Privacy policy

Last updated: September 2026

Bricks in the Cloud respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how personal data is collected, used and otherwise processed when you visit our website, contact us, purchase our products or use our digital products and services.

1. Who We Are

Bricks in the Cloud is a registered trading name of Monde Avenir sàrl, a société à responsabilité limitée incorporated under Luxembourg law.

For the purposes of applicable data protection law, including the General Data Protection Regulation (“GDPR”), the data controller is:

Monde Avenir sàrl
4 rue Aloyse Simon
L-8320 Capellen
Luxembourg

R.C.S. Luxembourg: B177722
VAT number: LU26172666

Email: hello@bricksinthecloud.com
Telephone: +352 621 355 207

2. Personal Data We May Collect

Depending on how you interact with Bricks in the Cloud, we may collect and process personal data including:

your name;
email address;
telephone number;
billing address and other billing information;
company name and business information where you purchase on behalf of a business;
VAT or tax-related information where applicable;
order and transaction information;
information concerning the products you purchase;
account information associated with access to our digital products;
course access and progress information where applicable;
communications you send to us, including enquiries and customer-support correspondence;
marketing and communication preferences;
information concerning your interactions with our website and communications;
technical information such as IP address, browser, device and website usage information; and
cookie and similar technology information where applicable.

We do not intentionally collect special categories of personal data through the ordinary operation of the Bricks in the Cloud website or our digital products.

Please do not provide sensitive personal information unless it is genuinely necessary and we have requested it for a legitimate purpose.

3. How We Collect Personal Data

We may collect personal data:

directly from you when you place an order, create or use an account, contact us, subscribe to communications or otherwise provide information to us;
automatically when you use our website, subject to applicable cookie and privacy requirements;
through Shopify and other service providers involved in processing orders, payments and delivering our services;
through the platform used to provide access to a purchased course or digital product; and
from other lawful sources where necessary for the operation of our business.

4. Why We Process Personal Data

We may process personal data for the following purposes:

To process purchases and perform our contract with you

This includes processing orders and payments, issuing purchase confirmations and invoices, providing access to purchased digital products, administering customer accounts and providing products and services you have purchased.

The legal basis for this processing is generally the performance of a contract with you or taking steps at your request before entering into a contract.

To administer digital products and course access

We may process information necessary to create and administer access to digital products, monitor technical access, record course progress where applicable, provide resources and issue Certificates of Completion where offered.

The legal basis is generally the performance of our contract with you.

To comply with legal obligations

We may process and retain information where necessary to comply with legal, accounting, tax, VAT, consumer-protection or other regulatory obligations.

The legal basis is compliance with our legal obligations.

To respond to enquiries and provide customer support

We process information contained in communications with you so that we can answer questions, resolve technical or purchase-related issues and provide customer service.

Depending on the circumstances, the legal basis may be performance of a contract, taking steps prior to entering into a contract, or our legitimate interest in operating our business and responding to enquiries.

To protect our business and digital products

We may process appropriate information to prevent fraud, protect our systems and digital products, investigate misuse, enforce our contractual and intellectual-property rights and maintain the security of our services.

Where applicable, this processing is based on our legitimate interests in protecting our business, customers, systems and intellectual property, subject to the rights and interests of individuals.

Marketing and newsletters

Where permitted by applicable law, we may use contact details to send newsletters, product information, educational content or other marketing communications.

Where consent is required, we will rely on your consent.

You may unsubscribe from marketing communications at any time using the unsubscribe mechanism provided in the communication or by contacting us.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Website operation and analytics

We may process technical and usage information necessary to operate, secure and improve our website and understand how it is used.

Where cookies or similar technologies require consent, such technologies will be used only in accordance with your consent choices.

Further information is provided in our Cookie Policy.

5. Payment Information

Payments are processed through payment providers made available through our online store.

We do not normally receive or store complete payment-card details ourselves. Payment providers process payment information in accordance with their own security and data-protection arrangements.

We may receive transaction information necessary to confirm payment, administer orders, process refunds where applicable and maintain appropriate financial records.

6. Shopify

Our online store is hosted and operated using Shopify.

Shopify processes personal data in connection with the operation of the online store, including information relating to website use, customers, orders and transactions.

Depending on the particular Shopify services and settings we use, Shopify may process personal data in different capacities and for different purposes.

Further information about Shopify's processing of personal data is available through Shopify's own privacy information.

Our Shopify privacy configuration and this Privacy Policy may be updated where we activate additional Shopify services that require further disclosures.

7. Course and Digital-Service Providers

We may use third-party platforms and technology providers to host, deliver or administer courses and other digital products.

Where necessary to provide a purchased product, relevant personal data may be shared with those providers for purposes such as creating or administering access, authenticating users, recording course progress or providing technical functionality.

We require service providers handling personal data on our behalf to do so subject to appropriate contractual and data-protection requirements where required by applicable law.

