Privacy Notice

Zunge Online LTD, with registered office at Lapathou 6, Strovolos, 2027 Nicosia, Cyprus, registration number HE 487889, ("we"), operates the website zunge.online (the "Website") and is the controller of personal data processed through the Website and our online services.

In this Privacy Notice, we explain what personal data ("your data") we collect, the purposes for which we use it, the legal bases for processing, the categories of recipients to whom data may be disclosed, and the rights you have under applicable data protection law when you visit our Website or use our online services.

Whenever you access our Website, even without registering, logging in or contacting us, our web server stores access data that your browser automatically transmits to our server. The data processed are the following:

1. IP address
2. Date and time of access
3. Website from which the request originated, if applicable (referring page)
4. Content accessed, including the particular page or subpage accessed
5. Access status and HTTP status code
6. Amount of data transferred
7. Browser software, language and version
8. Device used, operating system and user interface

We use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as a third-party service provider to host and display the Website. AWS EMEA SARL is established in Luxembourg. For hosting-related processing, AWS acts as our service provider/processor. Data may also be processed by affiliated companies of AWS, some of which may be located outside the European Economic Area. Where AWS transfers personal data outside the EEA to a country that is not subject to an adequacy decision, such transfers are subject to appropriate safeguards under Chapter V GDPR, including the AWS Data Processing Addendum and, where applicable, Standard Contractual Clauses approved by the European Commission.

We also use Cloudflare Turnstile on login, registration and contact forms to protect the Website against bots, spam, abuse and automated attacks. For this purpose, Cloudflare may process technical data such as your IP address, browser and device information, and challenge results. Cloudflare may process personal data in the United States and other countries. For transfers from the EEA to the United States, Cloudflare relies on applicable transfer mechanisms described in its privacy and data protection materials, including the EU-US Data Privacy Framework and, where required, Standard Contractual Clauses and supplementary measures. Further information is available in Cloudflare's Privacy Policy: https://www.cloudflare.com/privacypolicy/

The recipients of data processed in connection with visits to the Website may include our hosting provider, security and anti-abuse providers, IT service providers, and, where required by law or necessary for legal claims, competent authorities, courts or professional advisers.

We collect and process these data to safeguard our legitimate interests in ensuring the proper display, stability and security of the Website. The legal basis is Article 6(1)(f) GDPR. We delete these data within four weeks at the latest, unless longer retention is required to investigate security incidents or defend legal claims.

These data are automatically transmitted when you access the Website. Without this processing, we cannot display the Website securely and certain Website functions may not be available.

To use our online portal (learning management system), you must register with your email address. You may use a pseudonym instead of your real name, although the email address may still identify you. Registration is confirmed through a double opt-in process. If registration is not confirmed within 24 hours, the data are automatically erased from our active systems.

We process registration data and any optional information you provide, such as self-assessments, placement tests, course results, text answers, or information needed to tailor course content, for the performance of our contract with you. The legal basis is Article 6(1)(b) GDPR. Optional data are processed only to provide the specific services you request.

Where a premium or other paid version of the service includes teacher-reviewed pronunciation assessment, we may process sound files that you upload for the purpose of providing pronunciation feedback. Where Website-based text communication is available, we may also process the content of messages exchanged through the Website for course-related questions, pronunciation assessment, learning support, technical support, account support or other legitimate service-related purposes. The legal basis is performance of the contract under Article 6(1)(b) GDPR.

We do not use sound files for biometric identification, voice recognition or for uniquely identifying you. We process sound files only for educational assessment, pronunciation feedback and related support purposes, unless another lawful basis applies and is explained to you.

If you provide information about accessibility needs, this may constitute data concerning health or another sensitive category of data, depending on the information provided. We use this data only to provide the requested accessibility features. We process such data only on the basis of your explicit consent under Article 9(2)(a) GDPR, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

You should not include special categories of personal data, such as health data, religious beliefs, political opinions or other sensitive information, in text answers, Website messages or sound files unless this is necessary for your learning or support request. If you voluntarily provide such information, we will process it only where we have a valid legal basis under GDPR, such as your explicit consent, necessity for legal claims, or another applicable exception under Article 9 GDPR.

