Privacy Notice

Nexorio s. r. o. · Denis Bubeník brand Version 2.1.1 · effective 26 October 2026

The short version

• Who: Nexorio s. r. o. in Slovakia decides how your data is used. EU data protection law (the GDPR) applies to everything we do, wherever you live.
• What: the data you give us (for example your email address, messages and purchase details) and some technical data.
• Why: to send what you asked for, deliver what you bought, answer you, keep records the law requires and, only if you agree, send marketing emails and measure website visits.
• Automatic replies: when you request a resource on Instagram, you may get a fixed reply we wrote, delivered through Manychat. Ordinary Messenger handling is manual, apart from the controlled review case below. Our separate n8n integration receives Meta events for technical checks and sends fixed resource replies only for the controlled Meta App Review keyword described in section 3.7. We do not use an AI model to read or answer your messages.
• Video tools: we do not put your data into the tools we use to make videos.
• We do not sell your data. We do not use advertising pixels.
• Your rights: you can ask to see, correct or delete your data, unsubscribe at any time, and complain to a data protection authority.

1. Who is responsible

1.1 Controller. The controller is Nexorio s. r. o. (formerly BRISO SLOVAKIA s. r. o.; same company, renamed in August 2026), Palánok 1, 949 01 Nitra, Slovakia. Company ID (IČO): 55 918 263. It runs the website bubenikdenis.com and sells the products and courses presented under the Denis Bubeník brand.

1.2 Contact for privacy questions. privacy@bubenikdenis.com, or post to the address above. For purchase support use support@bubenikdenis.com; for refunds/withdrawal use refunds@bubenikdenis.com.

1.3 Data protection officer. We are not required to appoint a data protection officer and have not appointed one. Please send privacy questions to privacy@bubenikdenis.com.

1.4 Quebec. For people in Quebec, the person in charge of the protection of personal information at Nexorio is our managing director. You can contact this person at privacy@bubenikdenis.com or by post at the address in section 1.1.

1.5 Whop. Whop, Inc. runs its platform, accounts, checkout and payments. For buyer data that Whop makes available to us under its Seller Data Sharing Addendum, Whop and Nexorio act as independent controllers, and each handles the privacy requests it receives. Whop can make available to us your Whop user ID and username, your name and contact details (such as email address, address and phone number), your IP address, and your purchases and payments with us. We use only what we need for your purchase and support (section 3.3). Whop explains its own processing at https://whop.com/privacy/. This notice explains Nexorio's processing.

2. What this notice covers

This notice covers personal data we process when you:

• visit bubenikdenis.com,
• sign up for the free video or, if we later offer them, our emails,
• comment on or message our accounts on Instagram, Facebook, TikTok or YouTube, and, on Instagram or Facebook, get an automatic reply,
• talk to our AI assistant, if we add one (section 3.8),
• buy a course, minicourse, add-on, toolkit or starter on Whop, and use it,
• work through the sprint, or send us a scorecard or feedback,
• ask for a refund, withdraw from a contract or report a problem,
• write to us by email or through the contact form,
• apply to become an affiliate, if we open an affiliate program.

3. What we use, why, and on what legal basis

The legal bases below refer to Article 6(1) of the GDPR:

• (a) your consent,
• (b) a contract with you, or steps you asked for before one,
• (c) a legal obligation,
• (f) our legitimate interests, which we balance against your rights.

3.1 Free video

• Data: email address; first name if you give it; whether you ticked the optional box for course news and the exact wording shown next to it; the time of your request; the page you signed up on; and whether our email provider accepted the email with your link.
• Why: to email you the link to the free video and the free files you asked for, and to keep a record of your choice about course news. A separate waitlist or marketing form is not activated by a resource request.
• Legal basis:
• sending what you asked for — (b),
• marketing emails — your consent (a), which you give with a separate, unchecked box,
• keeping proof of your consent — (c) and (f).
• If you're in Canada: we send you marketing emails only if you gave your express consent by ticking the optional box. You can withdraw it at any time with the unsubscribe link in every marketing email.

