Privacy Notice

Who is the controller

DPAV International (trading as Bri Beyond Borders) is the controller of personal data collected through this Service. We decide what data is collected and how it is used.

What we collect

• Account data: name (if provided), email address, password hash, sign-in provider (e.g. Google).
• Purchase data: which itineraries you've unlocked, your subscription status, and a reference to your Stripe order (we do not store your full card details — Stripe does).
• Communications: messages you send us via email or any contact form.
• Usage and device data: pages viewed, approximate location inferred from IP, browser/device information, and basic analytics events.
• Cookies: essential cookies needed to keep you signed in and remember your session.

Why we use it (and on what legal basis)

• Provide the Service — create your account, unlock itineraries, run the subscription. Legal basis: performance of a contract.
• Customer support — answer your questions, fix issues. Legal basis: legitimate interests / contract.
• Security & fraud prevention — detect abuse, protect accounts. Legal basis: legitimate interests / legal obligation.
• Product improvement & analytics — understand which content resonates. Legal basis: legitimate interests.
• Marketing emails — only if you opt in. Legal basis: consent.
• Legal compliance — tax, accounting, responding to lawful requests. Legal basis: legal obligation.

Who we share data with

• Stripe — our payment processor. Stripe handles card processing, billing, and subscription management. See Stripe's Privacy Notice.
• Hosting and infrastructure providers that run the website, database, and authentication.
• Email and analytics providers we use to send transactional email and measure traffic.
• Professional advisers (legal, accounting) when needed.
• Authorities where we're required to disclose by law.

We don't sell your personal data.

International transfers

Some of our service providers are located outside your country, including in the United States and the European Economic Area. When personal data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

We keep your account data for as long as your account is active. Purchase and tax records are kept for as long as required by law (typically 6–10 years). Support emails are kept for up to 3 years. We delete or anonymize data when it is no longer needed.

Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Ask us to delete your data ("right to erasure").
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with your local data protection authority (in the UK, the ICO).

We aim to respond within one month. To exercise any of these rights, email pavlotskypursuits@gmail.com.

Security

We use industry-standard technical and organizational measures (encryption in transit, access controls, secure hosting, hashed passwords) to protect your data. No system is perfectly secure, but we work to keep yours safe.

Cookies

We use a small number of cookies, mostly essential ones that keep you signed in. Where we use analytics, those cookies are limited to understanding overall traffic patterns. You can manage cookies through your browser settings.

Children

The Service is not directed at children under 16, and we don't knowingly collect their personal data.

Changes

If we make material changes to this notice, we'll update the date above and, where appropriate, let you know directly.

Contact

DPAV International — email pavlotskypursuits@gmail.com.