Privacy Policy

1. Data controller

The data controller is Ing. Martin Polak / AlgoRhino, Company ID (IČO) 29812798, address Nebovidy 151, 664 48 Nebovidy, Czech Republic.

Contact for privacy matters: martin@itacademy-martin.com.

2. Processing of children’s data and parental consent

Under Czech law, a child who has reached the age of 15 may give consent to the processing of personal data in relation to information society services on their own. For children under 15, registration and consent (where consent is the legal basis) are provided by a parent or other legal guardian.

An account on the website is typically created by a parent / legal guardian or a teacher (school mode). The child uses access set up by an adult or the school.

A child’s name that may be entered in the system is used solely to generate a completion certificate for a course or level. We do not use it for marketing or targeted advertising.

3. School mode and pupil anonymity

In school mode, pupils join using a class code and a nickname. There is no need to enter the child’s e-mail address or other direct identifiers.

The contracting party and administrator of the school account is the school / teacher. We recommend nicknames that do not unnecessarily reveal the child’s full identity.

4. Scope and purposes of processing

We process in particular the following categories of data:

• Parent / teacher: e-mail, password (hashed by the authentication provider), optional name.
• Child (user): nickname (school mode), optional name for the certificate, course progress.
• Payments: purchase and billing data. Card payment data are processed directly by Stripe — we do not store card numbers.
• School: school name, teacher e-mail, packages, classes and seat limits.
• Technical data: security and operational logs to the extent necessary (e.g. IP when accessing the API).

Purposes and legal bases

We use data to provide course access, manage accounts, process payments and invoicing, operate school licences and keep the service secure.

• Performance of a contract (Art. 6(1)(b) GDPR) — account, access, school licences.
• Legal obligation (Art. 6(1)(c) GDPR) — accounting and tax duties.
• Legitimate interest (Art. 6(1)(f) GDPR) — security, abuse prevention, technical operation.
• Consent (Art. 6(1)(a) GDPR) — only where consent is required and has been given.

No marketing aimed at children

We do not use children’s data for marketing or targeted advertising. We do not share children’s data with third parties for advertising profiling.

5. Rights of users and parents

In connection with personal data processing you have in particular the following rights:

• right of access to personal data,
• right to rectification of inaccurate data,
• right to erasure (“right to be forgotten”), where legal conditions are met,
• right to restriction of processing,
• right to data portability where the GDPR allows,
• right to object to processing based on legitimate interest,
• right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ), website: www.uoou.cz.

Exercising your rights

To exercise your rights, write to martin@itacademy-martin.com. A parent / legal guardian may also exercise rights on behalf of a child under 15 (and, where they manage the account, to a reasonable extent for older children).

6. Processors and transfers to third parties

Personal data may be processed by trusted processors necessary to run the service:

• Stripe — payments and invoicing (Stripe Checkout).
• Supabase — database, authentication and serverless functions.
• Hosting services — website hosting (e.g. Websupport) and related infrastructure.
• Where enabled, a transactional e-mail provider (e.g. Resend).

Further information on processing

We do not sell data. Transfers outside the EU/EEA occur only if the processor provides appropriate safeguards (e.g. standard contractual clauses) or the country ensures an adequate level of protection.

Retention: accounting records for the period required by law (typically up to 10 years). Account data for the life of the account and a reasonable period thereafter. School records for the licence term and necessary archiving. Browser data (progress) can be deleted by the user.

Security: HTTPS, access control, hashed passwords, vetted providers. No internet transmission is completely risk-free.

Cookies and local storage: session for login; lesson progress and school session in localStorage. We do not use third-party advertising trackers.

We may update this policy; the current version is always on this page.