Personal data protection (GDPR)

This document describes what personal data we process, for what purpose, for how long, and what rights you have as a data subject. All in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 110/2019 Coll.

1. What data we process and why

Data	Purpose of processing	Legal basis	Retention period
Email, name	Creating and managing the user account, delivering content, communication	Performance of a contract (Art. 6(1)(b) GDPR)	For the lifetime of the account + 3 years from the last sign-in
Password (hash)	Account security	Performance of a contract	Same as the account
IP address, browser, sign-in time	Security (rate limiting, audit), abuse prevention	Legitimate interest (Art. 6(1)(f) GDPR)	12 months
Purchase history, invoices	Meeting statutory tax and accounting obligations	Legal obligation (Art. 6(1)(c) GDPR)	10 years under Act No. 235/2004 Coll. on VAT and Act No. 563/1991 Coll. on Accounting
Payment data (last 4 digits of the card, card type)	Proof of payment, customer service	Legal obligation	10 years
Study progress (lessons viewed, courses completed)	Platform functionality, certificates	Performance of a contract	Same as the account
Uploaded materials (files, transcripts of photos), answers in the study mode, chat messages	Providing the study mode: transcription and processing of materials, questions, evaluation of answers, chat	Performance of a contract	Until deleted by the user or the account is cancelled; deleted files stay in the trash for 30 days
Assessment of the suitability of uploaded material (category only, e.g. "fine")	Enforcing the rules for uploaded content, preventing misuse of the service	Legitimate interest	Same as the material
Contact details of a tutor or school entered by a user in "Recommend us" (name, email, message)	Approaching them with an offer of cooperation on the user's recommendation, at most three emails with an option to decline	Legitimate interest	12 months; if cooperation is agreed, for the duration of the cooperation
Credit and its use (balance, history of deductions)	Billing of AI Services	Performance of a contract	Same as the account
Marketing data (with your consent)	Sending the newsletter and offers	Consent (Art. 6(1)(a) GDPR)	Until consent is withdrawn

2. Who we pass data to

We do not pass your personal data to anyone except the following processorswho help us provide the service:

Processor	Purpose	Country
Stripe Payments Europe, Ltd.	Card payment processing	Ireland (EU)
Contabo GmbH	Server and database hosting	Germany (EU)
Anthropic Ireland, Limited	Artificial intelligence: transcription of photos, processing of materials, questions, evaluation of answers, chat, assessment of content suitability. Under its terms, it does not use API data to train models.	Ireland (EU); processing may take place in the USA — Standard Contractual Clauses
Impossible Cloud GmbH	Storage of uploaded files	EU
Google LLC (Gmail)	Sending transactional emails	USA — Standard contractual clauses
Google LLC (optional, trainers only)	Google Fonts (loading fonts from fonts.googleapis.com)	USA — Standard contractual clauses
YouTube / Vimeo (at the trainer's choice)	Hosting lesson videos	USA — Standard contractual clauses

We do not sell your data to third parties for advertising purposes.

2a. Automatic assessment of uploaded materials

Before processing, uploaded materials are automatically assessed by artificial intelligence according to the rules in the Terms (Art. 12). Clearly inappropriate material is not processed. This is not a decision about you within the meaning of Art. 22 GDPR: the material is assessed, not you. The controller sees only the resulting category, not the content. You can request a human review by email.

3. Your rights

In connection with the processing of your personal data you have the following rights:

• The right of access — you can request a copy of the data we hold about you
• The right to rectification — if the data is incorrect or incomplete
• The right to erasure (“the right to be forgotten”) — except for data we must retain by law (invoices for 10 years)
• The right to restriction of processing
• The right to portability — you can obtain your data in a machine-readable format
• The right to object — to processing based on legitimate interest
• The right to withdraw consent — at any time, e.g. by unsubscribing from the newsletter
• The right to lodge a complaint with the Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7)

4. Cookies and similar technologies

The Platform uses only necessary cookies for correct functioning (sign-in, basket). These do not require your consent.

• eduplace_session — stores your sign-in (HttpOnly, Secure, SameSite=Lax, lifetime 30 days)

We do not use third-party analytics or advertising cookies. If we were to allow them in the future, we would ask for your consent.

5. Security

We protect your data with the following measures:

• HTTPS encryption of all communication (TLS 1.2+)
• Passwords are stored as a hash (bcrypt)
• Regular server and application updates
• Database backups in encrypted storage in the EU
• Only the operator and the server administrator appointed by the operator have access to the data

6. Children

Minors may also use the Platform. We process the data needed for the account and studying on the basis of performance of a contract. A child under 15 may give consent to receiving news only with the consent of their legal guardian (Section 7 of Act No. 110/2019 Coll.), so we offer it only to those who confirm they are at least 15 years old. If we find that someone younger gave consent without the consent of their legal guardian, we will withdraw the consent.

7. Changes to this document

We reserve the right to change this document. We will inform you of substantial changes by email or by a notice on the Platform.

This document is valid from 12 November 2026 (previous version from 23 May 2026).
Martin Šabata, personal data controller.