Privacy Policy

Last updated: August 18, 2026

This Privacy Policy explains how Trainology collects, uses, stores and shares personal data when you visit dorianvarovic.com, contact us, subscribe to email communications, request a free resource, respond to an advertisement or lead form, purchase or use a service, or participate in an educational program or coaching service.

1. Data controller

The controller responsible for processing your personal data is:

Trainology, obrt za poslovne usluge, vl. Dorian Varović
42250 Lepoglava
Croatia
Registered in the Croatian Register of Trades

Email: dorian@dorianvarovic.com

In this Privacy Policy, “Trainology”, “we”, “us” and “our” refer to Trainology, obrt za poslovne usluge, vl. Dorian Varović.

2. Personal data we process, why we process it, and how long we keep it

The personal data we process depends on how you interact with us.

Activity	Personal data	Purpose and legal basis	Retention
General enquiries and contact forms	Name, email address, message and any information you choose to provide	To respond to your enquiry and communicate with you. Where your enquiry concerns a possible service, processing is necessary to take steps at your request before entering into a contract. For other ordinary correspondence, we rely on our legitimate interest in responding to communications directed to us.	If no ongoing relationship results, 12 months after the last substantive communication.
Coaching enquiries and applications	Name, contact details, training or professional background, goals, availability and answers provided in the application	To consider your application, determine whether the service is appropriate, answer questions and take steps toward a possible coaching contract. Legal basis: steps taken at your request before entering into a contract.	If coaching does not begin, 12 months after the last substantive communication.
Coaching services	Contact details, coaching records, goals, training information, correspondence, progress information and other data reasonably required to provide the service	To provide and administer coaching, communicate with you, monitor the service and fulfil our contractual obligations. Legal basis: performance of a contract.	Routine coaching records are retained for the duration of coaching and generally for 12 months after coaching ends. Core contractual, payment, complaint or dispute records may be retained for 5 years after the service ends, or longer where another legal retention requirement applies.
Case-specific health information	Limited information concerning an injury, medical condition, physical limitation or other health matter, but only where relevant to an individual coaching case	To adapt or provide coaching appropriately. The standard coaching application does not request health information. Where health information is required, we will explain why it is requested and, where we rely on consent, obtain your explicit consent before processing it.	Retained only while reasonably necessary for the relevant coaching purpose and normally for no longer than 12 months after coaching ends, unless continued retention is necessary in connection with an unresolved complaint or legal claim.
Purchases and payments	Name, email address, billing information, service purchased, amount, currency, transaction status, payment identifiers, refund information and limited payment-method information	To process and administer purchases, installments, refunds and payments and to perform our contract with you. Some records are also processed to comply with tax and other legal obligations.	Records forming part of legally required tax, bookkeeping or accounting documentation are retained for 10 years from the beginning of the applicable tax limitation period, unless a special rule requires longer retention.
Core contract and customer-service records	Purchase records, service details, material correspondence, cancellations, complaints and information required to establish what was agreed and provided	To perform and document our contractual obligations, deal with complaints and protect or defend legal rights. Legal basis: performance of a contract, compliance with legal obligations and, where applicable, our legitimate interest in establishing or defending legal claims.	Normally 5 years after the contractual relationship ends, unless the same record is subject to a longer statutory retention period or is needed for an unresolved claim or proceeding.
Educational programs and mentorships	Name, email address, enrollment information, participation records, questions, assignments, feedback, support correspondence and community username or activity relevant to the service	To deliver the program, provide materials and access, answer questions, provide feedback and administer participation. Legal basis: performance of a contract.	Routine participant information, assignments and support records are retained for the period during which access to the program is provided and for 12 months after that access ends, unless a specific record must be retained longer for contractual, tax, complaint or legal purposes.
Live sessions and recordings	Display name, voice, image/video if enabled, chat messages, questions and other contributions that may appear during a recorded session	To provide live teaching and recordings included with the relevant service. Legal basis: performance of the service contract and, where applicable, our legitimate interest in providing useful recordings while limiting unnecessary collection of participant information.	Recordings are retained for the access period stated for the relevant service or program. Where that access period ends, recordings containing participant personal data are normally deleted within 90 days, unless longer retention is necessary for an unresolved legal or contractual matter.
Free resources and defined email sequences	Name where requested, email address, signup source, resource requested, consent record, subscription status and relevant email-delivery information	To provide the resource and the email communications clearly described when you sign up. Where those communications include direct marketing, the legal basis is your consent.	For a limited email series, active processing for that purpose ends when the series ends unless you have also agreed to receive continuing communications. Consent and unsubscribe records may be retained where necessary to demonstrate compliance.
Newsletter and other email marketing	Name where supplied, email address, subscription source, consent information, preferences, delivery status, unsubscribe status and email-interaction information where enabled	To send newsletters, educational communications, launch information, offers and other promotional emails that you have agreed to receive. Legal basis: normally consent. In the limited circumstances permitted by law, we may contact an existing customer about our own similar services while providing a simple way to object.	Until you unsubscribe, withdraw consent or the relevant mailing list is discontinued. After opting out, we may retain the minimum information necessary on a suppression record so that the opt-out continues to be respected.
Meta Lead Ads and other lead-generation forms	Information you choose to submit, normally such as name, email address and answers to questions shown in the form, together with information identifying the source or campaign	To provide the resource, waitlist, information or service described in the lead form. The legal basis depends on the form: consent where you sign up for marketing or an email resource, or steps before entering into a contract where you make an enquiry about a service.	Once received by us, the data follows the retention period applying to the purpose for which it was collected. A lead that does not become an active subscriber, customer or ongoing enquiry is normally deleted within 12 months of the last interaction.
ManyChat and social-media messaging	Social-media username or identifier, messages, responses to an automated flow and contact information you choose to provide	To respond to messages, provide requested resources, process signups and operate automated social-media interactions. The legal basis depends on the interaction and may be consent, steps requested before entering into a contract, or our legitimate interest in responding to messages directed to us.	Where the interaction does not become an ongoing enquiry, subscription or customer relationship, the information is normally retained for no more than 12 months after the last interaction. If it becomes part of another relationship, the retention period for that relationship applies.
Website security and technical logs	IP address, browser/device information, timestamps, requested pages, technical errors and security information	To operate and secure the website, troubleshoot technical problems, detect abuse and protect our systems. Legal basis: our legitimate interest in maintaining a secure and functioning website.	Retained according to the security and logging periods used by our hosting and security systems and only for as long as required for security, troubleshooting or investigation of an identified incident.
Privacy requests, complaints and legal matters	Identity, contact information, request or complaint, supporting correspondence and relevant service or transaction records	To respond to requests, comply with legal obligations and establish, exercise or defend legal claims.	Normally 5 years after the matter is closed, unless a longer period is required because legal or administrative proceedings remain possible or ongoing.

