PRIVACY POLICY

Last updated: 05.09.2026

1. Data Controller

The data controller is:

Anna Sasorska ASTutorly

Genewska 7A/2

03-963 Warsaw, Poland

NIP: 1133207835

REGON: 545288890

E-mail: office@astutorly.pl

This Privacy Policy applies to the processing of personal data in connection with the use of the ASTutorly website, available at https://astutorly.pl, as well as contact with the Data Controller via the contact form and email, and in connection with establishing and carrying out cooperation, including the organisation and provision of tutoring services. Personal data is processed in accordance with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”).

2. What data do we collect?

We may process:

• the parent’s first and last name;

• telephone number;

• address necessary for issuing an invoice;

• e-mail address;

• information related to the provision of tutoring services;

• the student’s data, in particular their first name and, where necessary for the organisation and provision of tutoring services, their e-mail address or telephone number;

• data necessary for accounting and tax documentation.

The scope of the student’s data processed is limited to data necessary for the organisation and provision of tutoring services. Student contact details, such as an e-mail address or telephone number, are processed only when necessary for direct contact concerning lessons, providing materials, or organising lessons. If the student’s data is provided to the Data Controller by a parent or legal guardian, the parent or legal guardian is the source of such data. Providing contact details, in particular an e-mail address, may be necessary to respond to a message or process an enquiry. Where issuing an invoice requires certain information, providing such information is necessary to issue the invoice correctly and fulfil tax and accounting obligations. Please do not provide health information or other special categories of personal data referred to in Article 9 GDPR through the contact form, unless providing such information is necessary and is based on an appropriate legal basis.

3. How do we use personal data?

We use personal data for the following purposes:

• responding to messages or enquiries;

• contacting the customer regarding tutoring services;

• determining details concerning the organisation and provision of tutoring services;

• taking steps at the request of the data subject prior to entering into a contract;

• entering into and performing a contract;

• organising and properly providing tutoring services;

• contacting a parent, legal guardian or student regarding matters related to tutoring services;

• issuing invoices and maintaining accounting and tax records;

• complying with legal obligations applicable to the Data Controller;

• establishing, exercising or defending legal claims;

• ensuring the security and proper functioning of the website.

We do not operate a newsletter or conduct e-mail marketing.

4. Legal basis for processing personal data

We process personal data on the following legal bases:

• Article 6(1)(b) GDPR – where processing is necessary for taking steps prior to entering into a contract and for entering into and performing a contract for tutoring services with a parent or legal guardian;

• Article 6(1)(c) GDPR – where processing is necessary for compliance with legal obligations applicable to the Data Controller, in particular tax and accounting obligations and obligations relating to issuing and retaining accounting documents;

• Article 6(1)(f) GDPR – where processing is necessary for the purposes of the legitimate interests pursued by the Data Controller, in particular ensuring website security, conducting ongoing business-related communication, and establishing, exercising or defending legal claims;

• Article 6(1)(a) GDPR – where processing is based on consent, in particular in relation to non-essential cookies and similar technologies where prior consent is required.

Where a student is not a party to the contract, the student’s data is processed to the extent necessary for organising and providing tutoring services, on the appropriate legal basis applicable to the particular processing activity.

5. Contact form and e-mail

The contact form is used to contact ASTutorly, in particular regarding the tutoring services offered. We use Squarespace to operate the website and provide the contact form. Messages submitted through the contact form are forwarded to the Data Controller’s business e-mail address provided through home.pl. The contact form is protected by Google reCAPTCHA, a service used to protect the form against automated submissions and spam. In connection with the use of reCAPTCHA, information related to the use of the contact form may be processed by Google in accordance with Google’s privacy policy. Data submitted through the contact form may be processed by Squarespace to the extent necessary to provide the form service and by home.pl to the extent necessary to deliver and manage electronic correspondence.

