Updated 14 September 2026.

Your workbook is a place for your own thoughts. The answers you save in the PDF stay in your copy unless you choose to send them to us. We do not need your completed workbook to help with an order.

Who is responsible

Quannex Foundation is responsible for the personal information used to operate Small Steps with Sōan and its customer services.

Theodorus Niemeyerstraat 161, 9726 BR Groningen, Netherlands. Chamber of Commerce (KvK): 86273671.

For a privacy question or request, email domasrimkeviciusbusiness@gmail.com. You can also contact us on +31 6 16317840 or write to the address above.

Orders and customer support

When you buy the workbook, Payhip and Stripe process your checkout information. This includes your purchase email address, product, order reference, payment status, and billing or tax information required for the transaction. We use the order information available to us to deliver your download, help with your purchase, administer refunds and keep required business records.

The legal bases are performance of our contract with you and compliance with applicable legal obligations. Required checkout information is needed to process and deliver an order. Payment-card information is handled through the payment provider; please do not send it to our support mailbox or cancellation form.

If you contact us, we use your email address, message and relevant order information to answer you. Purchase-related support is part of performing our contract. For other product enquiries, our legitimate interest is responding to the question you chose to send us. We also have a legitimate interest in keeping the minimum evidence needed to resolve complaints or defend legal claims.

The optional free sample

The sample PDF can be downloaded without subscribing to emails. For sample-email signups, we use your email address, signup and confirmation information to provide three lesson emails and one feedback email through MailerLite. This is separate from purchasing the workbook. Buying the workbook does not subscribe you to thirty daily lesson emails.

The sample sequence uses your consent. You can withdraw it through the unsubscribe link in a sample email or by contacting us. Withdrawal does not affect the lawfulness of processing before you withdrew consent. We retain the minimum information needed to respect an unsubscribe request and, where necessary, demonstrate your earlier consent.

Online cancellation notices

The online cancellation form asks for your name and an email address for the acknowledgement. You can also provide your order reference and order date. It does not ask for a reason, payment-card details, passwords or workbook answers.

The service records the withdrawal statement, its reference and the time received. It also stores a submission identifier, a hash of the submitted details and delivery-status records to recognise repeat submissions and track acknowledgement attempts. The hash is a technical record of the form contents, not a fingerprint of your device.

We use this information to handle your withdrawal, evidence when it arrived and resolve related questions. The bases are performance of the purchase contract, applicable legal obligations and our legitimate interest in retaining necessary evidence of a request or dispute. An acknowledgement records receipt of a notice; it does not itself decide eligibility or issue a payment refund.

The notice is stored with the form's hosting service. When delivery is enabled, our Google email service receives your name, acknowledgement email, optional order reference, notice reference and received time. It does not receive the optional order date through this relay.

Providers and international processing

We use the following services for the functions described above:

• Payhip: the shop, checkout, order records and digital-file delivery. See Payhip's privacy policy.

• Stripe: payment processing and associated transaction, security and regulatory functions. Stripe's role depends on the activity; it also processes some information for its own purposes. See Stripe's privacy policy.

• MailerLite: the optional sample signup, subscriber records and email sequence. Its data processing agreement describes its processor role, and its privacy policy explains its other processing.

• Google: the customer-support mailbox and the cancellation email service. See Google's privacy policy and data-transfer information.

• OpenAI Sites: hosting and storage for the cancellation form. The Sites data processing addendum describes processing of hosted visitor data on the site operator's behalf. Hosting can involve infrastructure suppliers acting for the provider.

These services can involve processing outside the European Economic Area, including in the United States. Their published terms describe transfer arrangements such as adequacy decisions and standard contractual clauses where applicable. Contact us if you would like further information about the arrangements relevant to your data or a copy of applicable safeguards.

Some providers keep information under their own legal obligations and privacy policies, as well as processing it to provide our services. A request to us to delete data does not automatically remove every record a provider must keep independently.

How long information is kept

We keep information for the purpose it was collected for, taking account of unresolved requests, disputes and applicable record-keeping requirements. We use the following operational schedule for review:

• Routine support conversations: review for deletion 12 months after the issue is resolved. Keep only what remains necessary for an open complaint, legal claim or required business record.

• Orders and essential cancellation/refund evidence: keep the minimum required record for the applicable accounting or other legal period. This includes the evidence needed to establish when a cancellation was received. The relevant period depends on the record and applicable obligation.

• Duplicate cancellation-form records: review 90 days after resolution, once required evidence has been preserved and the notice can no longer trigger delivery. Never remove duplicate-prevention records separately while the original notice can still be sent.

• Sample subscriber records: review 12 months after the sequence ends if no further permitted purpose remains. An unsubscribe stops marketing earlier. Minimal consent and suppression evidence is handled separately from an active mailing list.

• Test records: review for deletion 30 days after the test is signed off, retaining a non-personal test-outcome summary where useful.

The reviews take place monthly, so a review date is not a promise of automatic deletion on that exact day. Information subject to an unresolved issue or legal retention requirement is excluded until that reason ends. Provider-controlled logs, backups and independently required transaction records can have different retention arrangements.

Cookies and email measurement

The shop, checkout, signup and hosting providers may process technical information such as IP addresses, device/browser information and service events to operate and protect their services. Their policies explain their own processing. Where non-essential cookies or similar technologies are used, applicable choices need to be provided by the relevant service.

Open tracking is disabled in the four sample emails, and optional visitor-data tracking is disabled on the sample landing page. The first two lesson emails contain no links. The third lesson email and the feedback email each contain one link to our shop. MailerLite records clicks on that link, on the confirmation and unsubscribe links, and on its own “Sent by MailerLite” footer link, which cannot be removed on our plan. Disabling open tracking does not remove earlier activity records. See MailerLite's tracking explanation.

Your privacy rights

Depending on the circumstances, you can ask to access, correct or delete your information, restrict its use, receive portable data, or object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time.

Contact domasrimkeviciusbusiness@gmail.com. We may ask for proportionate information to confirm that a request concerns your data. Please do not send identity documents unless we have explained why they are needed and agreed an appropriate way to provide them.

You can also complain to your local data protection authority, including the Dutch Autoriteit Persoonsgegevens. You do not have to contact us first to exercise that right.

The cancellation form records and acknowledges a submission; it does not automatically decide your statutory rights or refund eligibility. Payment providers may use their own fraud and security systems as described in their policies.

When this notice changes, the revised notice will show its updated date. Any use that requires new consent will be handled separately from that update.

Referenced provider and guidance links

Payhip's privacy policy: https://payhip.com/privacy

Stripe's privacy policy: https://stripe.com/privacy

data processing agreement: https://www.mailerlite.com/legal/data-processing-agreement

privacy policy: https://www.mailerlite.com/legal/privacy-policy

Google's privacy policy: https://policies.google.com/privacy?hl=en-US

data-transfer information: https://policies.google.com/privacy/frameworks?hl=en-US

Sites data processing addendum: https://openai.com/policies/chatgpt-sites-data-processing-addendum/

Dutch tax authority: https://www.belastingdienst.nl/wps/wcm/connect/bldcontentnl/belastingdienst/zakelijk/ondernemen/administratie/hoelang-moet-u-gegevens-bewaren

Payhip's privacy policy: https://payhip.com/privacy

MailerLite's tracking explanation: https://www.mailerlite.com/help/how-to-enable-and-disable-tracking

Dutch Autoriteit Persoonsgegevens: https://www.autoriteitpersoonsgegevens.nl/en