3.2 Marketing emails

• Data: email address, name, consent record, emails sent to you, unsubscribes.
• Launch status: no launch-announcement or marketing series is activated at launch. The purchase email flow sends the purchase confirmation only; any requested free-resource link is separate. The rules below apply only if a later marketing flow is specifically activated with valid consent.
• Tool: our website, our database at Supabase in the EU and our email provider Resend. Emails come from Denis Bubeník <denis@bubenikdenis.com>, and replies go to support@bubenikdenis.com.
• Measuring: open and click tracking is off for the launch marketing flow. Basic delivery/failure events are distinct from measuring engagement.
• Why, if later activated: to send the specific course news or useful content you separately subscribe to. Any welcome series is marketing and needs its own consent even if it includes a free-video link. No welcome schedule or launch email is promised or activated at launch.
• Legal basis: consent (a). You can unsubscribe with one click in every email. We act on an unsubscribe without delay, and within 10 business days at the latest. The unsubscribe route remains available for at least 60 days after each marketing email.
• Required content: every marketing email shows who sends it and Nexorio's valid postal address and contact route.
• Not a condition of purchase: marketing consent is never required to buy.

3.3 Purchases and course access

• Data:
• Whop account and membership identifiers,
• order number,
• product and plan,
• whether you have access,
• currency and amount paid,
• the contact email Whop gives us,
• your selected access/product options; a later group option is not active at launch,
• lesson progress recorded by Whop's course app: which lessons you completed, your completion rate and when you first and last used the course. We can see this in Whop as the course owner; we do not copy it into our own systems.
• Why: to provide immediate Whop access to the purchased course and all its main-course drops, confirm your order immediately after a verified purchase, give support and keep track of the founder count. There is no timed drip or sprint-email sequence at launch.
• How it moves: our website runs on Vercel. We keep private purchase and confirmation records in our own database at Supabase in the EU (Ireland) and send the confirmation email through Resend. We receive from Whop only the purchase and access data we need. Whop opens purchased lessons immediately and does not wait for the email. The n8n integration described in section 3.7 is not used for purchases or course emails.
• Legal basis: the contract (b). For a business buyer's representative, also our legitimate interest in handling the business purchase (f).
• Note: the date your Whop membership was created is not automatically the date of your contract.

3.4 Terms and early-access choice

• Data:
• whether you buy as a consumer or a business,
• which terms you accepted,
• the information we showed you,
• your express request for early supply and your acknowledgement through two separate, initially unchecked statements on our website before Whop checkout, distinct from general terms, marketing and payment,
• email and selected product, actual answers, time, language and exact text/document version,
• the link to the later verified purchase; a pre-checkout request alone does not show payment or supply.
• What we keep: the immutable contract confirmation, the version and wording of the information displayed, your express early-supply choice and acknowledgement, timestamps and purchase reference, plus actual confirmation-generation, sending and provision evidence. We send confirmation immediately after a verified purchase; immediate Whop access does not wait for email. We record the real sequence rather than inventing that confirmation preceded access. A successful send alone is not proof you read the confirmation or that all statutory withdrawal-exception conditions were met.
• Legal basis: legal obligation (c), the contract (b), and protecting legal claims (f).
• Note: the early-access choice is not marketing consent and not consent under the GDPR.

3.5 Refunds, withdrawal and defects

• Data: name, email, order details, what you wrote, time, the evidence needed, and the outcome.
• Legal basis: legal obligation (c), our refund policy as part of the contract (b), and protecting legal claims (f).

3.6 Support and email

• Data: name, email, company if given, and your message.
• Legal basis: steps you asked for or the contract (b). For general business emails, our legitimate interest in answering (f).
• Please don't send: passwords, card details, your customers' personal data, or health data. An anonymous description is enough.

3.7 Requested resources through Instagram comments and messages

This section concerns the Instagram account @bubenik.denis and our Meta integration, Nexorio Sales Agent. Nexorio s. r. o., identified in section 1, is the controller. For these requests, use privacy@bubenikdenis.com.

When you request a free resource using the stated keyword in an Instagram comment or direct message, we use the relevant comment or message, account identifiers and request status to deliver the link you asked for. A comment request may also receive a short public reply. We use Manychat for Instagram delivery. Ordinary Facebook Messenger messages to Denis - Contractor Systems are handled manually; Messenger is not connected to Manychat. The controlled n8n App Review exception is described below.