8. Other Recipients of Personal Data

Where necessary and lawful, personal data may also be disclosed to categories of recipients including:

payment providers;
website and technology service providers;
hosting and cloud-service providers;
email and communications providers;
accounting, tax and professional advisers;
fraud-prevention and security providers;
public authorities, regulators, courts or law-enforcement bodies where disclosure is legally required; and
other service providers necessary to operate our business or provide a service requested by you.

We do not disclose personal data to third parties simply for their own unrelated purposes unless we have an appropriate legal basis to do so.

9. International Transfers

Some of the technology and service providers used to operate our website or provide digital products may process personal data outside Luxembourg or the European Economic Area.

Where personal data is transferred internationally, we take appropriate steps, where required, to ensure that the transfer is made in accordance with applicable data-protection law.

Depending on the destination and provider, this may include reliance on an adequacy decision of the European Commission, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism.

Further information concerning relevant safeguards may be requested by contacting us.

10. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal requirements.

Accounting, invoicing and tax records

Invoices, transaction records and personal data forming part of accounting, tax or VAT documentation are retained for 10 years, in accordance with the retention requirements applicable to our business.

Where personal data forms part of documentation that we are legally required to retain, a request for erasure will not require us to delete that information before expiry of the applicable statutory retention period.

Other personal data

Personal data that does not need to be retained as part of our accounting, tax or other legally required records will generally be retained for no longer than 3 years after the end of the relevant relationship or the individual's last meaningful interaction with Bricks in the Cloud, unless:

a shorter retention period is appropriate;
you withdraw consent and there is no other lawful basis for continued processing;
retention is required by another legal obligation; or
a longer period is reasonably necessary for the establishment, exercise or defence of legal claims or another lawful purpose.

This may include, depending on the circumstances, customer correspondence, enquiry information, inactive customer information and other administrative data that is no longer required for performance of a contract.

Marketing information

Where we process personal data for marketing purposes, we will not retain it indefinitely.

If you unsubscribe or withdraw your marketing consent, we will stop using your contact details for those marketing communications. We may retain limited information necessary to record and respect your opt-out and prevent further unwanted communications.

Marketing data that is no longer required will otherwise be deleted or anonymised in accordance with our retention practices and, in principle, no later than 3 years after the last relevant interaction, unless applicable law requires or permits otherwise.

Course access

Information necessary to provide access to a purchased digital product may be retained for the applicable access period.

Where information associated with the purchase must also be retained for accounting, tax or legal purposes, the relevant statutory retention period will continue to apply even after course access has ended.

We periodically review the personal data we retain and delete or anonymise information where its applicable retention period has expired and there is no other lawful reason to retain it.

11. Your Data Protection Rights

Subject to the conditions and limitations established by applicable law, you may have the right to:

obtain information about how your personal data is processed;
request access to your personal data;
request correction of inaccurate or incomplete personal data;
request erasure of your personal data;
request restriction of processing;
object to certain processing, including processing based on legitimate interests;
object to direct marketing;
receive certain personal data in a portable format;
withdraw consent at any time where processing is based on consent; and
lodge a complaint with a competent data-protection supervisory authority.

These rights are not absolute and may be subject to legal exceptions. For example, we may be required to retain certain transaction or accounting information even after receiving an erasure request.

12. Exercising Your Rights

To exercise a data-protection right or ask a question about our use of your personal data, please contact:

hello@bricksinthecloud.com

We may request information reasonably necessary to verify your identity before responding to certain requests.

We will respond in accordance with the time limits and requirements established by applicable data-protection law.

13. Complaints

If you have concerns about how we process your personal data, we encourage you to contact us first so that we can investigate and respond.

You also have the right to lodge a complaint with the competent supervisory authority.

Our supervisory authority in Luxembourg is the Commission nationale pour la protection des données (CNPD).

14. Cookies and Similar Technologies

Our website may use cookies and similar technologies for purposes including website operation, security, preferences, analytics and, where enabled, marketing.

Non-essential cookies and similar technologies will be managed in accordance with applicable consent requirements.

Further information about the technologies used and the choices available to visitors is provided in our Cookie Policy and through the cookie-consent mechanism available on our website.

15. Security

We take appropriate organisational and technical measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

However, no internet-based system can be guaranteed to be completely secure.

16. Children

Our products and services are not specifically directed at children.

We do not knowingly seek to collect personal data from children through our website for the purpose of providing our products directly to them.

If we become aware that personal data relating to a child has been collected in circumstances requiring parental or other lawful authorisation, we will take appropriate steps in accordance with applicable law.

17. Changes to this Privacy Policy

We may update this Privacy Policy where necessary to reflect changes to our business, products, technology providers, data-processing activities or applicable law.

The current version will be made available on our website and the “Last updated” date will be amended accordingly.

Where a change materially affects how we process personal data, we will take any additional notification or consent steps required by applicable law.

18. Contact

For questions concerning this Privacy Policy or the processing of your personal data, please contact:

Bricks in the Cloud / Monde Avenir sàrl
4 rue Aloyse Simon
L-8320 Capellen
Luxembourg