Privacy

PERSONAL DATA PROTECTION POLICY (GDPR)
Súkromná jazyková škola ViP inštitút Paulus

Identification details of the Controller:

Business name: Súkromná jazyková škola ViP inštitút Paulus, Fraňa Mojtu 18, Nitra

Registered office / Address: Fraňa Mojtu 18, 949 01 Nitra, Slovak Republic

Company ID (IČO): 57 766 606

Contact: office@vipinstitut.com

Legal framework: Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection (Slovak Republic)

1. Introductory provisions

The protection of your personal data is of the utmost importance to us. This Privacy Policy explains how Súkromná jazyková škola ViP inštitút Paulus collects, processes, protects and stores the personal data of data subjects in accordance with applicable legislation (the GDPR and Act No. 18/2018 Coll.).

2. Purposes of processing, legal bases and categories of personal data

The Controller processes personal data only for specified purposes and on the basis of applicable legal grounds.

A. Provision of educational services and performance of the contract

Purpose: Registration for a language course, assignment to a group, maintenance of student records, communication regarding tuition and the issuing of certificates.

Legal basis: Performance of a contract or taking steps prior to entering into a contract (Article 6(1)(b) GDPR).

Categories of data: First name, surname, academic titles, date of birth, personal identification number, residential address, nationality, citizenship, e-mail address, telephone number and language proficiency level. For minor participants, the identification and contact details of their legal guardians are also processed.

B. Compliance with accounting and tax obligations

Purpose: Issuing invoices, recording payments and maintaining accounting records in accordance with the legislation of the Slovak Republic.

Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR).

Categories of data: Billing details (first name, surname or company name, address, company identification number and tax identification number, bank account number and payment history).

C. Direct marketing and information about news and updates

Purpose: Informing existing and prospective clients about new courses, discounts and news from the Language School.

Legal basis: Consent of the data subject (Article 6(1)(a) GDPR) or the Controller’s legitimate interest in relation to existing clients (Article 6(1)(f) GDPR).

Categories of data: Name, e-mail address, photographs taken at educational events, audio recordings and video recordings.

D. Optional question after submitting an application

After you submit your application, we may ask you an optional question about how you heard about us. We store your answer together with your application and use it solely to compile an overview of the sources through which prospective students find us. When an application is anonymised, the text you provided is deleted.

3. Retention periods for personal data

Contractual data: For the duration of the contractual relationship and thereafter for as long as necessary to exercise rights and pursue claims arising from the contract.

Accounting documents: For a period of 10 years, in accordance with the Accounting Act.

Marketing data: Until consent is withdrawn or an objection to processing is lodged, subject to a maximum retention period of 5 years from the last interaction.

4. Recipients and processors of personal data

We do not disclose personal data to unauthorised third parties. Where necessary, personal data may be made available to the following categories of recipients:

Qualified teachers and lecturers engaged under contract by the Language School.

Providers of accounting and tax services.

Providers of IT services, web hosting, e-mail services and online learning platforms (e.g. MS Teams, Zoom and Hostinger).

Public authorities, where disclosure is required by applicable legislation.

5. Transfers of personal data to third countries

The Controller primarily stores and processes personal data within the European Economic Area (EEA). Where cloud-based or educational services are used (e.g. Google Workspace, Zoom and Microsoft), transfers of personal data are subject to the EU Standard Contractual Clauses and appropriate safeguards.

6. Rights of data subjects

Under the GDPR, data subjects have the following rights:

Right of access: To obtain confirmation as to whether their personal data are being processed and to request a copy of those data.

Right to rectification: To request the correction of inaccurate data or the completion of incomplete data.

Right to erasure (“right to be forgotten”): To request the erasure of personal data where they are no longer necessary for the specified purposes or where consent has been withdrawn.

Right to restriction of processing: To request the restriction of processing while the accuracy of the data or the lawfulness of processing is being verified.

Right to data portability: To receive personal data in a structured, commonly used format.

Right to object: To object to processing based on the Controller’s legitimate interests or to processing for direct marketing purposes.

Right to withdraw consent: To withdraw consent at any time and free of charge by sending an e-mail to office@vipinstitut.com.

Right to lodge a complaint: To lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, Bratislava, www.dataprotection.gov.sk).

7. Security of personal data

The Controller has implemented appropriate technical, organisational and personnel measures, including encryption, secure servers and access restrictions, to prevent unauthorised access to, loss of, damage to or misuse of personal data.

8. Final provisions

This Privacy Policy takes effect on the date of its publication. The Controller reserves the right to amend and update it in response to changes in legislation or in personal data processing operations.