The recipients of data processed in connection with the online portal may include our authorised personnel, teachers or course administrators where necessary to provide the course, IT and hosting service providers, payment service providers where relevant, and, where required by law or necessary for legal claims, competent authorities, courts or professional advisers. Where pronunciation assessment or Website-based text communication is available, authorised teachers, course administrators and support personnel may access the relevant sound files, text submissions and messages only as necessary to provide assessment, feedback, learning support, technical support or account support.

After the relevant contract has been performed or your user account has been deleted, your data will be restricted from further active use and deleted after the expiry of mandatory retention periods, for example under tax, commercial, AML/CFT or sanctions-related laws, where applicable. If statutory retention obligations do not apply to individual data, such data will be deleted when it is no longer needed for the purposes for which it was collected. We may continue to process certain data where this is required by law, necessary for legal claims, or based on another lawful basis explained in this Privacy Notice.

Sound files uploaded for pronunciation assessment and Website-based text communications are retained for up to six months after the relevant assessment, feedback or communication has been completed, unless a longer retention period is required for legal claims, safeguarding, security, accounting, compliance or dispute-resolution purposes.

Your account data in connection with our learning platform will be automatically deleted after three years of non-use.

Our services may be used by minors as part of language learning. Where we offer information society services directly to a child and processing is based on consent, a child who is at least 14 years old may give consent under Cyprus data protection law. Where the child is under 14, consent must be given or authorised by a person with parental responsibility.

If we become aware that a user is under the applicable age and parental consent is required, we may request confirmation from a parent or guardian, restrict the account, or delete the relevant data where we cannot establish a valid legal basis for processing.

Where a minor uses features such as teacher-reviewed pronunciation assessment, sound-file upload or Website-based text communication, the parent or legal guardian is responsible for authorising and supervising the minor's use of those features where appropriate.

If we become aware of communications, sound files or other submissions that may create a safeguarding risk, harm a minor, exploit a minor, or involve unlawful content or communications, we may restrict access, suspend or close the relevant account, preserve relevant information where necessary, and report the matter to competent authorities or other appropriate organisations where required or appropriate.

Parents or guardians may contact us using the contact details in this Privacy Notice.

To process your payments, we transmit the necessary payment data, such as name, email address, billing address, order number, payment amount, payment status, transaction identifiers, fraud-prevention data and payment details, to the payment service provider you select during checkout. The legal basis is performance of the contract under Article 6(1)(b) GDPR.

The selected payment service provider also processes personal data under its own privacy notice. The payment service provider may process certain data as an independent controller, for example for payment execution, fraud prevention, compliance, anti-money laundering, sanctions screening, dispute handling and regulatory obligations. Depending on the payment functionality used, the payment service provider may also process certain data as our service provider/processor.

Payment data entered in the checkout form are transmitted directly to the selected payment provider. We do not store your full payment details, such as full credit card numbers, on our systems.

Our current payment service provider is Stripe. Stripe's relevant European entity is established in the European Union. Stripe may process data through affiliated companies or service providers outside the European Economic Area, including in the United States. Where such transfers occur, Stripe relies on applicable transfer mechanisms, including the EU-US Data Privacy Framework where applicable and, where required, Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

The recipients of data processed in connection with payments may include our payment service provider, banks or card schemes involved in the transaction, fraud-prevention and compliance service providers, and, where required by law or necessary for legal claims, competent authorities, courts or professional advisers.

Further information can be found in the payment service provider's privacy notice: https://stripe.com/en-lv/privacy

We use the information in your user account to adapt our Website and services to your interests, for example by displaying a personal homepage and course recommendations. The legal basis is our legitimate interest in promoting and improving our services under Article 6(1)(f) GDPR. You may object to this processing at any time by contacting us at support@zunge.online.

Where personalised content relies on cookies or similar technologies, we process your data only on the basis of your consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time through our cookie banner, through the Privacy Settings link: Open privacy settings, or by changing your browser settings, without affecting the lawfulness of processing carried out before withdrawal.

We do not send electronic direct marketing communications, such as marketing emails or messages, unless we have a lawful basis to do so under applicable electronic communications rules, including consent where required.

The recipients of data processed for personalised marketing may include our authorised personnel, IT service providers, and analytics or cookie technology providers where you have consented to the relevant technologies.

