Privacy Policy

1. General Information

This Privacy Policy sets out the rules for processing the personal data of users, including tutors, who use the online service www.Sophyratutors.com through which it is possible to purchase or provide online tutoring/lesson services.

We make every effort to ensure the security of personal data in accordance with applicable legal regulations, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

2. Personal Data Controller
The controller of personal data is SOPHYRA
SPÓŁKAZOGRANICZONĄODPOWIEDZIALNOŚCIĄ, with its registered office at ul. Szańcowa 44/1, 01-458 Warsaw, KRS No. 5273167115, NIP 0001176154, contact: Natalia Ambridge. The Controller is responsible for the correct and lawful processing of users’ personal data.

3. Scope of Data Collected
1. When using the website and purchasing/selling tutoring/lesson services, we may process the following personal data:
1. first and last name of the student or parent/guardian,
2. email address,
3. telephone number,
4. invoicing details (residential address, tax ID number),
5. payment details (e.g., bank account number, payment card data – processed by the payment operator),
6. IP address and technical data regarding the device and browser,
7. information stored in cookies.

2. For tutors cooperating with the Controller, we may also process:

1. first and last name,
2. email address,
3. telephone number,
4. education,
5. professional experience,
6. profile picture,
7. bank account number,
8. invoicing details, tax ID number, home/office address,
9. other information provided during recruitment or cooperation.

​

4. Purposes of Data Processing
1. Personal data is processed for the following purposes:
1. execution of tutoring orders,
2. contact with the client regarding lessons, schedule changes, payments,
3. issuing invoices and accounting documents,
4. conducting marketing activities (e.g., newsletters, promotions),
5. statistical analysis and improving website functionality,
6. fulfilling legal obligations of the Controller.

2. Tutors’ personal data is additionally processed for recruitment, concluding and performing cooperation agreements, financial settlements, organizational contact, and ensuring the quality of services provided.

5. Legal Basis for Processing
Personal data is processed based on:
1. user’s consent (Art. 6(1)(a) GDPR) for contact, promotional information, and updates,
2. necessity for the performance of a contract (Art. 6(1)(b) GDPR),
3. legal obligation (Art. 6(1)(c) GDPR),
4. legitimate interests of the Controller (Art. 6(1)(f) GDPR), such as customer service or fraud prevention.

6. Data Sharing
1. Personal data of users who are interested in or have purchased tutoring/lesson services may
be shared with:
1. selected tutors,
2. online payment operators (e.g., PayU, Stripe, Przelewy24),
3. subcontractors for contact or service performance,
4. IT and hosting service providers,
5. accounting and legal service providers,
6. public authorities if required by law.

2. Tutors’ data may be shared with:
1. users who purchased the service, to the extent necessary to conduct the lessons (e.g., name),
2. payment operators,
3. IT service providers,

4. accountants, lawyers, and other entities providing services to the Controller.

7. User Rights
Every data subject has the right to:
1. access their data,
2. rectify their data,
3. erase their data (“right to be forgotten”),
4. restrict processing,
5. data portability,
6. object to processing,
7. withdraw consent at any time,
8. lodge a complaint with the President of the Personal Data Protection Office (PUODO).

8. Cookies
The website uses cookies to ensure proper functioning, analyse traffic, and personalise content. Users may change cookie settings in their browser at any time. Using the website without changing the settings means consent to their use. Details are provided in the Cookies Policy.

9. Data Retention Period
Personal data is stored for the period necessary to provide tutoring services and cooperate with tutors, as well as for the time required by law – e.g., for accounting documentation (minimum 5 years). Data processed based on consent is stored until consent is withdrawn.

10. Security Measures
The Controller applies appropriate technical and organisational measures to ensure the security of personal data, including:
1. encrypted connections (SSL),
2. access control to data,
3. regular system updates,
4. cooperation only with trusted service providers.

11. Personal Data of Minors
1. Tutoring services offered via the website may be directed to minors; however, purchases and the provision of personal data should only be made by a parent or legal guardian.
2. The Controller does not knowingly process minors’ personal data without prior consent from their guardians. If it is found that a minor’s data has been provided without the required consent, the Controller will take steps to promptly delete it.

3. Data of underage students, such as name, age, education level, or learning preferences, is processed solely for the purpose of delivering tutoring services and is not used for marketing or shared with third parties without the guardian’s explicit consent.
4. A parent or legal guardian has the right to:
1. access the child’s data,
2. correct or delete it,
3. withdraw consent for its processing,
4. object to its processing.

12. Changes to the Privacy Policy
We reserve the right to make changes to this Privacy Policy. Users will be informed of any significant changes via the website or by email to the provided address.

13. Transfer of Personal Data Outside the European Economic Area (EEA)
1. In the course of service delivery, where a user who purchased the service or a tutor is located outside the EEA, as well as in connection with the use of analytical, marketing, and operational tools supporting the functioning of the Service, personal data may be transferred to third countries, in particular to the United States of America (USA).

2. Data may be transferred to:
1. tutors when the tutor is located outside the EEA,
2. users who purchased the service when located outside the EEA,
3. third parties indicated in point 6, if their registered office is outside the EEA,
4. Google LLC – in connection with the use of Google Analytics and Google Workspace,
5. Meta Platforms Inc. – in connection with Facebook integration (e.g., login, social media widgets),
6. LinkedIn Inc. – in connection with the presence of social media widgets.

3. Data transfer to third countries is carried out only in compliance with the GDPR, i.e., based on:
1. an adequacy decision by the European Commission (if applicable),
2. standard contractual clauses approved by the European Commission,
3. additional technical and organisational safeguards implemented by the Controller.
4. The user has the right to obtain a copy of the safeguards for data transfers outside the EEA by contacting the Controller via the contact details indicated in this Privacy Policy.