6. Cookies

The ASTutorly website uses cookies and similar technologies. Depending on their function, the following categories of cookies may be used:

• necessary cookies – cookies necessary for the proper functioning of the website and its basic features;

• performance and analytics cookies – cookies used to analyse website usage, generate statistics and improve website performance;

• advertising cookies – cookies used for advertising purposes and to measure advertising effectiveness, where such technologies are used on the website.

Non-essential cookies are restricted in accordance with the website’s privacy settings and applicable consent requirements. Where user consent is required, analytics or advertising cookies are activated only after consent has been given. Users can manage their cookie preferences using the consent management tools available on the website and may change their preferences at a later time.

7. Who may receive personal data?

We do not sell personal data. Personal data may be processed by service providers we use, in particular:

• Squarespace – website and contact form provider;

• home.pl – provider of domain and e-mail services;

• Google – provider of Google reCAPTCHA used to protect the contact form;

• other entities providing technical, IT, accounting or legal services to the Data Controller where necessary for conducting business activities.

Service providers process personal data to the extent necessary to provide their services and in accordance with applicable data protection laws. We do not provide personal data to other entities for their own marketing purposes.

8. Transfers of personal data outside the EEA

In connection with the use of technology service providers, in particular Squarespace and Google, personal data may in certain circumstances be transferred to or processed outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, the Data Controller ensures that such transfers comply with GDPR requirements and are subject to appropriate safeguards required by applicable law, including, where applicable, an adequacy decision of the European Commission, Standard Contractual Clauses or other legally permitted transfer mechanisms. Detailed information regarding the processing of personal data by individual service providers, including their rules concerning international data transfers, is available in their privacy policies and data protection documentation.

9. How long do we retain personal data?

Personal data relating to enquiries is retained for the period necessary to respond to the enquiry, maintain correspondence and handle the enquiry, and thereafter for the period necessary to protect against potential legal claims. If a contract for tutoring services is entered into, personal data is retained for the duration of the contract and thereafter for the period necessary to comply with legal obligations and to establish, exercise or defend legal claims. Student data is retained for the period necessary to organise and provide tutoring services and, after the cooperation has ended, for the period necessary to protect against potential legal claims, taking into account any applicable legal obligations. Data contained in accounting documentation, including data necessary for issuing and retaining invoices, is retained for the period required under applicable tax and accounting laws. After the applicable retention periods have expired, personal data is deleted or anonymised unless applicable law requires further retention.

10. Your rights

In connection with the processing of personal data, and subject to the conditions set out in the GDPR, the user has the right to:

• access their personal data;

• rectify inaccurate personal data or complete incomplete data;

• request the erasure of personal data where the conditions provided by the GDPR are met;

• request restriction of processing;

• data portability where applicable;

• object to processing where provided for by the GDPR;

• withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. To exercise these rights, please contact the Data Controller at office@astutorly.pl. The user also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if they believe that the processing of their personal data infringes applicable data protection laws.

11. Automated decision-making

We do not use automated decision-making, including profiling, which produces legal effects concerning users or similarly significantly affects them.

12. Minors

Tutoring services may be provided to minors. Where tutoring services are provided to a minor student, the contract for tutoring services is entered into with the student’s parent or legal guardian. The personal data of a minor student is processed only to the extent necessary for organising and providing tutoring services, in particular for organising lessons, contacting the student regarding matters related to lessons, and providing educational materials related to the lessons. Where the student’s data is provided to the Data Controller by a parent or legal guardian, the parent or legal guardian is the source of such data. Information concerning the processing of personal data is available in this Privacy Policy. ASTutorly does not direct marketing activities towards minors.

13. Data security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised access or disclosure. The ASTutorly website uses a secure HTTPS connection.

14. Changes to this Privacy Policy

This Privacy Policy may be updated in the event of changes to applicable laws, the way the website operates, the scope of services provided or the technologies used. The current version of the Privacy Policy is available on the ASTutorly website.

15. Contact

For matters concerning privacy or the processing of personal data, you can contact the Data Controller:

Anna Sasorska ASTutorly

Genewska 7A/2

03-963 Warsaw, Poland

NIP: 1133207835

REGON: 545288890

E-mail: office@astutorly.pl