Where a specific item of information falls into more than one category, the longest applicable lawful retention period may apply. We may delete information earlier where it is no longer needed.

3. Email marketing and free resources

We use MailerLite to manage mailing lists, email automations and email delivery.

Depending on how you subscribe, MailerLite may process information such as your name, email address, subscription source, consent status, email-delivery information, unsubscribe status and campaign interaction information where such tracking is enabled.

When a free resource is offered together with a defined email sequence, the signup page or form will explain that before you submit your information.

Requesting a resource does not by itself provide unlimited permission for us to send unrelated marketing indefinitely.

Where we rely on your consent for email marketing, you may withdraw that consent at any time by using the unsubscribe function contained in the email or by contacting us at dorian@dorianvarovic.com.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Where the law permits us to contact an existing customer about our own similar products or services without obtaining a new marketing consent, every such communication will provide a simple and free way to object to further marketing.

Service communications that are necessary to perform a contract are not treated as optional marketing. These may include purchase confirmations, payment information, session links, access instructions, scheduling changes, responses to support requests and other information necessary to provide a purchased service.

4. Meta Lead Ads

We may use lead-generation features provided through Facebook or Instagram.

When you submit a Meta lead form, Meta sends us the information you chose to provide in that form.

We use that information for the purpose described when it was collected. For example, this may be to:

deliver a requested resource and accompanying email sequence;
add you to a waitlist you requested to join;
respond to an enquiry;
provide information about a service you asked about.

If we want to use lead information for an additional purpose that is not covered by the original collection, we will obtain any additional permission required before doing so.

We may transfer lead information to service providers such as MailerLite or ManyChat where that is necessary to carry out the purpose for which the information was provided.

We do not sell Meta Lead Generation Data or customer mailing lists.

Meta processes information through its own services in accordance with its own privacy terms. For particular Meta Business Tools processing for which Meta and Trainology qualify as joint controllers, the allocation of responsibilities is governed by Meta’s applicable controller terms.

5. Cookies, Meta Pixel and advertising measurement

Our website uses cookies and similar technologies.

Some technologies are necessary for the website to operate or to provide a function you expressly request. Other technologies, including advertising and marketing technologies, are activated only after the required consent has been obtained.

We use a consent-management system that allows you to accept or reject non-essential categories and change your preferences later.

Meta Pixel

We use the Meta Pixel for advertising and conversion measurement.

The Meta Pixel is activated only after you consent to marketing cookies through our website’s consent-management system. If you reject marketing cookies, Meta Pixel advertising and conversion-tracking events are not activated through the website.

