Bookedu Privacy Policy

1. Personal data controller

1.1. The controller of personal data is — sp. z o.o., with its registered office in —, address: —, NIP (tax identification number): —, KRS (National Court Register number): —, hereinafter referred to as ‘Bookedu’, the ‘Controller’, ‘we’ or ‘us’.

1.2. For matters relating to the processing of personal data or the exercise of rights under the GDPR (RODO), you can contact us at: pomoc@bookedu.pl

1.3. The Controller has not appointed a Data Protection Officer. If a Data Protection Officer is appointed in the future, their contact details will be published in this Policy.

1.4. We process personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the ‘GDPR’ (RODO)) and the relevant provisions of Polish law.

2. Scope of the Policy

2.1. This Policy applies to data processed in connection with the use of the Bookedu platform, through which users may in particular:

• create a student or tutor account;
• publish and browse tutor profiles;
• search for tutors;
• book and organise lessons;
• manage their calendar and availability;
• communicate in connection with lessons;
• share educational materials, notes and assignments;
• post and read reviews;
• use features related to organising learning.

2.2. Some features of the service can be used without an account, in particular by browsing publicly available content and public tutor profiles.

3. Basic principles of data processing

3.1. We process only the data necessary to achieve specified purposes.

3.2. We do not sell users’ personal data.

3.3. We do not use users’ data for behavioural advertising or advertising profiling, unless in the future the user gives separate consent to this and this Policy is updated accordingly.

3.4. Payments for lessons are not currently made through Bookedu. Before payment features are launched, this Policy will be updated with regard to the payment operator, transaction data and settlements.

4. Sources of personal data

We may obtain personal data:

4.1. Directly from the user

In particular when:

• creating an account;
• completing a profile;
• publishing a listing;
• booking a lesson;
• exchanging correspondence;
• adding materials, notes or assignments;
• contacting technical support.

4.2. From other Bookedu users

Data may be shared in connection with organising a specific lesson, e.g. when a tutor sends materials to a student or a student sends an assignment or a message to a tutor.

4.3. From external login providers

If the user chooses to log in via Google or Meta/Facebook, we may receive data made available by that provider, within the scope accepted by the user.

4.4. Automatically when using the service

We may process technical data such as:

• IP address;
• date and time of connection;
• device type;
• browser type and version;
• information about technical errors;
• basic data on the use of the service.

5. Purposes, legal bases and periods of data processing

6. Obligation to provide data

Providing data is, as a rule, voluntary.

However, some data is necessary to use certain features.

Failure to provide data marked as required may prevent, for example:

• creating an account;
• publishing a tutor profile;
• making a booking;
• conducting a lesson;
• using a particular feature of the platform.

7. Public tutor profile

A tutor’s profile is publicly available to the extent resulting from the nature of a marketplace.

The following, among others, may be publicly available:

• first name and surname;
• photo;
• description;
• experience;
• subjects;
• rates;
• availability;
• ratings;
• reviews.

As a rule, student account data is not published as a public profile.

8. Recipients of data

Data may be transferred to entities that help us provide our services.

Depending on the features used, these may include in particular:

• Supabase — database, authentication and file storage;
• Vercel — hosting and application infrastructure;
• Resend — sending emails;
• SMSAPI — sending text messages (SMS);
• cyber_Folks — email and domain services;
• Google — authentication or features linked to a Google account;
• Meta Platforms — authentication via Facebook, if the user chooses this login method.

Providers performing services on our behalf may act as processors under appropriate agreements.

In some cases, a provider may act as an independent controller in accordance with its own privacy policy.

Data may also be disclosed to authorised public authorities where required by law.

9. Transfers of data outside the EEA

Some service providers may process personal data outside the European Economic Area.

In such cases, we apply the appropriate safeguards required by the GDPR (RODO), in particular:

• a European Commission adequacy decision;
• the EU-U.S. Data Privacy Framework, where applicable;
• standard contractual clauses approved by the European Commission;
• other mechanisms provided for by law.