Requesting a resource does not subscribe you to promotional emails or authorise unrelated private messages. You do not need to buy a product, provide an email address or follow the account to receive the resource. We process these limited requests on the basis of our legitimate interests in answering requests you initiate, preventing duplicate replies and honouring requests to stop, under Article 6(1)(f) GDPR. You may object at any time using the contact below.

Information and recipients

Manychat receives and stores a contact profile containing the name, Instagram account and platform identifier, profile photo where made available by Meta, comment or message contents, conversation history and interactions needed for the service. A resource request therefore creates records in Manychat as well as on Instagram; it is not processed only in our Meta inbox.

• Manychat, Inc. · United States · processor: Instagram contact profiles, message history and request interactions, to deliver the requested resource and manage the conversation. Manychat processes this data for us under its Data Processing Addendum, which forms part of its Terms of Service. Its subprocessor list names the providers it uses to run the service.
• Contabo GmbH · Germany · hosting processor under a data processing agreement with Contabo: hosts our self-managed n8n and its database on a server in the European Union for the parallel technical check below. This is separate from Manychat's platform.
• Google (Google Workspace) · processor: stores encrypted offsite disaster-recovery copies of our n8n database and settings in our corporate Google Drive. Its role, data and transfer safeguards are described in section 6.2.
• Meta · platform provider: provides Instagram and Facebook Messenger and processes platform data under its own Privacy Policy, separately from Nexorio's responsibilities. Other applicable platform roles are described in section 6.

Use of Manychat involves international transfers, including to the United States; our separate EU server does not make the whole workflow EU-only. Manychat, Inc. is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as giving adequate protection. Where the framework does not apply, Manychat's Data Processing Addendum provides the European Commission's Standard Contractual Clauses. You can ask us for information or a copy of the applicable safeguards.

Parallel technical checks and retention

Our self-hosted n8n integration receives relevant Meta events to check request handling. Ordinary Instagram resource requests using CLOCK, TEXTS or SIGNED are handled by Manychat. For the controlled Meta App Review case only, n8n sends a fixed Quote Clock resource reply when a comment, Instagram direct message or Facebook Messenger message uses the review keyword METAREVIEW; a comment can also receive one short public reply. Anyone who uses that review keyword can receive the fixed reply, with at most one automatic message per person and channel in 24 hours. Otherwise, n8n sends no replies. An event can include message or comment text, a name and platform identifiers. Its delivery log records time, channel, keyword, post identifier, outcome and mode, without the text, name or person identifier. That limited log is not the entire processing record.

For n8n, cleanup runs every 10 minutes and removes successful execution payloads once they are at least 15 minutes old. Error payloads can contain the original event and are scheduled for deletion after 14 days. Duplicate-prevention entries expire after 24 hours and are removed during a subsequent workflow run. Minimal stop records are retained while needed to honour an objection. Backups of the n8n database and settings are stored on the same server in the EU (Contabo GmbH), unencrypted, and removed automatically after about two weeks (at the latest after 16 days); deletion of active data does not immediately erase backups. Contabo GmbH also keeps a separate daily copy of the whole server for up to 10 days.

We also keep encrypted offsite disaster-recovery snapshots in our corporate Google Workspace Drive. The backup job retains 14 daily and 8 weekly snapshots. A snapshot can include older local backup files, so the 16-day local limit does not apply to offsite copies and snapshot retention is not a single fixed deadline for erasing each record. Deleting active data does not immediately remove these backup copies; if we restore them, we re-apply earlier deletion requests.

Manychat contact profiles and conversation history do not automatically disappear when a resource is delivered. We delete a Manychat contact and its conversation history no later than 12 months after your last interaction with us, or sooner if you ask (see below). We keep a minimal record longer only where needed to honour a request not to be contacted, or for a specific legal obligation or claim. The n8n deletion periods above do not apply to Manychat or Meta. Deleting a record does not immediately remove copies in a provider's backups. Downloading a PDF may also create ordinary website technical records as described in this notice.

Data deletion instructions for social resource requests

To request access, correction, deletion, or that we stop automated resource replies, email privacy@bubenikdenis.com. For deletion, use the subject Delete my social resource request. Tell us whether you used Instagram or Facebook, your account handle and, if known, the approximate request date or post. Do not send passwords, payment details or identity documents in your initial request.

