1Who we are
The controller of your personal data is:
REDROOM o.z.
Company ID (IČO): 51962322
Registered office: Jána Hollého 3513/111, 071 01 Michalovce, Slovak Republic
Registered in the Register of Civic Associations
Contact for data protection matters: info@flstudiomasterclass.eu
We have not appointed a Data Protection Officer — we do not meet the conditions under which one is required. Requests are handled directly by the controller at the address above.
2What we process and why
Course application
Data: name, e-mail address, Discord username, FL Studio version and operating system, an optional note and the topics you are interested in, the chosen course variant and number of hours, price and any discount applied, payment status, IP address and browser information, and confirmation that you have read this policy.
Purpose: processing your application, entering into and performing the course contract, communicating about the course, and giving you access to the student portal.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR). For the IP address and browser information, legitimate interest (Art. 6(1)(f)) — protecting the form against abuse and spam.
A copy of the submitted application, including the IP address, is delivered to our operational mailbox so that we can process it.
Payment
Data: amount, date, payment method, payment identifiers. For card payments, the card details are processed directly by the payment provider — we never see your card number.
Purpose: receiving payment and keeping accounting records.
Legal basis: performance of a contract and legal obligation (Art. 6(1)(b) and (c)) — accounting legislation.
Student account and portal
Data: e-mail, name, language, account status, your password stored only as a cryptographic hash (never in readable form), Discord username, the time zone detected from your browser, last login time, and whether you have completed the onboarding guide.
Purpose: running the portal, giving you access to the course and recordings, booking one-on-one sessions, showing times in your own time zone, and sending lesson reminders.
When you book a one-on-one session, the lecturer whose slot you chose receives an e-mail with your name and the date, time and length of the session — they need to know who they are meeting and when. Your e-mail address is not passed on to them.
Legal basis: performance of a contract (Art. 6(1)(b)).
Reporting a problem
Data: the text of your report, its language, the page you were on (and in the player the lesson and the recording), your browser, operating system and device type — prefilled from your browser and editable by you — and the technical string your browser identifies itself with. The report is linked to your account so we know whom it concerns.
Purpose: fixing faults on the site and in the portal. We read the reports; we do not reply to every one, and if we need more detail we will e-mail you.
Legal basis: legitimate interest (Art. 6(1)(f)) — keeping the service working.
When your account is erased the report is unlinked from you but not deleted — a player fault stays operationally useful to us afterwards. If you named yourself in the text of a report, we will redact that part on request.
Study activity
Data: which recordings you opened, how many times, how much of them you watched, how far you got and when you last watched, which lessons you marked as completed, your booked one-on-one sessions and your hours balance.
This data lets you resume where you left off and see your progress. It is also visible to our staff for an individual student — we use it for support and to assess how clear and effective the course is.
Legal basis: performance of a contract (portal functionality) and legitimate interest (Art. 6(1)(f)) for assessing course quality.
Contact form
Data: name, e-mail, message, language, IP address and browser information.
Purpose: replying to your message.
Legal basis: legitimate interest (Art. 6(1)(f)) — handling your enquiry; for the IP address, protecting the form against abuse.
Contest
Data: e-mail, artist name, optionally full name and Instagram, track title and the uploaded audio file, language, IP address and browser information, and your consent.
Purpose: entering you into the contest, judging it and announcing the results.
Legal basis: consent (Art. 6(1)(a)), or performance of a contract under the contest rules. You may withdraw consent at any time; withdrawal does not affect processing carried out beforehand.
Newsletter
Data: e-mail, language, the page you subscribed from, traffic source information (UTM parameters), the date and method of consent, IP address and browser information.
Purpose: sending news and offers.
Legal basis: consent (Art. 6(1)(a)). You can unsubscribe at any time.
Offers to existing customers
If you have taken a course with us, we may send you an offer for a related follow-up product. You can unsubscribe at any time using the link in the e-mail footer; we honour and record unsubscribes.
Legal basis: legitimate interest (Art. 6(1)(f)) — direct marketing to our own customers.
Reviews
If you write a review at our invitation, we process the rating, the text, an optional nickname and an optional link. Once approved, the review is published under the nickname you choose.
Legal basis: consent, given by submitting the review.
3Where the data comes from
We collect all data directly from you — from forms, from your account and from your use of the portal. We do not buy databases and do not obtain data from third parties.