10. Cookies and similar technologies

10.1. Bookedu uses cookies and similar mechanisms necessary for the service to function properly. They may be used, among other things, to:

• maintain the user’s session;
• keep logging in secure;
• remember certain settings;
• preserve context when moving between pages.

10.2. Bookedu does not currently use advertising or behavioural cookies.

10.3. If the analytics tool used does not store information that requires the user’s consent under the applicable law, it may be used without a marketing banner. If in the future we introduce analytics or marketing cookies that require consent, the user will be given a choice before they are activated.

10.4. Cookies can be deleted or blocked in your browser settings. However, restricting strictly necessary cookies may prevent you from using some Bookedu features.

11. Minors

11.1. Bookedu may be used by minors.

11.2. For users who do not have full legal capacity, the use of certain features of the platform may require action or consent by a parent or legal guardian in accordance with applicable law.

11.3. Where the processing of data of a person below the age required by law is based on their consent in relation to the offer of information society services, consent or authorisation by a parent or legal guardian may be required.

11.4. A parent or guardian who believes that a child’s data is being processed without an appropriate legal basis may contact us at: pomoc@bookedu.pl

12. Special categories of data

Bookedu does not require users to provide information concerning, among other things:

• health;
• racial or ethnic origin;
• political opinions;
• religious beliefs;
• sexual orientation;
• other special categories of data listed in Article 9 GDPR (RODO).

Please do not include such information in profiles, messages, materials or notes unless absolutely necessary.

13. Data security

We apply appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• loss;
• destruction;
• unauthorised alteration;
• disclosure;
• any other unlawful processing.

The measures applied may include in particular:

• HTTPS connection encryption;
• secure authentication mechanisms;
• access restrictions;
• permission control;
• infrastructure safeguards;
• private access to lesson materials;
• monitoring of errors and incidents.

For security reasons, we do not publish detailed information about the configuration of our safeguards.

14. Data retention period

We store data for no longer than necessary to achieve the purpose for which it was collected.

After you stop using the service, some data may be stored for longer if this is required:

• by law;
• by accounting or tax obligations;
• to pursue claims;
• to defend against claims;
• to demonstrate that our actions comply with the law.

Once the relevant periods have expired, the data is deleted, anonymised or permanently rendered incapable of being attributed to a specific person.

15. User rights

Under the terms set out in the GDPR (RODO), the user may have the right to:

• obtain information about the processing of data;
• access the data;
• obtain a copy of the data;
• rectify the data;
• erasure of the data;
• restriction of processing;
• data portability;
• object;
• withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, you can contact us at: pomoc@bookedu.pl

We may ask for information necessary to confirm the identity of the person making the request.

We respond to requests within the time limits laid down in the GDPR (RODO).

16. Right to lodge a complaint

If the user believes that their data is being processed unlawfully, they have the right to lodge a complaint with:

the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stawki 2
00-193 Warszawa
uodo.gov.pl

17. Automated decision-making and profiling

Bookedu does not currently make decisions concerning users that produce legal effects or similarly significantly affect them and that are based solely on automated processing of data.

If the way the platform operates changes in this respect, users will be informed and this Policy will be updated accordingly.

18. Payments

Bookedu does not currently handle payments for lessons through the platform.

Before introducing payment features, we will:

• name the payment operator;
• describe the scope of transaction data processed;
• set out the rules for sharing data with the operator;
• update this Policy and, where necessary, the Terms of Service.

Bookedu will not store full payment card details where they are processed directly by a certified payment operator.

19. Changes to the Privacy Policy

This Policy may be updated from time to time, in particular in the event of:

• a change in the scope of services;
• the launch of payments;
• the introduction of new integrations;
• a change of technology providers;
• a change in the law;
• a change in the way data is processed.

The current version of this Policy is published on the Bookedu website together with the date of the last update.

We may additionally notify users of changes that significantly affect their rights by email or by a notice on the service.

20. Contact

For matters relating to privacy and personal data, please contact us:

— sp. z o.o.
Address: —
NIP: —
KRS: —
Email: pomoc@bookedu.pl