Privacy and Data Protection Policy

Academy of Chinese Swordsmanship Operated by the Great River Taoist Center

Effective date: 1 September 2025 Last updated: 31 May 2026

1. Introduction

We respect your privacy and are committed to protecting your personal data. This policy explains how we collect, use, and protect your data, and sets out your rights under the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and the California Consumer Privacy Rights Act (CPRA).

It applies to all visitors, users and members of our website at https://www.chineseswordacademy.com, and to our members portal, courses, community and email communications. By using our services, you accept the practices described here.

2. Who we are

The Academy of Chinese Swordsmanship is a trading name of the Great River Taoist Center, a US-based non-profit educational organisation, which is the data controller for your personal data.

Email: [email protected].

Address: 3543 Marvin Street, Annandale, VA 22003, USA.

Phone: (703) 846-8222.

3. What personal data we collect

Data you provide directly includes your name, email address, billing address, an optional phone number, payment details (processed securely by our payment providers), any responses to surveys or feedback forms, and information you share in the community, comments or support requests.

Data we collect automatically includes your IP address, browser type and version, time zone and device information, usage data such as which pages you visit and time spent, and cookies and tracking pixels used for analytics and advertising.

We do not knowingly collect or store special category data, such as health or biometric data. A profile photo you choose to upload is an ordinary image, not biometric data, and is optional.

4. How we use your data

We process your personal data to deliver the online courses, members portal and community content, to manage subscriptions and payments, to send service emails such as receipts, login details and important updates, to provide support and respond to enquiries, to run live webinars and group sessions, to improve our services and content through analytics, to comply with legal and tax obligations, and to send marketing communications where you have opted in.

5. Community and member visibility

The Academy is a community as well as a library. When you take part, other members of the same community space can see your display name, your profile and anything you post or comment. This is how a community works and is necessary to provide the service you have joined.

You control how much you share. You choose your display name, whether to add a profile photo, which is optional, and what you post. You can adjust your visibility and what you receive in your account settings. If you would rather not take part, contact us and we will help you limit this, although some visibility to other members is an unavoidable part of a shared community.

6. Legal bases for processing

We process your data under one or more of the following legal bases. We rely on contractual necessity to provide the services you signed up for, including the courses, members portal and community. We rely on consent for email marketing, advertising and analytics tracking, and other optional data collection, and you may withdraw consent at any time. We rely on legal obligation for tax, accounting and regulatory requirements. We rely on our legitimate interests in improving and securing our services, fraud prevention, and internal analytics.

7. How we share your data

We do not sell your personal data. We share it only with the providers and people needed to run the Academy.

Our platform, community, courses and communications run through GoHighLevel. Kartra handles billing for our original members, and membership.io provides archive and vault storage for member content. Payments are processed by Stripe and PayPal. We use Google Analytics and Meta (Facebook) to understand site usage and to measure and improve our advertising. Cloudflare provides our DNS and site security. Scott Rodell and the teaching team, as co-instructors, access the member and community information needed to teach and run the programmes. Other members of your community space can see your display name, profile and posts. We also share data with professional advisers and authorities where we are legally required, for example for accounting, legal advice, or to comply with the law.

All providers are bound by contract to protect your data and to use it only for the purposes we set.

8. International transfers

Several of our providers, and our organisation, are based in the United States, so your personal data may be transferred to and stored outside the UK and EU. Where we do this, we rely on safeguards recognised under data protection law, such as the UK extension to the EU-US Data Privacy Framework, Standard Contractual Clauses, and Data Processing Agreements, to protect your data to a similar standard as in the UK.

9. Your data rights

Under UK and EU GDPR you have the right to access the personal data we hold about you, to have inaccurate or incomplete data corrected, to have your data erased in certain circumstances, to restrict how we use your data in certain circumstances, to object to processing based on our legitimate interests and to direct marketing at any time, to data portability, and to withdraw consent at any time where we rely on it.

Under the California CPRA you have the right to know what personal information is collected, to delete your personal data, to opt out of any sale of data, which we do not do, and to non-discrimination for exercising your privacy rights.

To exercise any of these rights, contact us at [email protected]. We will respond within one month. There is normally no charge.

10. Cookies and tracking

We use cookies and similar technology for site functionality such as logins and video playback, for analytics through Google Analytics, and for advertising through the Meta (Facebook) pixel and retargeting. We do not set non-essential cookies, including analytics and advertising cookies, without your consent. You can manage your choices through the banner on our site or your browser settings.

11. Email marketing

We only send marketing emails if you have opted in. You can unsubscribe at any time using the link in any email or by contacting us. Service emails relating to your account, payments or course access are necessary to deliver the service and are not marketing.

12. Data retention

We keep your data only as long as needed to deliver the services you have signed up for, to comply with our legal obligations such as tax and accounting, generally for six years, and to resolve disputes and enforce agreements. We review inactive member data periodically and delete or anonymise it when no longer needed.

13. Children's privacy

Our services are not intended for users under 16. We do not knowingly collect data from children. If we learn we have done so, we will delete it.

14. Data security

We take appropriate technical and organisational measures to protect your data, including secure servers, SSL encryption, role-based access and routine backups. No method of transmission over the internet is completely secure, but we work to protect your data and to deal promptly with any issue.

15. Your right to complain

If you believe we have mishandled your data, please contact us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, to your local EU Data Protection Authority, or to the California Privacy Protection Agency (CPPA).

16. Changes to this policy

We may update this policy from time to time. The effective date above shows when it was last changed. Where changes are significant, we will tell members by email or a notice on the site.

17. Contact us

For any question about this policy or to exercise your data rights, contact the Academy of Chinese Swordsmanship at [email protected]. The data controller is the Great River Taoist Center, 3543 Marvin Street, Annandale, VA 22003, USA.