Scuola Italiana
Courses Gift Cards

PRIVACY POLICY

SCUOLA ITALIANA s. r. o. – Live Online Italian Language Lessons

Data Controller

SCUOLA ITALIANA s. r. o.

Registered Office

Laurinská 11, 811 01 Bratislava-Staré Mesto, Slovak Republic

Company ID No.

57 773 289

Registration

Commercial Register of the Slovak Republic, Section Sro, Insert No. 56823/S

E-mail

[email protected]

This Privacy Policy provides information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the “GDPR”) and Act No. 18/2018 Coll. on Personal Data Protection. It applies to the processing of personal data in connection with the provision of live online Italian language lessons by SCUOLA ITALIANA s. r. o.

ARTICLE I. PERSONAL DATA WE PROCESS

  1. Depending on the service used, we process, in particular, the following personal data: first name, surname, address, e-mail address, telephone number, billing details, information concerning the course or package ordered, language level, lesson dates and times, payment information, and records of communication between the parties.
  2. In the case of a minor student, we may process the child’s first name and surname, age or date of birth, language level, and the personal data of the child’s legal representative to the extent necessary for entering into and performing the contract.
  3. In connection with online lessons, providers of video-conferencing platforms may process technical and operational data necessary to establish and maintain the connection. Unless otherwise provided by the applicable terms and conditions of the relevant platform, lessons are not routinely recorded by the Controller.
  4. When using the website, technical data and cookies may be processed. Further information is provided in the separate Cookie Policy.

ARTICLE II. PURPOSES AND LEGAL BASES FOR PROCESSING

  1. Enquiries, assessment of the appropriate service, and pre-contractual communication – Article 6(1)(b) GDPR.
  2. Entering into and performing the contract, course registration, scheduling, provision of online lessons, communication with the teacher, and administration of payments – Article 6(1)(b) GDPR.
  3. Invoicing, accounting, tax and statutory record-keeping obligations – Article 6(1)(c) GDPR.
  4. Protection and defence of legal claims, keeping records of contractual performance, and ensuring the security of information systems – the legitimate interests of the Controller pursuant to Article 6(1)(f) GDPR.
  5. Newsletters and marketing communications – voluntary consent pursuant to Article 6(1)(a) GDPR, unless the statutory exception for direct marketing of the Controller’s own similar goods or services under Section 116 of Act No. 452/2021 Coll. applies. Marketing communications may be refused at any time. Contact details obtained in connection with the sale of goods or services may, under the regime applicable to the Controller’s own similar goods or services, be used for direct marketing for a maximum period of one year following termination of the contractual relationship.
  6. Analytical and marketing cookies – the user’s consent, unless an exemption is provided for by applicable law.

ARTICLE III. RECIPIENTS AND ONLINE PLATFORMS

  1. Personal data are made accessible only to persons who need access to them for the purposes of providing the service, in particular authorised employees and the relevant teacher.
  2. Personal data may be processed by providers of accounting and invoicing services, web hosting, IT support, e-mail and newsletter services, and video-conferencing platforms, such as Microsoft Teams, Google Meet, Zoom, or another comparable platform selected for a particular lesson.
  3. Personal data may be disclosed to public authorities or other authorised entities where required by applicable law.
  4. Where a service provider processes personal data on behalf of the Controller, the processing shall be governed by a data processing agreement or another legal mechanism pursuant to Article 28 GDPR, where required.

ARTICLE IV. TRANSFERS TO THIRD COUNTRIES

  1. Some providers of IT or video-conferencing services may process personal data outside the European Economic Area. Any such transfer shall take place only where the requirements of Chapter V of the GDPR are satisfied, in particular on the basis of an adequacy decision or appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission.

ARTICLE V. DATA RETENTION PERIODS

  1. Personal data obtained from an enquiry which does not result in a contractual relationship are generally retained for no longer than 12 months from the end of the relevant communication.
  2. Data relating to an order and the provision of a course are retained for the duration of the contractual relationship and subsequently generally for 3 years following its termination, unless a specific legal obligation or the protection or exercise of legal claims requires a longer retention period.
  3. Accounting and tax documents are retained for the period prescribed by applicable law, generally for 10 years.
  4. Marketing data processed on the basis of consent are processed until the consent is withdrawn. Records documenting the granting and withdrawal of demonstrable marketing consent are retained to the extent required by Act No. 452/2021 Coll., for at least four years following the withdrawal of consent.

ARTICLE VI. RIGHTS OF THE DATA SUBJECT

  1. Subject to the conditions set out in the GDPR, the data subject has, in particular, the right of access, the right to rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interests.
  2. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal. The data subject may object to direct marketing at any time.
  3. Data subject rights may be exercised by contacting the Controller at the e-mail address specified in the heading of this Privacy Policy.
  4. The data subject has the right to lodge a complaint with, or initiate proceedings before, the Office for Personal Data Protection of the Slovak Republic:

Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic

Website: www.dataprotection.gov.sk

ARTICLE VII. PROVISION OF DATA, SECURITY AND FINAL PROVISIONS

  1. Data marked as mandatory are necessary for processing an order or providing the service. Without such data, it may not be possible to enter into a contract or provide online lessons. Consent to marketing communications is not a condition for ordering or using the service.
  2. The Controller does not carry out decision-making based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the data subject, unless expressly stated otherwise for a particular service.
  3. The Controller implements appropriate technical and organisational measures to protect personal data and restricts access to such data to persons who require it for the performance of their duties.
  4. This Privacy Policy may be updated in response to changes in applicable legislation, the platforms used, or the scope of services provided. The current version shall be made available on the Controller’s website.
  5. This Privacy Policy shall take effect on October 1st, 2026.