A person will locate the records, proportionately verify that the request concerns you, and explain the action taken. This includes relevant records held for us in Manychat and our n8n installation. We normally respond within one month; any lawful extension and reason will be explained. We may retain a minimal suppression identifier to honour a request not to be contacted, or information required by law or a specific claim, and explain why. Asking us to stop replies is different from deleting every record.

These instructions concern Nexorio's records, including processing through Nexorio Sales Agent. They do not delete your Instagram or Facebook account or records independently controlled by Meta. Use the platform's privacy controls for those records. These are human request instructions, not an automatic data-deletion callback. The rights and complaint options in section 10 remain available. The stable instruction URLs are https://bubenikdenis.com/privacy#comment-dm and https://bubenikdenis.com/privacy#data-deletion.

Other social messages and scheduling

On TikTok and YouTube we read and answer comments, and messages on TikTok, ourselves in the platforms' own apps, including TikTok Studio and YouTube Studio. We do not use automatic replies on TikTok or YouTube. Scheduling our own posts in the platforms' own apps and tools uses our own content. The platforms also process account and interaction data under their own policies. For Facebook Page statistics (Page Insights), Meta's and Nexorio's roles are described in section 6.

We answer only people who initiate contact or request the stated resource; we do not send cold messages to new followers or people who did not request a reply. Any promotional direct messages require their own permission and compliance with the platform's rules. Any future recipient must be named in section 6, and this notice updated, before it receives personal data.

3.8 AI assistant (not used at launch)

• Today: we do not use an AI assistant. Automatic replies are fixed texts we wrote (section 3.7). A person reads and answers everything else.
• If we add one later: we will name its provider in section 6 and update this notice before it reads any message. It would then read your message and write the reply under the rules in section 4.
• Data it would use:
• your message,
• your username,
• the conversation history needed to answer,
• the approved facts it answers from.
• Legal basis: steps you asked for (b), or our legitimate interest in answering quickly (f).

3.9 Sprint, scorecards, feedback and testimonials

• Scorecards and feedback:
• Sending a scorecard, question or feedback is optional. We use it to help you and to improve the course.
• Legal basis: the contract (b) or our legitimate interest (f).
• Please remove your customers' details first.
• Later summaries, if offered: the group option and its summaries are not active at launch. Any later group summaries use only genuinely anonymised questions. We remove customer details and identifying context, not just names. We do not send raw questions or messages to an AI model.
• Testimonials:
• We use your name, words, image or results in marketing only with your separate written consent (a).
• You can withdraw it for future use at any time.
• We keep the consent record as proof (c, f).

3.10 Affiliates (only if we open a program)

• Data:
• name, email, channels and audience description,
• application answers,
• affiliate link activity,
• commissions and payout details handled through Whop,
• the posts we check for proper disclosure.
• Legal basis:
• the affiliate agreement (b),
• legal obligations (c),
• our legitimate interest in checking that affiliates disclose the commission and make no false claims (f).

3.11 Accounting

• Data: identity, billing and transaction data needed for accounting and tax.
• Legal basis: legal obligation (c).
• Note: the website's order confirmation is not a tax invoice or proof of a bank payout.

3.12 Security and running the website

• Data: IP address, time and address of the request, browser information, sign-in session data, technical errors.
• Why: to protect the website and paid content.
• Legal basis: legitimate interest (f).

3.13 Optional analytics

• Data: visits to public pages, as described in section 9.
• Legal basis: your consent (a).

3.14 Research for our content

• What we read: to decide what to teach, we read public posts and comments about running a trade business.
• What we keep: only the text of common questions, with the date and the platform where we saw them, without names, usernames, profile links or screenshots.
• Legal basis: legitimate interest (f).

3.15 Older products: contact form, withdrawal form and local tools

These parts of v1.5 stay in place.

• Contact form: it prepares a message in your own email app. It sends nothing to our server; you send the message yourself.
• Online withdrawal form (https://bubenikdenis.com/withdrawal, https://bubenikdenis.com/en/withdrawal, https://bubenikdenis.com/odstupenie):
• You send your name, email and order details after checking them.
• We record the notice, reference, UTC time, language and confirmation version.
• You can save the confirmation as a TXT file, and we also email it.
• Receiving a notice is not the same as finishing a refund.
• Toolkit working tools:
• Answers, calculations and notes stay in your browser. They are not sent to us or to Whop automatically.
• Signing in does not sync them between devices.
• An export is a file on your device. If you send it to us, we use it to handle your request.
• Toolkit sign-in:
• Uses your Whop account ID and basic profile (openid profile), without access to your email inbox.
• A separate server check of your membership gives us the contact email for your confirmation.
• The server checks your product, access and confirmation record. This is a technical access check, not a personal or financial assessment. If it seems wrong, ask for a person to review it.

