Privacy policy

§ 1. General provisions and Personal Data Controller

This Privacy Policy sets out the rules for processing and protecting the personal data of Clients and Students using the educational services of the ePiFii School of Exact Sciences, as well as users of the related application and websites.

The Personal Data Controller is Martyna Kowalczyk, conducting business activity under the name ePiFii Martyna Kowalczyk, tax ID (NIP): 9512655068, with its registered office in Warsaw at ul. Edwarda Dembowskiego 7/57, 02-784 Warsaw (the “Controller” or the “School”).

In all matters concerning personal data protection the Controller can be contacted at: martyna.kowalczyk@epifii.pl.

§ 2. Legal bases and purposes of processing

Personal data is processed in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”). Data is processed for the following purposes:

1. Conclusion and performance of the educational services agreement (Art. 6(1)(b) GDPR) – to handle bookings, conduct lessons, provide teaching materials and operate the profile in the application.

2. Fulfilment of legal obligations incumbent on the Controller (Art. 6(1)(c) GDPR) – including accounting and tax obligations, such as issuing e-receipts and invoices.

3. Pursuit of the Controller's legitimate interests (Art. 6(1)(f) GDPR) – for ongoing communication with the Client, handling enquiries, ensuring the security of IT systems and, where applicable, establishing, pursuing or defending against claims.

4. Measuring the effectiveness of online advertising (Art. 6(1)(a) GDPR) – solely on the basis of the voluntary consent given in the cookie banner, which can be withdrawn at any time by clearing the site data in the browser. Withdrawal does not affect the lawfulness of processing carried out before it.

§ 3. Scope of personal data processed

Depending on the nature of the service provided, the Controller processes the following categories of personal data:

1. Identification data: the full name of the Client (Parent/Legal guardian) and the full name of the Student.

2. Contact data: e-mail address and phone number.

3. Billing data: residence/registered address, tax ID (for business entities) and payment transaction history.

4. System data: history of purchased lesson packages, system logs related to the acceptance of the terms and current activity in the ePiFii application.

Data of underage Students (name, learning progress, lesson materials) is processed in connection with the agreement concluded with the Parent/Legal guardian, who provides this data and controls the Student's account.

§ 4. Security standards and server infrastructure location

The Controller implements rigorous technical and organisational measures to ensure a level of security appropriate to the risk to the rights and freedoms of natural persons, including modern data transmission encryption protocols and strict access control.

Entrusted personal data is stored in a certified data centre located in the European Union (infrastructure provider: OVHcloud).

The Controller does not transfer personal data outside the European Economic Area (EEA), unless the use of the providers listed in § 5 requires it — in such cases the transfer is based on a European Commission adequacy decision or standard contractual clauses (SCC).

§ 5. Disclosure of data to third parties (data recipients)

Personal data may only be transferred to trusted processors with whom the Controller has concluded appropriate data processing agreements guaranteeing the highest security standards. These include in particular:

1. PayPro S.A. (operator of the Przelewy24 service) — for the authorisation and processing of online payments.

2. Google Ireland Ltd. — e-mail, calendar, Google Meet video calls and the optional Google sign-in.

3. Cloudflare, Inc. — protection of public forms against bots (the Turnstile mechanism).

4. OVHcloud — application hosting and data storage.

5. An external accounting office handling the School's accounting and tax processes, and providers of sales-document software.

6. Google Ireland Ltd. (Google Ads) — measuring advertising campaign performance, only after consent has been given in the cookie banner. What is transmitted is the ad click identifier and — for conversion matching — the e-mail address and phone number as an irreversible SHA-256 cryptographic hash; the Controller does not transmit these in plain form.

Under no circumstances does the Controller sell personal data or share it with external parties so that third-party advertising can be targeted at Clients.

§ 6. Data retention period

Data processed for the provision of educational services is stored for the entire duration of the cooperation and, after it ends, only until the limitation of any claims under civil law.

Data contained in accounting and tax documentation (including fiscal receipts and invoices) is stored for 5 years from the end of the calendar year in which the relevant tax payment deadline expired, in accordance with mandatory provisions of Polish tax law.

§ 7. Rights of data subjects

Under the GDPR, every person whose data is processed by the School has:

1. The right of access: to request information about the processed data and to receive a copy of it.

2. The right to rectification: to request the prompt correction of inaccurate data or the completion of incomplete data.

3. The right to erasure (“right to be forgotten”): unless there are overriding legal grounds obliging the Controller to continue processing (e.g. tax requirements).

4. The right to restriction of processing.

5. The right to data portability to another controller in a structured format.

6. The right to object to processing based on the Controller's legitimate interest.

7. The right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office (PUODO).

To exercise the above rights, please contact the Controller by e-mail.

§ 8. Cookies

Cookies strictly necessary for the service to work: session cookies (keeping you signed in), cookies remembering the selected language and the active user role. As they are necessary to provide the service, no separate consent is required.

Google Ads marketing cookies: written only after “Accept” is clicked in the consent banner, in order to establish which ad led to contacting the School and to measure campaign performance. Until consent is given, Google runs in restricted mode (Consent Mode) and stores no identifiers on the device.

Visit statistics are collected with an analytics tool that works without cookies and without identifying individual persons — regardless of the choice made in the consent banner.

Consent to marketing cookies can be withdrawn at any time by clearing the site data in the browser settings — the banner will then appear again. Cookies can also be blocked entirely, which will however prevent signing in to the application.

§ 9. Final provisions

The Controller reserves the right to update this Privacy Policy in connection with the ongoing development of the ePiFii application's functionality or changes in applicable law.

Clients will be informed of any material changes to the Privacy Policy by e-mail with the appropriate statutory advance notice.