The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to all organizations that process personal data of EU residents, regardless of where the organization is located.

Under GDPR, you have the following rights regarding your personal data:

We only collect and process personal data that is necessary for providing our English learning services:

We process your personal data under the following legal bases:

We implement comprehensive security measures to protect your personal data:

• Encryption: All data transmissions use SSL/TLS encryption
• Access Controls: Role-based access with multi-factor authentication
• Data Minimization: We only collect data necessary for our services
• Regular Audits: Security assessments and vulnerability testing
• Staff Training: Regular privacy and security training for all team members
• Incident Response: Procedures for handling potential data breaches
• Vendor Management: Due diligence for third-party service providers

Some of our service providers are located outside the European Economic Area (EEA). When we transfer your data internationally, we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries deemed adequate by the European Commission
• Standard Contractual Clauses: EU-approved contracts for data protection
• Certification Schemes: Providers certified under recognized privacy frameworks
• Data Processing Agreements: Contractual obligations for data protection

To exercise any of your data protection rights or if you have questions about our GDPR compliance:

Right to Lodge a Complaint: If you're not satisfied with how we handle your data, you have the right to lodge a complaint with your local data protection authority. For EU residents, you can find your local authority at ec.europa.eu/justice/data-protection.