3.16 What we never ask for

We never receive your Whop password or full card details. We don't ask for ID documents or other data we don't need. If we don't get the data we need, we may not be able to deliver a purchase or handle a request.

4. Automatic replies and any future AI assistant

4.1 Automatic replies and an AI assistant.

• Automatic replies are fixed texts we wrote. The tools named in section 3.7 deliver the requested resource when you use the stated keyword or start a conversation. Any reply about prices and the founder count, access, how to ask for a refund, or product links uses approved facts. The n8n integration replies only in the controlled Meta App Review case described in section 3.7; otherwise it records a limited delivery log.
• A person reviews complaints, refund disputes and anything outside those facts before we answer.
• If we add an AI assistant later:
• it tells you it is an AI and does not sign as Denis. If you ask whether you're talking to a bot, it answers truthfully,
• it answers automatically only from the same approved facts,
• it does not make decisions about you that have legal or similarly significant effects (GDPR Article 22). It cannot approve or refuse refunds.

4.2 AI provider settings. If we add an AI assistant, we will use the provider's business service under its data processing terms. Before it reads any message, we will check that the provider does not use your messages to train its models, how long it keeps them and where it processes them, and we will state this here.

4.3 Other AI tools. We do not put buyers' or followers' messages into AI tools, and we do not use the AI reply features of Manychat, Meta Business Suite, TikTok or YouTube.

5. Where the data comes from

• From you: forms, emails, comments and messages.
• From Whop: purchase and membership data.
• From the social platforms: your username, public profile and messages, when you contact us there.
• From links you click: a campaign label in the link, without personal data.

6. Who receives the data

6.1 Who sees your data. Authorised Nexorio staff and the providers below see your data, only as far as they need it. Accountants, advisers, courts or authorities may receive data where the law requires it or to protect legal claims.

6.2 Providers and platforms. "Processor" means the provider works for us under our instructions. "Own controller" means the provider decides its own use under its own policy.

Tools we may add. Before a new tool receives personal data, we will list its role, data and location here. It must have data processing terms and a transfer safeguard where needed (section 7).

6.3 Nexorio's use of data. Nexorio does not sell your personal data or share it for cross-context behavioural advertising. This statement concerns Nexorio's practices. Whop acts independently: its Privacy Policy describes its own cookies, analytics and targeted advertising, including possible "sale" or "sharing" of personal information as defined by California law. You can exercise those choices with Whop.

7. Transfers outside the EU

Some providers are in the United States or process data there. We use them only with a legal safeguard for each provider:

• an EU adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or
• the European Commission's Standard Contractual Clauses.

An EU database, EU n8n server or EU sending region does not mean that all related data stays in the EU. These providers are in the United States or may process data outside the EU:

• Manychat, Vercel, Resend and Google: certified under the EU-U.S. Data Privacy Framework; their data processing terms also include the European Commission's Standard Contractual Clauses.
• Supabase and Namecheap: the European Commission's Standard Contractual Clauses in their data processing terms. Our Supabase database is stored in the EU (Ireland).
• Whop and Meta: act as independent controllers under their own policies (sections 1.5 and 6.2).

You can ask us for a copy or description of the safeguards at privacy@bubenikdenis.com.

8. How long we keep data

We keep data only as long as we need it for the purpose. When a period ends, we delete the data or make it anonymous. Where we keep data for a legal obligation or a specific claim, we keep only what that obligation or claim needs.

Deleting active records does not instantly delete backups or emails already delivered. Providers may keep their own records under their own policies. Ending your course access does not delete accounting records or your Whop account.

9. Cookies and analytics

9.1 Necessary cookies. These protect sign-in and your session on the toolkit members area:

• the sign-in window lasts at most 10 minutes,
• a session lasts at most 8 hours.

They can end earlier when you sign out or lose access. Blocking them may stop sign-in. This is separate from your 731-day access period.