We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you.

We use cookies and similar technologies, such as localStorage and, where applicable, embedded content technologies, to operate our Website, improve its functionality, and analyse usage. Essential cookies and similar technologies are used without consent where they are strictly necessary to provide the service requested by you or to transmit communications over the network.

When you first visit our Website, a cookie banner allows you to accept or reject non-essential cookies. You can change your cookie settings at any time through the Privacy Settings link: Open privacy settings, without affecting the lawfulness of processing carried out before withdrawal.

The retention periods for cookies and similar technologies depend on the specific technology used. Strictly necessary security cookies are generally stored only for the session or for a short period needed for the relevant security process, for example approximately 15 minutes for temporary Google sign-in correlation cookies. Cookie consent choices stored in localStorage remain until you clear them or change your settings. Authentication/session entries stored in browser localStorage may remain on your device until logout or until you clear browser storage, while account data stored in our systems are retained as described in section 3 of this Privacy Notice. Google Analytics cookies, where you have consented to analytics, may be stored for periods such as 2 years, 24 hours or 1 minute depending on the specific analytics cookie. Cloudflare Turnstile security cookies may be stored for periods such as 30 minutes or, in the case of certain challenge clearance cookies, up to 1 year.

The recipients of data processed through cookies and similar technologies may include our hosting and IT service providers, security providers, analytics providers where you have consented to analytics, and providers of embedded content where you have consented to or activated such content.

Detailed information on the specific cookies and technologies we use, including their providers, purposes and storage periods, is available in our Cookie Policy: https://www.zunge.online/cookies

We maintain pages on TikTok, YouTube and Instagram (collectively, "Social Media Pages"). These Social Media Pages are located on platforms operated by third parties (collectively, "Social Media Operators"). The relevant Social Media Operator is primarily responsible for processing personal data on its platform and for fulfilling data protection rights in relation to platform-level processing.

When you visit or interact with our Social Media Pages, the relevant Social Media Operator processes your personal data under its own privacy notice. We process only the personal data that you make available to us through your interaction with our Social Media Pages, such as your username, profile picture, comments, likes, follows, messages or other interaction content.

For certain analytics or insights functions provided by Social Media Operators, such as aggregated statistics about visits and interactions with our Social Media Pages, we and the relevant Social Media Operator may act as joint controllers within the meaning of Article 26 GDPR. The relevant Social Media Operator usually provides the main platform-level information and mechanisms for exercising data subject rights, but you may also contact us and we will forward your request where appropriate.

We process this data to respond to your enquiries, manage our Social Media Pages, provide customer support, and improve our services. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. You may object to this processing at any time for reasons relating to your particular situation.

If you have questions about our specific services, for example courses or events, we may propose that you communicate with us outside the Social Media Pages, for example by email or Telegram.

Our Website may include embedded YouTube videos. Where embedded YouTube content is not strictly necessary for a Website function requested by you, it will be loaded only after you have given consent or actively chosen to display the relevant embedded content. The legal basis for loading non-essential embedded YouTube content is your consent under Article 6(1)(a) GDPR, together with applicable cookie and electronic communications rules. Upon activation, your browser may establish a direct connection to Google's servers, and Google may collect technical data such as your IP address, browser type, device information and information about the accessed content. Google processes such data under its own privacy notice.

Our Website may also contain ordinary links to our TikTok and Instagram profiles. These links do not by themselves set cookies or similar technologies on our Website. If you click such a link, you leave our Website and the relevant Social Media Operator may process your data under its own privacy notice.

The recipients of data processed in connection with our Social Media Pages or embedded YouTube content may include the relevant Social Media Operator, providers of embedded content technologies, our authorised personnel, IT service providers, and, where required by law or necessary for legal claims, competent authorities, courts or professional advisers.

Our Social Media Pages and this Privacy Notice may contain links to websites operated by other providers. We are not responsible for the data processing on those websites. Please consult the privacy notices of the relevant providers to find out how they process personal data.

We process profile information and interaction content for as long as necessary to respond to your enquiry or manage the relevant interaction, unless longer retention is required for legal claims or compliance purposes. If we store your contact details and information about your interactions on our Social Media Pages with your consent, we will delete such data when you withdraw your consent, unless another lawful basis applies.