4Who we share data with
We do not sell your data. We share it only with service providers who process it for us and on our instructions:
| Recipient | What they process | Location |
|---|---|---|
| Contabo (VPS hosting) | server and database operation | Germany (EU) |
| Hetzner (object storage) | video recordings, materials, contest tracks | Germany (EU) |
| Hostinger (mail server) | sending e-mails | EU |
| Stripe | card payments | Ireland / USA |
| Cloudflare | bot protection for forms (Turnstile) | USA |
| Discord | community communication and live lessons | USA |
We may also share data with our accountant, and with legal or other professional advisers if we ever had to establish or defend a legal claim, and — to the extent required by law — with public authorities.
5Transfers outside the European Union
Stripe, Cloudflare and Discord may process data in the USA. These transfers are safeguarded by those companies' certification under the EU–US Data Privacy Framework, or by standard contractual clauses approved by the European Commission.
If you join our Discord server, your use of Discord is governed by Discord's own policy, where it acts as an independent controller.
6How long we keep data
| Data | Retention |
|---|---|
| Paid applications and payment records | 10 years, then anonymised; only the amount, date and course type remain |
| Unpaid or abandoned applications | 12 months |
| Student account and study activity | for as long as you have access to the course; we close the account on request at any time |
| Contact messages | 24 months |
| Contest entries including uploaded tracks | 12 months after the contest ends |
| Newsletter | until you unsubscribe; we keep the record of the unsubscribe so we can honour it |
| IP addresses and browser information | 12 months, then removed |
| Records of e-mails sent | 24 months |
For paid applications, accounting legislation requires longer retention — we cannot delete such records sooner, but on request we remove the personal data in them and keep only what accounting requires.
8Website analytics
We measure traffic with Plausible Analytics, which we host on our own server. It uses no cookies, creates no visitor identifiers, does not store full IP addresses and cannot follow you across websites. We only obtain aggregate statistics — for example, how many people visited a course page and how many of them opened the application form.
9Third-party content on our pages
- Cloudflare Turnstile — verifies that you are not a bot when you submit a form, and processes your IP address in doing so.
- Stripe — when paying by card, the Stripe payment form is loaded and sets its own cookies needed to process the payment and prevent fraud.
- Spotify — the About us page contains an embedded Spotify player.
When the About us page loads, your IP address and browser information are transmitted to Spotify, which may set its own cookies — even if you never start playback. This processing is governed by Spotify's own privacy policy. If you would rather avoid it, do not visit the About us page, or block third-party content in your browser.
10Security
Passwords are stored only as a salted cryptographic hash — not even we can read your password. Login sessions are likewise stored only as hashes. All communication with the site is encrypted (HTTPS). Administration access is password-protected and limited to a small number of people. Course files and contest uploads live in private storage and are served only through temporary links.
11Automated decision-making
We do not use automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.
12Backups
We back up the database regularly so that your data is not lost in the event of a failure. Deleted data may persist in backups for some time, until older backups expire. Backups are used solely to recover from a failure; if a restore ever happens, we repeat any deletion you requested.
13Your rights
You have the right:
- of access — to confirmation of whether we process your data, and a copy of it,
- to rectification of inaccurate or incomplete data,
- to erasure („the right to be forgotten“),
- to restriction of processing,
- to data portability — to receive your data in a machine-readable format,
- to object to processing based on legitimate interest,
- to withdraw consent where processing is based on it (e.g. newsletter, contest); withdrawal does not affect the lawfulness of processing carried out beforehand.
How to exercise them: write to info@flstudiomasterclass.eu. We will respond within 30 days at the latest. To make sure we do not hand data to the wrong person, we handle requests from and to the e-mail address we hold for you; if you write from a different address, we may ask for additional verification.
If you request erasure in connection with a paid course, we remove the personal data and keep only the record required for accounting (amount, date, course type) — see section 6.
If you request erasure while your course is still running, you will lose access to it — the account is how the course is delivered. While we are still providing the course, your data remains necessary to perform that contract, so we will point this out first and leave the decision to you.
14Complaints
If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava 27, Slovakia
We would appreciate hearing from you first — most things we can sort out straight away.
15Changes to this policy
We may update this policy if the way we process data changes. The current version is always available on this page and carries its effective date.
Effective from: 13 August 2026