This notice explains which personal data we collect when you use this website, book and pay for lessons, or write to us, why we use it and what your rights are. We process personal data under the EU General Data Protection Regulation (GDPR) and Italian data protection law. It should be read together with our Cookie Policy.
Who is responsible for your data
Data controller: Bukata Nataliia (VAT IT06175540878), who runs The Super Talker ("we", "us").
Email: supertalker1@gmail.com
What data we collect
- Account — your name, email address and time zone. If you register with email and password, the password is handled by our login provider (Google Firebase) and we never see it. If you sign in with Google, we receive your name and email address from Google.
- Lessons — the lessons you buy and how many you have left, the lessons you book (date, time, type and language) and any cancellations.
- Payments — what you bought, the amount, the date and the payment status. Card details are entered on Stripe's page and go directly to Stripe: we never receive or store your card number. We also record when you accept the Terms of sale and which version.
- Withdrawals — if you withdraw from a purchase: your name, email address, the contract details you give us, and the date and time.
- Messages — when you use the contact form or request the free guide: your name, email address, the language you are interested in and your message.
- Technical data — your IP address, used for a short time to protect the contact and withdrawal forms from abuse, and the standard server logs of our hosting provider.
We do not use analytics, advertising or tracking tools, and we do not build profiles of visitors.
Why we use it and on what legal basis
- To provide the lessons you ask for — managing your account, your lessons and bookings, sending booking confirmations and the link to join each lesson. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- To take payments and keep accounting recordsLegal basis: performance of a contract and compliance with tax and accounting obligations (Art. 6(1)(b) and (c) GDPR).
- To handle withdrawals and refunds — receiving your statement, acknowledging it and refunding you. Legal basis: compliance with consumer law and performance of a contract (Art. 6(1)(c) and (b) GDPR).
- To answer your messages — replying by email to questions sent through the contact form, and sending the free guide you request. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR).
- To keep the website secure — preventing spam, abuse and fraud. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
We do not send newsletters or marketing emails. Providing your name and email address is necessary to create an account, book lessons or receive a reply; without them we cannot provide these services.
Transfers outside the EU
Some providers above belong to groups based in the United States, so data may be accessed from outside the European Economic Area. In that case the transfer relies on the EU–US Data Privacy Framework, where the provider is certified, or on the European Commission's Standard Contractual Clauses.
How long we keep it
- Account and lessons — while your account exists. You can ask us to delete it at any time.
- Payments and related bookings — 10 years, as required by Italian accounting and tax law, even if you delete your account.
- Consents to the Terms of sale and withdrawals — 10 years, together with the payment records they relate to.
- Contact messages — up to 24 months after our last exchange, unless they lead to lessons.
- Technical data — IP addresses used to protect the contact and withdrawal forms live only in the server's temporary memory and are never saved; hosting logs are kept for the short period set by Vercel.
Your rights
You can ask to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Write to supertalker1@gmail.com; we reply within one month and may ask you to confirm your identity.
You also have the right to lodge a complaint with the Italian data protection authority, Garante per la protezione dei dati personali, or with the authority of the EU country where you live.
Children
Accounts are for people aged 14 and over. Lessons for younger learners are booked by a parent or guardian from their own account.
Security
Data travels over encrypted connections (HTTPS). Database access rules let each student see only their own lessons, and payments are handled entirely by Stripe. No system is completely secure, but we take care to limit who can access your data.
Automated decisions
We make no automated decisions with legal or similar effects on you. The only automatic rule is the cancellation policy: a lesson cancelled at least 24 hours in advance goes back to your account.
Changes to this notice
If we change how we use your data, we will update this page and the date at the top, and tell registered students by email about significant changes.