Privacy Policy
1. Data Controller
The data controller is:
- Name: pylandschool
- Address: Georgia, Kutaisi, Abashidze str. 8, office 83
- Email: info@pylandschool.com
- Phone: +995 551 00 62 54
This Privacy Policy applies to the processing of personal data of PyLand platform (pylandschool.com) users and was developed in accordance with the 2023 Law of Georgia on Personal Data Protection, as amended, and the EU General Data Protection Regulation (GDPR) for users in the EEA.
2. Collected Data
Data you provide
- First and last name (display name);
- Email address;
- Profile data from OAuth providers (Google, GitHub) — only if you selected that sign-in method;Profile data from OAuth providers (Google, GitHub) — only if you chose that sign-in method;
- Profile photo (when uploaded);
- Education and profession information (when filling in your profile).
Platform Usage Data
- Course and lesson completion progress;
- Test and practical assignment results;
- Login date and time;
- IP address and browser data (User-Agent);
- Website navigation data.
Payment Data
Payment data (card number, CVV, account details) is processed exclusively by Paddle as Merchant of Record and is never shared with the Company or stored on pylandschool servers. Paddle is certified to PCI DSS Level 1.
The Company receives from Paddle only: the transaction identifier, the buyer's email, the name of the purchased course, the amount, and the payment status.
3. Legal Basis for Processing (GDPR)
For users in the European Economic Area, personal data processing is carried out on the following legal bases:For users from the European Economic Area, personal data is processed on the following legal bases:
- Performance of Contract (Art. 6(1)(b) GDPR) — processing necessary to provide course access, maintain the account, and send related service notifications.
- Legitimate Interests (Art. 6(1)(f) GDPR) — platform security and fraud prevention.
- Consent (Art. 6(1)(a) GDPR) — optional analytics, advertising measurement, and marketing communications.
- Compliance with Legal Obligations (Art. 6(1)(c) GDPR) — retaining transaction data in accordance with accounting and tax legislation requirements.storing transaction data in accordance with accounting and tax law requirements.
4. Purposes of Data Processing
- Registration and authentication of users on the Platform;
- Providing access to purchased courses and educational materials;
- Tracking and saving learning progress;
- Issuing course completion certificates;
- Technical support for users;
- Sending transactional notifications (purchase confirmation, password reset);Sending transactional notifications (purchase confirmation, password reset);
- Sending configurable service and educational notifications related to the account, courses, and learning progress;
- Sending marketing communications only with separate consent;
- Ensuring security and preventing fraud;
- Analytics and improving Platform quality;
- Compliance with applicable legal obligations.
5. Third Parties and Data Processors
The Company may share personal data with the following third parties strictly to the extent necessary for the stated purposes:The Company may transfer personal data to the following third parties solely to the extent necessary for the stated purposes:
- Paddle — payment processing as Merchant of Record. Paddle is an independent data controller for payment information.payment processing as Merchant of Record. Paddle is an independent data controller for payment information.
- Google LLC — OAuth authentication (Google Sign-In) when the user selects this sign-in method.
- GitHub, Inc. — OAuth authentication (GitHub Sign-In) when the user selects this sign-in method.
- Google LLC — Google Analytics 4 and Consent Mode for visit and conversion analytics. Before consent, Google may receive limited signals without analytics or advertising cookies; full analytics is enabled after consent.
- Yandex LLC — Yandex Metrica, Session Replay, and interaction maps for website analytics, only after user consent.
- Meta Platforms, Inc. — Meta Pixel and Conversions API for advertising measurement, only after consent. Visit and conversion details and hashed identifiers such as email may be disclosed. facebook.com/privacy/policy
- Cloudflare, Inc. — Turnstile to protect forms from automated requests and abuse.
- Functional Software, Inc. (Sentry) — technical error and service stability diagnostics when the integration is enabled.
- Telegram — transfer and storage of encrypted database and media backups in a private operational channel; archive contents are protected with separate encryption.
- Hosting Provider — server infrastructure for data storage and Platform operation.
