1. GENERAL PROVISIONS AND DOCUMENT STATUS
1.1. This Policy sets out the procedure, terms of processing, and protection of personal data of users by AirTouch LLC, a company registered in the State of Florida, USA (registration number L23000016132; registered address: 45 SW 9th St, Unit 3104, Miami, Florida 33130, USA; email for inquiries: support@airtouch.education) (hereinafter referred to as the "Controller" or "Operator").
1.2. This Policy applies to all visitors to the website airtouch.education, customers, payers, and direct participants of in-person AirTouch professional events who complete forms on the website or make payments via the Stripe payment gateway.
1.3. This document has been drafted in compliance with the European Union General Data Protection Regulation (GDPR), United States federal laws, and the privacy laws of the State of Florida.

2. LEGAL BASES AND PURPOSES OF DATA PROCESSING
The Controller processes personal data only where at least one of the following lawful bases applies:
2.1. Performance of a Contract: To process orders, register participants, confirm payments via Stripe, send organizational communications, and issue personalized certificates.
2.2. Compliance with a Legal Obligation: To maintain mandatory corporate accounting and tax records in accordance with the requirements of the United States and the countries where events are held (including European VAT accounting).
2.3. Legitimate Interests: To protect the business against fraudulent transactions and unjustified chargebacks in the payment system, investigate IT security incidents, handle legal claims, and verify service delivery or participant no-shows.
2.4. Freely Given Consent: To send newsletters and marketing communications, offers regarding future events, and to deploy analytical and advertising cookies (tracking pixels). Consent is collected separately and may be withdrawn by the user at any time with effect for the future.

3. CATEGORIES OF DATA AND RETENTION PERIODS
The Controller collects data strictly to the minimum extent necessary to achieve the stated purposes:
3.1. Contact and Registration Data: First name, last name, email address, telephone number, social media/messenger handle, country and city of residence, and professional status. Retention period: Up to 3 years from the date of last interaction if no purchase is completed.
3.2. Payment and Accounting Data: Order amount, payment status, billing address, and the last 4 digits of the payment card or payment token. Full payment card details are processed directly by the Stripe payment gateway acting as an independent data controller and are never accessed by the Controller. Retention period: 7 to 10 years for compliance with tax and financial laws and for defense in payment disputes.
3.3. Technical Data: IP address, device and browser type, website browsing activity, cookies, and similar identifiers. Retention period: Determined by the specific cookie type, but not exceeding 24 months from the date of collection.

4. ON-SITE PHOTOGRAPHY AND VIDEO RECORDING (MEDIA CONSENT)
4.1. The Controller conducts general documentary and promotional filming during events for subsequent coverage of event outcomes on official social media accounts and in AirTouch marketing materials.
4.2. Opt-Out Mechanism: Masterclass participants have the right to object to having their recognizable likeness or voice recorded and used for marketing purposes. To exercise this right, the Participant must notify the Provider’s on-site team prior to the commencement of filming.
4.3. Venue coordinators are obligated to provide any Participant who opts out of filming with a workstation in the auditorium located outside the field of view of recording equipment (a "camera-free zone"). Refusal to participate in marketing filming shall not result in restricted access to the event or any diminution in the quality of services provided to the Participant.

5. INTERNATIONAL DATA TRANSFERS
5.1. Because the Controller (AirTouch LLC) is established in the United States of America, personal data of users located in the European Economic Area (EEA) or the United Kingdom is transferred to and stored on servers located outside the EU/EEA.
5.2. To ensure adequate protection for the personal data of EU citizens during cross-border transfers, the Controller incorporates the Standard Contractual Clauses (SCCs) approved by the European Commission into agreements with its processors/contractors (including the Tilda platform and the Stripe payment system) and implements internal technical encryption and access-control safeguards.

6. DATA SUBJECT RIGHTS UNDER THE GDPR
Users located in the EEA or the United Kingdom hold the following inalienable rights:
- Right to Erasure ("Right to be Forgotten"): To request the complete deletion of their personal data from the Controller’s databases (excluding records that the Controller is legally required to retain for tax reporting purposes).
- Right to Withdraw Consent: To withdraw consent to receive marketing emails at any time via the "Unsubscribe" link included in every email.
- Right of Access and Data Portability: To request a copy of their personal data in a structured, commonly used format.
- Right to Lodge a Complaint: To lodge a complaint regarding the Controller’s processing activities with the competent data protection supervisory authority in their country of residence.
To exercise these rights, the user may submit a reasoned request to support@airtouch.education.

7. AGE RESTRICTIONS AND CHILDREN’S PRIVACY
7.1. The website, informational materials, and AirTouch events are intended exclusively for adults aged 18 and older.
7.2. The Controller does not knowingly collect or process personal data of minors. If the Controller becomes aware that personal data of an individual under 18 years of age has been submitted via website forms without verifiable parental/guardian consent, such data shall be immediately and permanently deleted.

8. DATA SECURITY
8.1. The Controller implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, alteration, unauthorized disclosure, or access. These measures include restricting database access to authorized personnel only, using secure transmission protocols (HTTPS), payment tokenization, and regular data backups.

9. UPDATES TO THIS POLICY
9.1. The Controller reserves the right to amend this Policy. Any updated version enters into force upon its publication on the website. Users are encouraged to regularly check the effective date stated at the top of the document.