Information about the Social Media Operators and their privacy notices can be found here:

• Within the European Economic Area (EEA), TikTok is a service offered by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. If you are resident in the United Kingdom, you may have a contract with TikTok Information Technologies UK Limited, 4 Lindsey Street, Barbican, London, EC1A 9HP, United Kingdom. You can find the TikTok privacy notice at: https://www.tiktok.com/legal/page/eea/privacy-policy/en
• Within the European Economic Area (EEA), YouTube is a service offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You can find Google's privacy notice, which applies to YouTube, at: https://policies.google.com/privacy
• Within the European Economic Area (EEA), Instagram is a service offered by Meta Platforms Ireland Limited, 2/4 Grand Canal Quay, D02 R890 Dublin, Ireland. You can find Meta's privacy notice, which applies to Instagram, at: https://www.facebook.com/privacy/policy

We offer Telegram as an optional communication channel for responding to user enquiries. The communication takes place via Telegram following a direct contact request from the user.

If you contact us via Telegram, we process the personal data you provide in your message and data visible through your Telegram profile, such as username and profile photo.

Telegram is provided by Telegram Messenger Inc. Telegram may process personal data on servers outside the EEA. We cannot influence Telegram's independent processing. Telegram has appointed European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium, as its representative in the EEA. You can find the Telegram privacy notice at: https://telegram.org/privacy/eu

We use Telegram on the basis of our legitimate interest in providing an additional, fast communication channel under Article 6(1)(f) GDPR. You are free to use alternative contact methods, such as email, if you prefer not to use Telegram. If you do not wish Telegram to process your data, please use email or another contact method offered by us.

The recipients of data processed in connection with Telegram communications may include Telegram, our authorised personnel, IT service providers, and, where required by law or necessary for legal claims, competent authorities, courts or professional advisers.

We will delete personal data collected via Telegram within four months after the enquiry has been resolved, unless longer retention is required for legal claims or compliance purposes.

We apply appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Our security measures are continuously reviewed and adapted in line with technological developments and organisational needs. These measures may include encryption in transit, access controls, restricted user permissions, backups, monitoring and other measures appropriate to the risks of the relevant processing. While no internet-based system can be guaranteed to be completely secure, we take appropriate measures to reduce the risk of unauthorised access, disclosure, alteration or loss.

You are responsible for keeping your login credentials confidential and for choosing a strong password. Please note that standard email communications are typically not end-to-end encrypted and should not be considered fully secure.

As a data subject, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access (Article 15): to receive information about the personal data we process about you.
• Right to rectification (Article 16): to correct inaccurate or incomplete data.
• Right to erasure (Article 17): to request deletion of your data, except where processing is required by law or for legal claims.
• Right to restriction (Article 18): to request limited processing in certain cases, for example if accuracy is contested.
• Right to data portability (Article 20): to receive your data in a structured, commonly used and machine-readable format and transmit it to another controller.
• Right to object (Article 21): to object at any time to processing of your data based on our legitimate interests, including profiling, or to direct marketing.
• Right to lodge a complaint (Article 77): to complain to a supervisory authority. You can usually contact the authority in your habitual residence, place of work, or where the alleged infringement occurred. Our lead authority is the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).

If we process your personal data on the basis of our legitimate interests, you have the right to object to such processing at any time for reasons relating to your particular situation.

If you object, we will stop processing your data for these purposes unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

Where we process your personal data for direct marketing, you may object at any time without giving reasons. Once you object, we will stop using your data for direct marketing immediately.

You may also withdraw any consent you have given us at any time through the Privacy Settings link: Open privacy settings, or by contacting us using the contact details below, without affecting the lawfulness of processing carried out before withdrawal.

We may ask you to provide information necessary to confirm your identity before responding to a request. We will respond to your request within the timeframe required by GDPR.

Requests concerning access, deletion or restriction of Website messages or uploaded sound files may be subject to verification of identity and may be limited where retention is necessary for legal claims, safeguarding, security or compliance purposes.

To exercise your rights, or if you have questions about how we process your data, please contact us at: support@zunge.online or Lapathou 6, Strovolos, 2027 Nicosia, Cyprus.