Privacy Policy

The party responsible for processing personal data (the controller) is:

We collect only the data necessary to provide our services:

When registering for a course or submitting a request

• First and last name of the parent or student
• Contact e-mail and phone number
• Child’s name, date of birth, school, grade (if applicable)
• Any message or additional information you provide in the form

When purchasing learning programmes

• Buyer’s first name, last name, e-mail
• Payment information is processed by the payment provider Paysera — we do not store bank card data

Automatically when visiting the site

• Technical browser data (type, version, screen resolution)
• IP address — for security and spam protection
• Strictly necessary cookies (see the “Cookies” section)

• Organising the learning process: forming groups, scheduling, communicating with parents and students
• Processing requests and payments: accepting requests, issuing invoices, delivering purchased materials
• Informing: notifications about schedule changes, lesson reminders, answering your questions
• Fulfilling legal obligations: tax and accounting records
• Protecting the site: preventing spam, fraud and attacks

Legal basis: performance of the contract with you (GDPR Art 6(1)(b)), compliance with legal obligations (Art 6(1)(c)) and our legitimate interest in ensuring the security of the site (Art 6(1)(f)).

• Student and parent data — while the child studies with us and for three years after the end of study (for possible enquiries and requests).
• Programme buyers’ data — three years from the date of purchase.
• Accounting documents — seven years in accordance with the Estonian Accounting Act.
• Site requests that did not lead to a contract — one year.
• Technical logs and IP addresses — up to 90 days.

After the retention period, data is deleted or anonymised.

We do not sell or share your data with third parties for marketing purposes. Data may be shared with our processors strictly to provide services:

• Paysera (Lithuania, EU) — payment processing. Terms: paysera.com/privacy
• Brevo (France, EU) — sending transactional e-mails (confirmations, material links). Terms: brevo.com/privacy
• Hosting providers — for hosting the site and database (servers located in the EU).
• Government authorities — only when required by law (for example, tax or law-enforcement authorities upon official request).

All processors are bound by data protection agreements and process information only on our instructions.

The site uses only strictly necessary cookies to function:

• Authentication session — to keep you logged in (registered users only).
• CSRF protection — for form security.
• Local settings — for example, consent to show the app install banner. Stored in the browser and not sent to us.

We do not use advertising or marketing cookies and do not connect third-party trackers or analytics systems that track users across sites.

In accordance with GDPR, you have the right to:

• Access your data — find out what data we hold about you.
• Rectify data — ask us to update inaccurate or incomplete information.
• Erase data (“right to be forgotten”) — except for data we are required to keep by law (for example, accounting).
• Restrict processing — ask us to temporarily suspend the use of your data.
• Receive data in a portable format — to transfer to another service provider.
• Withdraw consent — if processing is based on consent (for example, use of photos from lessons).
• Object to processing — if we process your data based on legitimate interest, you have the right to object to such processing.
• Lodge a complaint with the Estonian supervisory authority — the Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee.

To exercise any of these rights, write to us at estenglishschool@gmail.com. We will respond within 30 days.

• The site runs over the secure HTTPS protocol — all data is encrypted in transit.
• User passwords are stored encrypted (bcrypt); we cannot see them.
• Only staff who need it for their work have access to the data.
• All actions in the admin panel are logged.
• Payment data is processed only by Paysera and is not stored on our servers.

Since our centre works with children, we process the data of minors only with the consent of their parents or legal guardians. A course request is submitted by an adult, who accepts the terms of this policy.

Consent to use photo and video materials from lessons is requested separately in the request form and may be withdrawn at any time.

• We do not use automated decision-making or profiling that would have legal consequences for you or significantly affect you.
• Data is stored within the European Economic Area (EEA). Our processors (Paysera, Brevo, hosting) are located in the EU. If data transfer outside the EEA becomes necessary in the future, we will ensure appropriate safeguards in accordance with GDPR.

We may update this policy. Significant changes will be published on this page with a new update date. If changes affect your rights, we will additionally notify you by e-mail.

For any questions related to the processing of personal data, write to estenglishschool@gmail.com.