Privacy Policy

The data controller is TAKTalk Szkoła Języka Polskiego - Karolina da Silva Cardoso, Tax ID (NIP): 9252154813, Business Registry Number (REGON): 545311979, registered address: Os. W. Witosa 3, 67-112 Siedlisko, Lubuskie Voivodeship, Poland. For privacy questions, contact us at admin.taktalk@gmail.com.

We collect information you submit through quote, contact, account, support, and teacher application forms, including name, email, phone, language background, availability, learning goals, and CV files when you apply to work with us.

When you use the platform, we process account details, lesson schedules, attendance, materials, support messages, notifications, and payment-related records needed to provide the service. Where required for invoicing and accounting, we also collect your structured postal address (street, postal code, and city).

• Contract performance (Art. 6(1)(b)) — preparing quotes, creating your account, scheduling and delivering lessons.
• Legitimate interest (Art. 6(1)(f)) — responding to inquiries, platform security, and fraud prevention.
• Legal obligation (Art. 6(1)(c)) — accounting, tax, and complaint-handling records required by Polish law, including your postal address for invoicing.
• Consent (Art. 6(1)(a)) — optional CV retention for future openings, and any future marketing communications; you can withdraw consent at any time without affecting past processing.

We use personal data to answer inquiries, prepare quotes, manage lessons, create and protect accounts, deliver notifications, process teacher applications, provide support, issue invoices, and meet legal or accounting obligations.

We do not sell personal data. We share it only with the following categories of recipients, acting as our processors: hosting and infrastructure (Vercel), authentication and database (Supabase), transactional email (Resend), payment processing (Stripe), spam/rate-limiting protection (Upstash), video conferencing for individual lessons (8x8/Jitsi Meet, which receives audio, video, and the meeting room identifier of session participants), and video conferencing for group lessons (Google Calendar/Meet, which receives the name and email of group lesson participants to generate and grant access to the meeting).

We also use Vercel Analytics, a cookieless traffic-analytics tool, to measure page views and site performance based on our legitimate interest in understanding and improving the platform.

Some of our processors (including Vercel, Supabase, Resend, Stripe, Upstash, Google, and 8x8/Jitsi) may process data on servers located outside the European Economic Area, including in the United States. Where this happens, we rely on the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism recognized under Chapter V GDPR to keep your data protected.

• Account and lesson data — for the duration of our agreement and for 6 years afterward, matching the Polish statute of limitations for civil claims.
• Accounting and invoicing records, including postal address — for 5 years from the end of the relevant tax year, as required by Polish law.
• Data processed on the basis of consent (e.g. optional CV retention for future openings) — until you withdraw consent or the stated retention period (up to 24 months) expires, whichever comes first.

You have the following rights over your personal data, at no cost, exercised by writing to the email address above:

• Access a copy of the data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data, subject to our legal retention obligations.
• Restrict or object to certain processing based on legitimate interest.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.

We respond to rights requests within one month. You also have the right to lodge a complaint with the Polish supervisory authority, Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland — https://uodo.gov.pl.

We use access controls, server-side validation, row-level security, rate limiting where configured, and secret management practices to reduce unauthorized access, abuse, and data exposure risks.