Privacy Policy

Last updated: 3 November 2026

This policy explains how Fennequs Ltd ("we", "us", "our") collects and uses your personal data when you use this website and The Art of Open Source Analysis. We are the data controller. Fennequs Ltd is registered in England and Wales with company number 17069975, registered office 20 Wenlock Road, London, England, N1 7GU. Contact us at [email protected].

What we collect

• Account details: your name, email address and password (the password is stored by Thinkific in encrypted form; we can't see it)
• Order details: what you bought, when, the price, any tax charged, your billing country and, if you buy as a business, your VAT number. Card details are handled by Thinkific Payments and Stripe, not by us
• Learning activity: which lessons you open and complete, quiz answers, and any comments, assignments or messages you submit
• Technical data: IP address, sign-in count, device and browser information, collected by Thinkific when you use the site
• Messages: anything you send us by email

We need your name, email address and payment details to sell you a course and give you access. Without them we can't provide the course.

Why we use it, and the legal basis

• Creating your account, giving you course access, processing payments. Legal basis: performance of a contract.
• Sending service emails (receipts, access, course updates). Legal basis: performance of a contract.
• Keeping tax and accounting records. Legal basis: legal obligation.
• Working out the right tax for your country, using your billing address and the country of your payment card. Legal basis: legal obligation.
• Preventing fraud, account sharing and content theft, including reviewing sign-in, IP and lesson activity. Legal basis: legitimate interests (protecting the course and our business).
• Improving the course using progress and completion data. Legal basis: legitimate interests.

We will not sell your personal data. We only email you about your account and the courses you have bought. We won't send you marketing emails, or add you to any other mailing list, unless you separately agree.

We do not make decisions about you based solely on automated processing.

Who we share it with

• Thinkific Labs Inc. (Canada), which hosts the site, stores account and learning data, and runs checkout
• Stripe, which processes payments through Thinkific Payments and uses payment data under its own privacy policy
• Wistia (United States), which streams course videos for Thinkific
• Our accountant and professional advisers, where needed
• Authorities, where the law requires it

Some of these providers process data outside the UK. Canada is recognised by UK adequacy regulations as giving adequate protection. Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise on the UK International Data Transfer Addendum. Email us if you would like more detail on these safeguards.

How long we keep it

• Account and learning data: for as long as your account exists, so you keep access to your courses. If you ask us to delete your account, we will do so within one month, apart from records we must keep by law
• Order and tax records: six years from the end of the company's financial year, as required by UK company and tax law, or ten years for EU VAT records where that law requires it
• Emails: as long as needed to deal with your query

Cookies

The site uses cookies set by Thinkific to sign you in and remember your place in lessons. These are needed for the site to work. Thinkific and its video provider Wistia may also use cookies or similar technologies to measure how the site and videos are used. We do not add our own advertising or analytics cookies.

Your rights

Under UK data protection law you can ask to access, correct, delete, restrict or move your data. You can object to processing based on legitimate interests. Where we rely on your consent, you can withdraw it at any time; this does not affect anything we did before you withdrew it.

Email [email protected] to use any of these rights. We will respond within one month. If a request is complex we may extend this by up to two further months, and we will tell you why.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to sort it out first.

Changes

If we change this policy we'll update the date at the top. Significant changes will be emailed to students.

If we connect another service that receives your personal data, such as an email or analytics tool, we will add it to the "Who we share it with" section before it goes live.