9.2 Withdrawal form security. The withdrawal form uses security counters made from your email and IP address with a one-way code (HMAC). The counters do not contain the email or IP address in plain text.

9.3 Google Analytics 4 — only with your consent.

• Before you agree: the Google script does not load at all.
• What we measure: visits to public pages, language, general source of traffic and campaign labels that contain no personal data.
• What we never send:
• form contents or tool answers,
• sign-in data,
• withdrawal notices or contract confirmations,
• members-area activity,
• messages.
• Page addresses: sent without query parameters.
• Cookies: _ga and _ga_* cookies last at most 180 days. We remember your choice for 6 months.
• Data kept at Google: individual data for 2 months. Summary reports may be kept longer.
• Changing your mind: use "Cookie settings" in the footer at any time. Saying no does not limit the website or anything you bought.

9.4 No advertising pixels on our website. Nexorio does not use advertising pixels or advertising features in Google Analytics on its website. If that changes, we will update this notice and ask for your consent first.

9.5 Video on the free video page. The free video plays in a standard video player on our own website. It is not embedded from YouTube or another video platform, and the player does not set cookies. Apart from Google Analytics, which runs only if you agree (section 9.3), watching it creates only the ordinary technical records described in section 3.12.

9.6 Other sites. Whop, the social platforms and other sites we link to have their own cookies and rules.

10. Your rights

10.1 Your rights under the GDPR. Under the conditions of the GDPR you have the right to:

• see your data and get a copy,
• correct it,
• have it deleted,
• restrict its use,
• take it with you (portability),
• object to processing based on legitimate interests, and always to direct marketing,
• withdraw consent at any time. This does not affect what we did before.

10.2 How to ask. Email privacy@bubenikdenis.com.

• We may check, in a proportionate way, that the request is about your data.
• We usually answer within one month. If we need more time as the law allows, we tell you why.
• Automatic replies (and any AI assistant we may add later) do not handle privacy requests. A person does.

10.3 Complaints. You can complain to the Office for Personal Data Protection of the Slovak Republic (https://www.dataprotection.gov.sk/) or to the authority where you live.

10.4 If you live in the United States.

• We give the same rights to everyone, whatever your state.
• We do not sell personal data and do not share it for cross-context behavioral advertising.
• We do not use sensitive personal data to infer things about you.

10.5 If you live in Canada.

• Canadian privacy law gives you the right to access and correct your personal information.
• The person responsible for protecting personal information at Nexorio is its managing director. You can reach them at privacy@bubenikdenis.com.
• We and some of the providers in section 6 store or process your information outside Canada, in the European Union and the United States. There, courts and authorities may be able to access it under local law.
• You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

11. Children

Our website, courses and emails are for adults running or working in a business. Buyers must be at least 18. We do not knowingly collect data from children under 16, or under 13 in the US. If you think a child sent us data, tell us and we will delete it.

12. Security

12.1 How we protect data. We use access controls, sign-in protection and separate private storage for contract and withdrawal records. The n8n integration described in section 3.7 and its PostgreSQL database run on a virtual server we rent from Contabo in the EU. The database is not publicly reachable and n8n diagnostics are switched off. Access to the server is limited to Denis and our authorised technical operator. Local backups are kept on the same server. We also keep encrypted offsite disaster-recovery copies in our corporate Google Workspace Drive. The separate backup layers and retention are described in sections 3.7 and 8.

12.2 Your part. Protect your own devices and your Whop login.

12.3 Data breaches. If a breach puts your rights at high risk, we will tell you as the law requires.

13. Community

The optional free English peer community on Whop is currently closed. If we open it or a discussion group, joining is separate from buying and from marketing consent.

• What others see: moderators and other members can see what you post and your profile, depending on the settings.
• What not to post: customer records, credentials or payment details.
• What we do: we use moderation data only to run the space safely.

The community rules explain the rest.

14. Changes to this notice

We update this notice when our processing changes, for example when we add a tool. The date and version are at the top. For important changes that affect you, we tell you by email or on the website.

Version history: 1.4 (8 October 2026), 1.5 (9 October 2026, toolkits and community), 2.0 (16 October 2026, draft, not published), 2.1 (26 October 2026, courses and current tools), 2.1.1 (26 October 2026, corporate Workspace backup disclosure).