Personal Data Processing Policy

1. General provisions

This Personal Data Processing Policy (the “Policy”) has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”) and defines how personal data are processed and the measures taken by the Operator to ensure their security.

Personal data operator: Andrew (Эндрю), an individual providing Korean language instruction under the brand “Andrew Korean” (the “Operator”). [Full legal name and, if applicable, sole proprietor / OGRNIP status and address — to be completed before publication]

Operator contact details for personal data inquiries:

• Email: [email protected]
• Telegram: @Andrew_Korean

By using the website and/or submitting a request through forms on the website, the user confirms agreement with the terms of this Policy.

2. Legal bases for processing

Personal data are processed on the basis of:

• the data subject’s consent to processing (Articles 6 and 9 of the Law);
• conclusion and performance of a contract for educational services to which the data subject is a party;
• Federal Law No. 152-FZ and other applicable laws and regulations of the Russian Federation.

3. Categories of data subjects and data processed

The Operator processes personal data of users who submit a request or contact the Operator (prospective and current students). The following data may be processed:

• name;
• phone number and/or Telegram username;
• email address;
• contents of a message or comment submitted via a form;
• information about the selected course and level-test results (if provided by the user);
• technical data (cookies, IP address, browser and device information) — see Section 8.

The Operator does not process special categories of personal data (such as racial or ethnic origin, health status, and similar), nor biometric personal data.

4. Purposes of processing

• communicating with the user about learning, consultation, and lesson booking;
• providing results of a free level assessment;
• delivering educational services and related information;
• handling inquiries and feedback.

5. Processing methods and retention periods

Personal data are processed with and without automation and may include collection, recording, systematization, accumulation, storage, updating, use, transfer (where provided by this Policy), blocking, deletion, and destruction of personal data.

Personal data are retained no longer than required for the purposes of processing. Data are stored until those purposes are achieved or until the data subject withdraws consent, after which they are deleted or anonymized, unless otherwise required by the laws of the Russian Federation.

6. Storage of data in the Russian Federation

In accordance with Part 5 of Article 18 of the Law, recording, systematization, accumulation, storage, updating, and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation.

7. Transfer to third parties

The Operator does not sell or transfer personal data to third parties except where necessary to achieve the purposes of processing and on the Operator’s instructions (Article 6 of the Law), as well as in cases required by the laws of the Russian Federation.

Third-party services may be used to receive requests and communicate with users (in particular Telegram and request-tracking / spreadsheet tools). Such services process data solely on the Operator’s instructions and only to the extent needed for those purposes.

8. Cookies and analytics

The website uses cookies and web analytics tools (for example, Yandex Metrica and/or Google Analytics) to collect anonymized usage statistics and improve the site. The data collected are anonymized in nature (browser, device, on-site actions, IP address).

Users may disable cookies in their browser settings. Disabling cookies may affect certain website features.

9. Cross-border data transfer

When certain third-party services are used (messengers, analytics systems), some processing may occur on servers outside the Russian Federation. Such transfer is carried out in compliance with Article 12 of the Law. Initial recording and storage of personal data of citizens of the Russian Federation are performed in databases located in the Russian Federation (see Section 6).

10. Rights of the data subject

The data subject has the right to:

• receive information about the processing of their personal data;
• request clarification, blocking, or deletion of their data if they are incomplete, outdated, inaccurate, or processed in violation of the law;
• withdraw consent to personal data processing at any time;
• appeal the Operator’s actions or inaction to the authorized body for the protection of data subjects’ rights (Roskomnadzor) or in court.

11. Withdrawal of consent and deletion of data

To withdraw consent to personal data processing, or to request clarification or deletion of data, the data subject may send a request to email: [email protected]. The Operator ceases processing and/or deletes personal data within the period established by the laws of the Russian Federation, unless other legal grounds for processing remain.

12. Personal data protection measures

The Operator takes necessary legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful actions (Articles 18.1 and 19 of the Law).

13. Changes to this Policy

The Operator may amend this Policy. The current version is always available on this page. The date of the latest update is indicated at the beginning of the document.