reach the ICO at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would appreciate the chance to address your concerns before you approach the ICO, so please consider contacting us first.