Privacy

PERSONAL DATA PROTECTION POLICY (GDPR)
Súkromná jazyková škola ViP inštitút Paulus

Identification details of the Controller:
• Business name: Súkromná jazyková škola ViP inštitút Paulus, Fraňa Mojtu 18, Nitra
• Registered office / Address: Fraňa Mojtu 18, 949 01 Nitra, Slovak Republic
• Company ID (IČO): 57 766 606
• Contact: institut.paulus@gmail.com
• Legal framework: Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection (Slovak Republic)

1. Introductory provisions
The protection of your personal data is essential to us. This Privacy Policy explains how Súkromná jazyková škola ViP inštitút Paulus collects, processes, protects and retains the personal data of data subjects in accordance with applicable legislation (the GDPR and Act No. 18/2018 Coll.).

2. Purposes, legal bases and categories of data processed
The Controller processes personal data solely for defined purposes and on the basis of valid legal grounds:

A. Provision of educational services and performance of the contract
• Purpose: Registration for a language course, assignment to a group, student records, communication regarding tuition, issuing of certificates.
• Legal basis: Performance of a contract or steps taken prior to entering into a contract (Article 6(1)(b) GDPR).
• Scope of data: First name, surname, academic titles, date of birth, personal identification number, address of residence, nationality, citizenship, e-mail, telephone number, level of language proficiency. In the case of minor participants, also the identification and contact details of the legal guardian.

B. Compliance with accounting and tax obligations
• Purpose: Issuing invoices, records of payments, bookkeeping in accordance with the legislation of the Slovak Republic.
• Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR).
• Scope of data: Billing details (first name, surname or company name, address, company ID and tax ID, bank account number, payment history).

C. Direct marketing and information about news
• Purpose: Informing existing and prospective clients about new courses, discounts and school news.
• Legal basis: Consent of the data subject (Article 6(1)(a) GDPR) or the legitimate interest of the Controller in the case of existing clients (Article 6(1)(f) GDPR).
• Scope of data: Name, e-mail address, photographs from educational events, audio recordings, video recordings.

3. Retention period of personal data
• Contractual data: For the duration of the contractual relationship and subsequently for the period necessary to exercise rights and claims arising from the contract.
• Accounting documents: For a period of 10 years pursuant to the Accounting Act.
• Marketing purposes: Until consent is withdrawn or an objection to processing is raised (a maximum of 5 years from the last interaction).

4. Recipients and processors of personal data
We do not disclose personal data to unauthorised third parties. To the extent necessary, data may be made available to the following categories of recipients:
• Qualified teachers and contracted lecturers of the Language School.
• Providers of accounting and tax services.
• Providers of IT services, web hosting, e-mail and online teaching platforms (e.g. MS Teams, Zoom, Hostinger).
• Public authorities, where required by specific legislation.

5. Transfer of personal data to third countries
The Controller primarily stores and processes personal data within the European Economic Area (EEA). Where cloud or teaching services are used (e.g. Google Workspace, Zoom, Microsoft), any transfer is governed by the EU standard contractual clauses and appropriate security safeguards.

6. Rights of data subjects
Under the GDPR, the data subject has the following rights:
1. Right of access: To request confirmation of processing and a copy of the personal data.
2. Right to rectification: To request the correction of inaccurate data or the completion of incomplete data.
3. Right to erasure ("right to be forgotten"): To request the erasure of data where it is no longer necessary for the stated purposes or where consent has been withdrawn.
4. Right to restriction of processing: To request the restriction of processing while the accuracy or lawfulness of the processing is being verified.
5. Right to data portability: To obtain the personal data in a structured, commonly used format.
6. Right to object: To object to processing based on legitimate interest or for direct marketing purposes.
7. Right to withdraw consent: To withdraw consent at any time free of charge by sending an e-mail to institut.paulus@gmail.com.
8. Right to lodge a complaint: To lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, Bratislava, www.dataprotection.gov.sk).

7. Security of personal data
The Controller has adopted appropriate technical, organisational and personnel measures (encryption, secured servers, restricted access) in order to prevent unauthorised access to, loss of, damage to or misuse of personal data.

8. Final provisions
This Privacy Policy takes effect on the date of its publication. The Controller reserves the right to update it in the event of changes to legislation or to processing operations.