Privacy Policy

Data Controller

The controller of personal data processed through the website and in connection with our educational services is:

For matters relating to personal data protection, please contact:

Whose data we process and what data we use

The scope depends on your relationship with Conversa Language Centre and the purpose of the interaction.

• Website and contact-form users: name, email address, telephone number, company name where relevant, message content and other information voluntarily provided in correspondence.
• Clients, parents and guardians, and adult learners: identification and contact details, data required to enter into and perform an agreement, organise a course and handle payments.
• Minor learners: name, age or educational-stage information required to organise learning, course and schedule information, attendance and progress information and — during online lessons — voice and image transmitted in real time through Microsoft Teams.
• Website technical and statistical data: limited information described in the Website analytics section below.

Please do not provide information that is not necessary to handle your matter or provide the service.

Purposes and legal bases

• Handling enquiries and pre-contract communication — Article 6(1)(b) GDPR and, where relevant, Article 6(1)(f) GDPR.
• Entering into and performing agreements and organising educational services — Article 6(1)(b) GDPR; in B2B relationships also Article 6(1)(f) GDPR where necessary to organise training.
• Accounting, tax and other legal duties — Article 6(1)(c) GDPR.
• Establishing, pursuing or defending claims and ensuring organisational and IT security — Article 6(1)(f) GDPR.
• Compliance with statutory child-safeguarding duties and verification of persons permitted to work with minors — Article 6(1)(c) GDPR in connection with applicable law.
• First-party website statistics — Article 6(1)(f) GDPR, as described below.

Children and young people

Conversa Language Centre also provides educational services to minors. We obtain minors’ data primarily from parents or legal guardians and, to the extent necessary, directly from the learner while lessons are being provided.

During Microsoft Teams lessons, image and voice may be transmitted in real time to the extent required for the lesson. Conversa Language Centre does not use a minor’s image or voice for promotional or marketing purposes without a separate and explicit legal basis, in particular any consent that may be required.

Lessons are not recorded by Conversa Language Centre as a standard practice. Any recording would require a separate decision, appropriate legal basis and prior information to the persons concerned.

Safety rules for children and young people are also described in our Child Safeguarding Standards and the short version for young people.

Online lessons and Microsoft 365

We use Microsoft 365 services, including Microsoft Teams, for online lessons, communication and organisational support. Depending on how a participant joins a meeting, identification data, technical data and real-time audio/video may be processed.

We limit the scope of data to what is necessary to provide lessons, communicate and ensure service security.

Website analytics

We operate our own limited website statistics to understand how the website works, which parts of the offer are of interest and how effective our promotional activities are.

The statistics are created within our own server infrastructure. We do not use Google Analytics, Meta Pixel or other external advertising or analytics platforms for this purpose.

We use simple statistics to understand which parts of the website are visited most often, which parts of our offer attract interest and whether the website is clear and easy to use. We may count, for example, page views, the source of a visit, campaign parameters (UTM), basic information about the device and browser, the language version of the website, clicks on buttons or links leading to contact or offer pages, the start of completing the contact form and how far visitors scroll down a page. Based on the time of these events, we may also create general summaries by hour and day of the week.

We do not store users’ IP addresses or location information. We also do not collect the content entered into the contact form for analytics purposes or data that would allow us to identify a specific person. We do not create user profiles or track people between separate visits to the website.

The statistics are aggregated and are used only to evaluate how the website performs, interest in our offer and the effectiveness of our promotional activities.

The legal basis is Article 6(1)(f) GDPR — our legitimate interest in evaluating and improving our own website and the effectiveness of presenting our offer and promotional activities.

Raw analytics data is retained for no longer than 90 days. Aggregated statistics that are not used to identify a specific person may be retained for longer.

How long we retain data

• Enquiries that do not lead to cooperation: generally 12 months after the contact ends.
• Operational course data: for the duration of the course, then deleted or archived depending on the continuing need.
• Organisational documentation and lesson history: up to 5 years after cooperation ends where still required to document services, settle accounts or protect against claims.
• Detailed educational information, progress and teaching notes: generally up to 2 years after a course ends, unless there is a justified need for longer retention.
• Accounting data: for the period required by applicable tax and accounting law.
• Claims-related data: until the relevant limitation period expires.
• Raw website analytics: a maximum of 90 days.

Who may receive the data

Data may be disclosed or entrusted only to the extent necessary for a specific purpose, including:

• OVHcloud — hosting provider for the website, application and database,
• Microsoft — provider of Microsoft 365 and Microsoft Teams,
• during the transition period, Google services used for email handling,
• our accounting provider / entities handling financial settlements, where necessary,
• authorised teachers and collaborators, only to the extent required to organise and provide lessons,
• technical, legal or IT service providers where necessary and lawful,
• competent public authorities where disclosure is required by law.

Transfers outside the European Economic Area

Because we use global technology providers, in particular Microsoft and, during the transition period, Google services, data may in some circumstances be processed with the involvement of entities or infrastructure outside the EEA.

Where such a transfer takes place, mechanisms provided for under the GDPR are used as appropriate to the specific transfer and provider.

Your rights

Subject to the conditions set out in the GDPR, you may have the right to:

• access your data,
• rectify your data,
• erase your data,
• restrict processing,
• data portability,
• object to processing based on the controller’s legitimate interest,
• withdraw consent where consent is the legal basis.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact . You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

Is providing data mandatory?

Providing data through the contact form is voluntary, but without contact details we may be unable to respond. Information necessary to enter into and perform an agreement or comply with legal duties must be provided to the extent required for the relevant purpose.

Cookies and browser local storage

The website may use technical solutions necessary for its proper operation.

We use browser localStorage only to remember a functional language preference so that the website can retain the user’s PL/EN choice. This information is not used for analytics, advertising or profiling.

Our first-party website statistics do not use analytics cookies, localStorage or sessionStorage and do not create a persistent visitor identifier. We do not use Google Analytics or Meta Pixel.

If we introduce technologies that require consent in the future, users will be able to make a choice before such technologies are activated.

Profiling and automated decision-making

Conversa Language Centre does not use personal data for automated decision-making producing legal effects for users or for advertising profiling.

Data security

We use appropriate organisational and technical measures, including encrypted connections, access controls, data minimisation, backups and confidentiality rules. Access to personal data is limited to persons who need it to perform their duties.

Child Safeguarding Standards

Because Conversa Language Centre provides educational activities for children and young people, we maintain Child Safeguarding Standards covering safe relationships, responses to concerns, incident reporting and support for minors.

Full Child Safeguarding Standards
Short version for young people

Changes to this Privacy Policy

This Policy may be updated, in particular when the website, our services, providers or applicable law change. The current version will always be available on the official Conversa Language Centre website.