Once marketing consent has been provided, information sent through the Pixel may include technical browser or device information, the webpage visited and configured events such as a page visit, lead or purchase.

Where configured for a purchase event, information such as transaction value and currency may also be transmitted.

We do not send complete payment-card numbers or card security codes to Meta through the Pixel.

We use this information to measure whether advertising results in website visits, enquiries, leads or purchases and to assess and improve advertising performance.

You may withdraw your marketing-cookie consent at any time through the website’s consent settings. Withdrawal does not affect processing that lawfully occurred before consent was withdrawn.

More detailed information about individual cookies and their duration is available in our Cookie Policy and consent-management interface.

6. Payments and Stripe

Payments are processed through Stripe.

Stripe processes the payment information required to complete and authenticate transactions and to provide payment-related services.

Trainology may receive information such as:

your name and billing information;
the amount and currency;
payment status;
Stripe customer or transaction identifiers;
limited information identifying the payment method;
refund, failed-payment or dispute information.

We do not receive or store your complete payment-card number or card security code.

Stripe may process some information as a processor providing payment services to us and other information as an independent controller where Stripe has its own legal, regulatory, fraud-prevention or payment-network obligations.

7. Educational programs, Discord and online meetings

Educational services may use Discord for private participant communities.

Where you join such a community, Trainology may process your Discord username, messages directed to us or posted within the relevant community, questions, participation information and moderation information where necessary.

Discord also processes account and platform information independently under its own terms.

Live online sessions may be delivered through Zoom or Google Meet, depending on the relevant service.

Those providers may process information required to operate the meeting, such as your display name, device or connection information and any audio, video, chat or other information you choose to provide while participating.

Where a session will be recorded, participants will be informed that recording is taking place.

Unless participation on camera is specifically necessary for a particular service, participants may generally choose to keep their camera off.

We do not use identifiable participant contributions, recordings, screenshots, assignments or private messages for public advertising or testimonials without separate permission.

8. Health information in coaching

Our standard coaching enquiry or application form does not request health or medical information.

During an individual coaching relationship, there may occasionally be circumstances where information concerning an injury, medical condition, physical limitation or similar health matter is relevant to the service.

Health information is treated as special-category personal data.

Where we need to request such information, we will explain why it is relevant and request only the information reasonably necessary for that purpose. Where explicit consent is the legal condition relied upon for processing that health information, that consent will be requested separately.

Health information provided for coaching is not used for advertising, marketing audiences or unrelated promotional purposes.

You may withdraw explicit consent to health-data processing where consent is the basis relied upon. If the information is genuinely necessary for us to provide the coaching service appropriately, withdrawal may mean that we cannot continue providing the affected part of the service.

9. Who receives personal data

We disclose personal data only where this is reasonably necessary for the purposes described in this Privacy Policy or where disclosure is required by law.

Recipients or categories of recipients may include:

MailerLite — email-list management, automations and email delivery;
Stripe — payments and related payment administration;
Meta — Facebook and Instagram lead-generation services, advertising and Meta Pixel;
ManyChat — automated social-media messaging and lead/resource delivery when used;
Discord — private program communities where applicable;
Zoom and Google — online meetings and related services where applicable;
website hosting, email, security, backup and technical-service providers;
accountants or bookkeeping providers;
legal, tax or other professional advisers where their assistance is necessary;
public authorities, courts, regulators or other persons where disclosure is required by law or necessary to establish, exercise or defend legal rights.

We do not sell personal data or provide customer lists to unrelated businesses for their independent marketing.

10. International transfers

Some of the service providers we use operate internationally or may process information outside Croatia or the European Economic Area.

Where personal data is transferred outside the EEA, we use providers and transfer arrangements that provide a lawful basis for the transfer under applicable data-protection law.

Depending on the country and provider, this may include:

an adequacy decision adopted by the European Commission;
Standard Contractual Clauses approved by the European Commission; or
another lawful transfer mechanism available under Chapter V of the GDPR.

You may contact us if you would like information about the safeguards applicable to a particular transfer of your personal data.

11. Legal bases explained

The principal legal bases on which we rely are:

Consent

We rely on consent where you voluntarily agree to particular processing, including most email marketing, non-essential marketing cookies and, where applicable, processing of case-specific health information.

You may withdraw consent at any time.

Contract and pre-contractual steps

We rely on contractual necessity when processing is required to:

respond to a request you make before purchasing a service;
process and administer a purchase;
provide coaching or an educational service;
provide access, teaching, feedback or support included in that service.

Legal obligation

We process and retain certain information where Croatian or EU law requires us to do so, including relevant tax and business records and information required to respond to lawful requests.

Legitimate interests

We rely on legitimate interests only where our interests are not overridden by your rights and interests.

