The Seller is the administrator of personal data.

Seller:
Name: VALENTINA SOLDATENKO
Company ID: 08230641
Registered office: Rokosovského 144/7, Dubí, 417 02, Czech Republic
Contact email: valentinasoldatenko@seznam.cz

2.1. Personal data is processed in accordance with the GDPR, in particular on the basis of:
2.1.1. Performance of a contract (Article 6(1)(b)
2.1.2. Compliance with legal obligations (Art. 6(1) - c)

2.1.3. Legitimate interest (Article 6(1) - f)

3.1. Identification data
3.2. Contact details
3.3. Billing details
3.4. Technical data related to access to the course

Personal data is stored for the duration of the contractual relationship and further for the period specified by law.

5.1. In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the data subject has, in particular, the following rights:
5.1.1. Right of access under Article 15 GDPR, i.e., the right to obtain confirmation as to whether their personal data are being processed, and, if so, to access such data and receive information on the manner of processing;
5.1.2. Right to rectification under Article 16 GDPR, where personal data are inaccurate, incomplete, or outdated;
5.1.3. Right to erasure (“right to be forgotten”) under Article 17 GDPR, in particular where: personal data are no longer necessary for the purposes for which they were processed; the data subject withdraws consent and there is no other legal basis for processing; the data subject objects to the processing; or personal data have been unlawfully processed;
5.1.4. Right to restriction of processing under Article 18 GDPR, where: the data subject contests the accuracy of personal data; the processing is unlawful but the data subject opposes erasure; the controller no longer needs the personal data but the data subject requires them for the establishment, exercise, or defense of legal claims;
5.1.5. Right to data portability under Article 20 GDPR, where processing is based on the data subject’s consent or on a contract and is carried out by automated means;
5.1.6. Right to object to the processing of personal data under Article 21 GDPR, where processing is based on the legitimate interests of the controller;
5.1.7. Right to lodge a complaint with a supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), if the data subject considers that the processing of their personal data constitutes a violation of GDPR.

6.1. The Controller declares that it has implemented and continuously maintains appropriate technical and organizational measures in accordance with Article 32 GDPR, taking into account the nature, scope, context, and purposes of personal data processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons.

6.2. The measures adopted include, in particular: secure access to information systems; protection of access credentials and passwords; use of secure third-party payment and hosting services; and restricting access to personal data only to persons who necessarily require it to perform their work or contractual obligations.

6.3. The Controller shall not be liable for any breach of personal data security in cases where the data leakage occurs as a result of:
6.3.1. Force majeure (e.g., a cyberattack that could not have been reasonably anticipated or prevented despite all reasonable efforts),
6.3.2. Actions of third parties, in particular providers of payment gateways, hosting services, cloud storage, or online educational platforms,
6.3.3. Unauthorized actions by the data subject (e.g., sharing login credentials with third parties),
6.3.4. Technical malfunctions beyond the Controller’s control.

6.4. The data subject acknowledges that no data transmission over the Internet or electronic storage is completely secure and that, despite all measures taken, the risk of unauthorized access to personal data cannot be entirely excluded.

7.1. The Controller is entitled to process personal data to the extent necessary for the performance of a contract, compliance with legal obligations, and the protection of its legitimate interests pursuant to Article 6(1)(f) GDPR.

7.2. The Controller’s legitimate interests include, in particular:
7.2.1. the protection of its legal claims,
7.2.2. ensuring the security and integrity of digital content,
7.2.3. preventing misuse of online courses and unauthorized access to them,
7.2.4. maintaining internal records and statistics for the purpose of improving services.

7.3. The Controller is entitled to restrict, refuse, or postpone the fulfillment of a data subject’s request if necessary to protect its rights and legitimate interests, in particular in cases provided for by GDPR or other applicable laws.

7.4. The Controller reserves the right to retain personal data for as long as necessary to protect its legal claims, even after the termination of a contractual relationship, if required by law or to safeguard the Controller’s legitimate interests.

These principles are valid and effective from February 3, 2026.