Information on Personal Data Processing

1. Personal Data Controller

• Name: pylandschool
• Address: Georgia, Kutaisi, Abashidze str. 8, office 83
• Email: info@pylandschool.com
• Phone: +995 551 00 62 54

2. Categories of Processed Data

Required data (for registration and account operation)

• Email address;
• Username (display name);
• Encrypted password hash (for email registration);
• OAuth profile data: name, email, avatar (when signing in via Google or GitHub).

Platform Usage Data

• Course, lesson and assignment completion progress;
• Test and quiz results;
• Login dates and times;
• IP address and browser data (User-Agent, language).

Transaction Data

• Paddle transaction identifier;
• Name and price of the purchased course;
• Payment status and transaction date.

Optional data

• Profile photo;
• Information about education and professional experience;
• Links to social media profiles.

3. Legal Basis for Processing

For users from the EEA (GDPR)

• Contract performance (Art. 6(1)(b)) — account creation, providing access to courses, technical support.
• Legitimate interests (Art. 6(1)(f)) — platform security and fraud prevention.
• Consent (Art. 6(1)(a)) — optional analytics, advertising measurement, and marketing communications.optional analytics, advertising measurement, and marketing communications.
• Legal obligation (Art. 6(1)(c)) — storage of transaction data for tax reporting.

For users from Georgia

Processing is carried out on the lawful bases provided by the 2023 Law of Georgia on Personal Data Protection, as amended, including consent, performance of a contract, and the controller's legitimate interests.

Users in Other Countries

Where a user's national law applies to the Platform, processing is subject to its mandatory requirements. Questions about rights and legal bases may be sent to info@pylandschool.com.

4. Purposes of Data Processing

• User registration and authentication;
• Providing access to educational materials;
• Tracking and saving learning progress;
• Issuing course completion certificates;
• Technical support for users;
• Sending transactional notifications (purchase confirmation, password reset);Sending transactional notifications (purchase confirmation, password reset);
• Sending configurable service and educational notifications related to the account, courses, and learning progress;
• Sending marketing communications only with separate consent;
• Ensuring security and preventing fraud;
• Maintaining accounting and tax records;
• Improving the quality and functionality of the Platform.

5. Data Processors and Recipients

Personal data may be shared with the following parties:

• Paddle — payment processing. Paddle is an independent personal data controller for payment information.payment processing. Paddle is an independent personal data controller for payment information.
• Google LLC — authentication via Google OAuth.
• GitHub, Inc. — authentication via GitHub OAuth.
• Google LLC — Google Analytics 4 and Consent Mode for website analytics.
• Yandex LLC — Yandex Metrica and Session Replay for website analytics after consent.
• Meta Platforms, Inc. — advertising conversion measurement after consent.
• Cloudflare, Inc. — Turnstile to protect forms from abuse.
• Functional Software, Inc. (Sentry) — technical error diagnostics when the integration is enabled.
• Telegram — transfer and storage of encrypted backups in a private operational channel.
• Hosting Provider — server infrastructure for data storage and processing.

The Company does not sell personal data for money. Data is disclosed to analytics and advertising services only for the purposes described and, where required, after the user's consent.

6. Data Retention Periods

• Account Data — for the lifetime of the account; related data is deleted or anonymised in active systems when the account is deleted.
• Learning progress — for the duration of the account.
• Transaction Data — local records are deleted with the account; Paddle independently retains payment records under its policy and applicable law.
• Security logs — no longer than necessary for security, diagnostics, and abuse prevention.
• Marketing data — until consent is withdrawn.

Data deleted from active systems may temporarily remain in encrypted backups until the relevant backups are deleted; they are used only for disaster recovery.

7. Data Subject Rights

You have the right to:

• Access — obtain a copy of your stored data;
• Rectification — request the correction of inaccurate data;
• Erasure — request deletion of data when there are no legal grounds for its retention;request the deletion of data when there are no legal grounds for its retention;
• Restriction of processing — request the suspension of processing in cases established by law;
• Data portability — receive data in machine-readable format (JSON/CSV);
• Objection — object to processing based on legitimate interest;
• Withdrawal of consent — withdraw consent at any time.

To exercise your rights, send a request to info@pylandschool.com. The request will be handled within the period required by applicable law; under Georgian law, generally no later than 10 working days. Where permitted by law, the period may be extended after notifying the user.

8. Data Protection Measures

• Data transmission encryption using TLS 1.2/1.3;
• Passwords are stored only as strong one-way cryptographic hashes;
• Restricted employee access to personal data based on the principle of least privilege;Restricted employee access to personal data based on the principle of least privilege;
• Regular data backups;
• Security monitoring and auditing.

9. Withdrawal of Consent and Data Deletion

You have the right to withdraw your consent to the processing of personal data at any time by sending a request to info@pylandschool.com. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

If consent is withdrawn and no other lawful basis applies, processing will stop and the data will be erased within the period required by applicable law; under Georgian law, no later than 10 working days after the request. This does not apply to data that must be processed or retained on another lawful basis.

Account deletion causes related data in the active database, including local payment records, to be deleted or anonymised. Independent controllers, including Paddle, retain data they received under their own policies and applicable law; backups are deleted separately.

10. Contacts

• Data Controller: pylandschool
• Email: info@pylandschool.com
• Address: Georgia, Kutaisi, Abashidze str. 8, office 83
• State Audit Office of Georgia (data protection): pdp.sao.ge