Examples may include:

maintaining website and account security;
responding to ordinary business communications;
maintaining limited records needed to establish or defend legal claims;
preventing misuse or fraud;
administering a private participant community;
contacting existing customers about our own similar services where this is permitted by applicable electronic-communications law.

Where processing is based on legitimate interests, you may have a right to object as explained below.

12. Your rights

Subject to the conditions and limitations in applicable data-protection law, you have the following rights.

Right of access

You may ask whether we process personal data about you and, if so, request access to that data and the information required by data-protection law.

You are also generally entitled to a copy of the personal data undergoing processing.

Right to rectification

You may ask us to correct personal data that is inaccurate and to complete information that is incomplete where appropriate.

Right to erasure

You may request deletion of your personal data where one of the legal grounds for erasure applies, including where the information is no longer necessary for the purpose for which it was collected or where you withdraw consent and no other lawful basis remains.

The right to erasure is not absolute.

For example, we may need to retain information where processing remains necessary to:

comply with a legal obligation;
establish, exercise or defend legal claims; or
satisfy another exception recognised by applicable law.

This means, for example, that withdrawal of marketing consent does not require us to delete invoices or transaction records that we are legally required to retain.

Right to restriction of processing

You may request that processing be restricted in the circumstances specified by the GDPR, including while the accuracy of disputed data is being checked or while certain objections are being considered.

Right to data portability

Where processing is carried out by automated means and is based on your consent or on a contract, you may have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format.

Where technically feasible, you may also have the right to request transfer of that data directly to another controller.

This right does not apply to every type of personal data we hold.

Right to object

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation.

We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms or unless the processing is required for the establishment, exercise or defence of legal claims.

Direct marketing

You have the right to object at any time to the use of your personal data for direct marketing.

If you object or unsubscribe, we will stop using your personal data for that marketing purpose.

Withdrawal of consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

13. How to exercise your rights

To exercise a data-protection right, contact:

dorian@dorianvarovic.com

Please describe the request clearly enough for us to identify the relevant information.

Where we have reasonable doubts about the identity of the person making a request, we may request additional information necessary to verify identity.

We will respond without undue delay and normally within one month of receiving your request.

Where a request is particularly complex or a large number of requests have been received, the response period may be extended by up to two additional months. If an extension is necessary, you will be informed within the original one-month period and told why additional time is required.

Requests are normally handled free of charge.

Where a request is manifestly unfounded or excessive, particularly because of its repetitive character, applicable law permits us to charge a reasonable fee reflecting administrative costs or, in appropriate circumstances, refuse to act on the request.

If we refuse to act on a request, we will explain the reasons and inform you of the available complaint and judicial-remedy options.

14. Right to complain to a supervisory authority

You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that your personal data has been processed unlawfully.

Trainology’s supervisory authority in Croatia is:

Agencija za zaštitu osobnih podataka (AZOP)
Ulica Metela Ožegovića 16
10000 Zagreb
Croatia
Email: azop@azop.hr

Where another EU supervisory authority is competent because of your place of residence or the circumstances of the processing, you may also have the right to submit a complaint to that authority.

15. Security

We are required to use technical and organisational measures appropriate to the nature of the personal data processed and the risks associated with that processing.

Our use of third-party services does not remove our responsibility to consider data protection when selecting and using those services.

No internet transmission, website, email system or online service can be guaranteed to be completely secure.

If you believe that personal data connected with Trainology has been compromised, contact dorian@dorianvarovic.com.

16. Automated decision-making

Trainology does not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects for you.

Third-party platforms such as payment, advertising or security providers may use automated systems for their own fraud prevention, advertising delivery, security or other purposes. Processing undertaken by those providers for their own purposes is subject to their respective privacy information and legal responsibilities.

17. Children

Paid Trainology services are intended for adults unless a particular service expressly states otherwise.

We do not knowingly use our standard lead-generation or marketing processes to collect personal data from children.

If you believe that a child has provided personal data to us in circumstances where it should not have been collected, contact dorian@dorianvarovic.com.

18. Third-party websites

Our website and communications may contain links to third-party websites, social-media platforms, research publications or other services.

Those third parties may process personal data independently.

Their processing is governed by their own privacy information, and this Privacy Policy does not determine how an independent third party uses information for its own purposes.

19. Changes to this Privacy Policy

We may update this Privacy Policy when our services, providers, website functionality, processing activities or legal obligations change.

The current version will be published on dorianvarovic.com with its most recent revision date.

Where a change materially alters how personal data already collected from you will be used, we will provide additional information or obtain additional permission where required by law.

20. Contact

Questions about this Privacy Policy or the processing of your personal data may be sent to:

Trainology, obrt za poslovne usluge, vl. Dorian Varović
42250 Lepoglava
Croatia

Email: dorian@dorianvarovic.com