THE SSCA METHOD
Privacy notice
Last updated 21 October 2026. This notice explains how personal data is processed on sscamethod.com: the public pages and free resources, the webinars, the member account, enrolment and payment, and the English-language online course. It is issued under Regulation (EU) 2016/679 (GDPR) and the Hungarian Act CXII of 2011 on informational self-determination.
Who controls the data
The controller is Rajzelemzési Intézet Kft. (English designation: Institute of Projective Drawings), registered office 2141 Csömör, Mező u. 11., Hungary; company registration number Cg. 01-09-276756; VAT number HU13869274.
Privacy contact: support@sscamethod.com. We answer requests within one month (extendable by two further months for complex requests, with notice).
What we process and why
| Data | Purpose and legal basis | Retention |
|---|---|---|
| Name, email, profession, optional use case, quiz answers and score, landing variant and campaign (UTM) fields | Send the requested free resource and, with your consent, SSCA Method teaching, webinar and enrolment emails. Legal basis: consent (GDPR Art. 6(1)(a)), which you may withdraw at any time. | Until you unsubscribe or ask for deletion; a suppression record is kept so that the withdrawal is honoured. |
| Data from a Facebook/Instagram lead form you submit (name, email and the answers you give) | Same as the row above. Legal basis: consent. | Same as the row above. |
| Webinar registration: name, email and the session you chose | Send the access link and reminders and run the live session. Legal basis: consent. | Until you unsubscribe or ask for deletion. |
| Member account: name, email, password stored only as a bcrypt hash, session version, access entitlements, course progress, reset-token fingerprint | Create and secure your account and give you the content you are entitled to. Legal basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in account security (Art. 6(1)(f)). | For the life of the account; afterwards deleted or anonymised, except data covered by the course and accounting rows below. |
| Enrolment and billing: name, email, phone, billing address and country, personal or company invoice, company name and tax number, the product and price chosen, start preference, accepted terms version, the optional withdrawal-waiver statement, Braintree transaction and subscription IDs, the last four digits of the card and the Braintree payment token used for instalments | Conclude and perform the contract, take payments and instalments, issue invoices. Legal basis: performance of the contract and compliance with legal obligations (Art. 6(1)(c); Hungarian Act C of 2000 on Accounting, §169). Braintree holds the full card data; sscamethod.com receives only the items listed here. | Accounting records: 8 years (Act C of 2000, §169). Other enrolment data: for the term of the contract and until the general five-year limitation period has run (Hungarian Civil Code, §6:22). |
| Course participation: natural identification data (name, birth name, place and date of birth, mother's name), educational identification number where applicable, email, highest educational qualification, data on joining, progress, completion or leaving, exam results and final-paper assessment | Run the course, assess the exam and final paper, issue the certificate, and report the data required by law to the Hungarian Adult Education Reporting System (FAR). Legal basis: legal obligation under Act LXXVII of 2013 on Adult Education (§15, §21) and Government Decree 11/2020 (II. 7.). | Until the last day of the eighth year after the adult-education contract was concluded (Act LXXVII of 2013, §21(5)). |
| Content you send us: the final paper, questions, consultation messages, support emails | Assess your work and answer you. Legal basis: performance of the contract. Please anonymise any case material: remove health data and anything that identifies the person who made a drawing. | With the course records above. |
| Security counters derived from email and IP address, request time, technical and error logs | Prevent abuse, diagnose faults and protect accounts. Legal basis: legitimate interest. | A short operational period, then deleted; longer only while a specific incident is being investigated. |
| Cookieless page-view event: landing variant, limited campaign field and time | Measure which pages work, anonymously. Legal basis: legitimate interest. | Aggregated after the measurement period. |
| Necessary session cookie; currency cookie (rz_cur, set from your country); locally stored consent choice | Keep a member logged in, show prices in your currency and remember your cookie choice. Legal basis: necessary for the service you requested. | Session cookie: 30 days, or until you log out. Currency cookie: 12 months. Consent choice: until you clear your browser's site data. |
| Meta advertising event (Meta Pixel / Conversions API) | Measure advertising, only after you select Accept. Legal basis: consent. | Under Meta's retention terms and your browser controls. |
Providing data is voluntary. Name and email are needed to send a resource, run an account or deliver the course; billing data is needed to invoice a purchase; the course-participation data is required by law for an adult-education course, so the course can be delivered only with it.
Who receives the data
The following service providers process data on our behalf:
- Vercel Inc. (USA): website hosting, serverless functions and the member/order database (Edge Config).
- SalesAutopilot Kft. (Budapest, Hungary; Cg. 01-09-286773): mailing list, consent fields and customer records.
- Plus Five Five, Inc., operator of Resend (USA): delivery of resource, account, password-reset, receipt and course emails.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), operator of Braintree: card payments, stored card for instalments, fraud and 3-D Secure checks.
- KBOSS.hu Kft. (Budapest, Hungary; Cg. 01-09-303201), operator of számlázz.hu: issuing and storing invoices.
- Our external accountant (Hungary): bookkeeping and tax filings.
- BunnyWay d.o.o. (Slovenia) and Cloudflare, Inc. (USA): delivery of course videos and PDFs.
- Zoom Communications, Inc. (USA): live webinars.
- Meta Platforms Ireland Ltd. (Ireland): lead forms you submit on Facebook/Instagram, and advertising measurement after consent.
- Google and other static-file networks: web fonts and scripts on some pages; they receive ordinary request data such as IP address and browser type.
By law we also pass course-participation data to the Hungarian Adult Education Reporting System (FAR), operated by the state, and to authorities when a court or authority lawfully requests it.
Some of these providers are based in the USA, so data may be processed outside the EEA, under the transfer safeguards each provider applies under Chapter V of the GDPR. Personal data is used only for the purposes in this notice.
Emails and withdrawing consent
Every marketing email carries an unsubscribe link and a one-click unsubscribe header. Unsubscribing cancels the scheduled messages, updates SalesAutopilot and, where you have an account, its marketing preference. Account, security, payment and course messages are part of the service and keep arriving while you are enrolled.
Your rights
You may request access to your data, correction, deletion, restriction of processing and data portability, and you may object to processing based on legitimate interest. Withdrawing consent leaves earlier lawful processing valid. Data kept under a legal obligation (accounting, adult-education records) stays until its retention period ends. Members can view their basic account data and request deletion on the account page; all other requests go to support@sscamethod.com.
You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9-11., postal address 1363 Budapest, Pf. 9., phone +36 1 391 1400, ugyfelszolgalat@naih.hu, naih.hu, or to the data-protection authority of your own EU country. You may also go to court; in Hungary the case may be brought before the court of your place of residence.
Decisions with legal or similarly significant effect on you are made by people (Article 22 GDPR).
Cookies and optional measurement
The site works fully if you decline Meta measurement. Accept and Decline are equally available. Clear this site's browser storage to reset your choice.
Changes
We publish changes to this notice on this page; the date at the top shows the current version.