Privacy policy

As of: July 2026 · under the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG)

This is a courtesy translation for information only. The legally binding version is the German original.

1. Controller

Controller for data processing within the meaning of the GDPR:
Davit Hovakimyan, Kraygasse 94/2/6, 1220 Vienna, Austria
Email: davit18h@gmail.com · Phone: +43 676 397 5535

2. What data we process

If you use an account in our booking system, we process:

Account and master data: name, email address and a password stored in encrypted (hashed) form.
Billing data: billing name and billing address (street, postcode, town, country).
Booking and appointment data: booked lessons, date, time and the assigned tutor.
Lesson credit and payment data: lesson credits, transactions and receipts/invoices (receipt number, date, amount).
Lesson-related data: notes on learning progress, a profile picture if you choose to upload one, and learning materials provided for lessons.
Technical data: server log data generated when you visit the website (e.g. IP address, date/time of access) and technically necessary session cookies.

3. Purposes and legal bases

Performance of a contract (Art. 6(1)(b) GDPR): providing your account, booking and delivering lessons, managing lesson credits and appointments.
Legal obligation (Art. 6(1)(c) GDPR): issuing and keeping invoices and receipts.
Legitimate interest (Art. 6(1)(f) GDPR): secure and stable operation of the application and protection against misuse.
Consent (Art. 6(1)(a) GDPR): where you provide optional information, such as a profile picture. You can withdraw your consent at any time with effect for the future.

4. Minors

Our lessons are also aimed at students under 18. Under §4(4) DSG, in Austria a child’s consent to data processing is only valid up to the age of 14 with the approval of their legal representative (parents or guardians). Registration and the provision of personal data of children under 14 are therefore carried out by their parents or guardians, or with their consent.

5. Cookies and tracking

Technically necessary cookies: for sign-in and the security of the application, we set a session cookie and a CSRF cookie, as well as a cookie that stores your cookie consent (tgp_consent). These cookies are strictly necessary to run the website (§ 165(3) TKG 2021) and therefore do not require consent. Fonts are served locally from our own server; no data is passed on to third parties for this.

Cookies and services that require consent: in addition, we use the following services exclusively after your express consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). Without your consent, these services are not loaded and no corresponding cookies are set:

Statistics: Microsoft Clarity (Microsoft Ireland Operations Ltd., Ireland; Microsoft Corporation, USA): analysis of usage behaviour (including page views, clicks, scrolling) to improve our services. More information: privacy.microsoft.com.
Marketing: Google Ads / Google Tag (gtag.js) (Google Ireland Ltd., Ireland; Google LLC, USA): measuring the success of our ads (conversion tracking). More information: policies.google.com/privacy.

On your first visit, we ask for your consent through a cookie banner. You can freely switch individual categories (statistics, marketing) on or off; if you make no selection, only technically necessary cookies are set. You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the page footer. These services may involve transferring personal data to the USA (see section 7).

6. Recipients and processors

To run the application, we use the following service providers, which process personal data on our behalf and in accordance with our instructions:

Hosting: Render (Render Services, Inc., USA). The servers are located in the EU (Frankfurt, Germany) region. A data processing agreement (DPA) is in place with the provider: Render incorporates its Data Processing Addendum (available at render.com/dpa) automatically into the contract as part of its terms of service; it therefore applies when the service is used and includes the EU standard contractual clauses for any transfers to third countries.
Error monitoring: Sentry (Functional Software, Inc., USA), data region EU (Frankfurt, Germany). If a technical error occurs in the application, an error report (error message, affected page, technical environment) is sent so that we can fix the error. Name, email address, IP address, cookies and form entries are not included. A data processing agreement (DPA, sentry.io/legal/dpa) that includes the EU standard contractual clauses is in place with the provider. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
Statistics & marketing (only with consent): if you use the optional statistics or marketing services (see section 5), data is transferred to Microsoft (Microsoft Clarity) or Google (Google Ads). This transfer takes place exclusively on the basis of your consent; if you do not give it, no data is transferred.

We do not pass data on to any other third parties unless we are legally obliged to do so.

7. Transfers to third countries

The data is hosted in the EU. As the hosting provider is a US company, access from a third country (the USA) cannot be completely ruled out. Any such transfer is protected by appropriate safeguards (EU standard contractual clauses under Art. 46 GDPR or certification under the EU-US Data Privacy Framework).

If you consent to the optional statistics or marketing services (Microsoft Clarity, Google Ads, see section 5), personal data (such as your IP address) may be transferred to Microsoft or Google and their group companies in the USA. The legal basis for this is your consent (Art. 6(1)(a) in conjunction with Art. 49(1)(a) GDPR); in addition, both providers rely on EU standard contractual clauses and their certification under the EU-US Data Privacy Framework. Without your consent, no such transfer takes place.

8. Storage period

Account, booking and lesson data: until your account is deleted, or for as long as needed for your lessons.
Invoices and receipts: seven years, due to the statutory retention obligation (§132 BAO). When an account is deleted, personal data is removed; receipt data that must be retained by law is kept for the retention period and deleted afterwards.
Details for a free trial lesson booked without an account (name, email, phone, message): twelve months after the appointment, after which they are deleted automatically.
Technical log data: only briefly, to keep the service running; expired login sessions are deleted automatically.

9. Your rights

You have the following rights regarding your personal data:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR)
Withdrawal of consent with effect for the future

To exercise your rights, simply send a message to davit18h@gmail.com.

You also have the right to lodge a complaint with the supervisory authority:
Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

10. Data security

Data is transmitted in encrypted form over HTTPS/TLS. Passwords are only ever stored in hashed form. Access to personal data is restricted by role: students only see their own data.