The Company does not sell personal data for money. Data is disclosed to advertising and analytics services only for the purposes described and, where required, after consent.
6. International Data Transfers
Because international services are used (Paddle, Google, GitHub, Yandex, Meta, Cloudflare, Sentry, and Telegram), data may be processed outside the user's country, including the US, the UK, and other provider infrastructure locations.
Such transfers are carried out with one of the following safeguard mechanisms in place:Such transfer is carried out subject to one of the following safeguard mechanisms:
- a European Commission adequacy decision for the destination country;
- Standard Contractual Clauses (SCCs) approved by the European Commission — in particular, transfers to Paddle (US), Google (US), and GitHub (US) are protected by SCCs or equivalent safeguards;
- certification of the recipient under the EU-US Data Privacy Framework (where applicable).recipient certification under the EU-US Data Privacy Framework (where applicable).
7. Data Retention Periods
- Account Data — retained for the lifetime of the account and deleted or anonymised in active systems when the account is deleted.
- Learning Progress Data — retained for the duration of the account.
- Transaction Data — local records linked to the account are deleted with it; Paddle independently retains payment records under its policy and applicable law.
- Technical Logs — no longer than necessary for security, diagnostics, and abuse prevention.
- Marketing Newsletter Data — until consent is withdrawn.
After deletion from active systems, some data may temporarily remain in encrypted backups until those backups are deleted under backup management procedures. Backups are used only for disaster recovery and not for ordinary processing.
8. Your Rights
You have the following rights regarding your personal data:
- Right of Access — request a copy of your stored personal data.
- Right to Rectification — request correction of inaccurate or incomplete data.
- Right to Erasure ('right to be forgotten') — the right to request erasure of data when there are no legal grounds for its retention.request deletion of data when there is no legal basis for its retention.
- Right to Restriction of Processing — request suspension of data processing in cases established by law.
- Right to Data Portability — the right to receive data in a machine-readable format for transfer to another controller.receive data in machine-readable format for transfer to another controller.
- Right to Object — the right to object to processing based on legitimate interest or for marketing purposes.object to processing based on legitimate interest or for marketing purposes.
- Right to Withdraw Consent — the right to withdraw previously given consent at any time without affecting the lawfulness of prior processing.withdraw previously given consent at any time without affecting the lawfulness of prior processing.
To exercise your rights, send a request to info@pylandschool.com. The request will be handled within the period required by applicable law; under Georgian law, generally no later than 10 working days. Where permitted by law, the period may be extended after notifying the user.
EU Users
You have the right to lodge a complaint with the data protection supervisory authority in your country of residence. List of EU authorities:You may contact the data protection supervisory authority of your country of residence. List of EU authorities: edpb.europa.eu
Georgian Users
You have the right to contact the State Audit Service of Georgia (Personal Data Protection Division):You may contact the State Audit Office of Georgia (Personal Data Protection section): pdp.sao.ge
Russian Users — FZ-152
Where Federal Law No. 152-FZ on Personal Data applies to the particular processing, users in Russia may exercise the rights it provides and contact Roskomnadzor: rkn.gov.ru. Requests to exercise these rights are accepted at info@pylandschool.com and handled within the period required by applicable law.
Brazilian Users — LGPD
Where the LGPD applies to the particular processing, users in Brazil may exercise the rights it provides. The supervisory authority is the National Data Protection Authority (ANPD): gov.br/anpd
Users in the United Kingdom — UK GDPR
Where the UK GDPR applies to the particular processing, users in the United Kingdom may exercise the rights it provides. The supervisory authority is the Information Commissioner's Office (ICO): ico.org.uk
Users in Australia — Privacy Act 1988
Where the Australian Privacy Act 1988 applies, users may exercise its rights, including requesting access to or correction of data at info@pylandschool.com.
Users in California (USA) — CCPA/CPRA: right to opt out of sale or sharing
Where the CCPA/CPRA apply, California residents may exercise their rights to know, correct or delete data and opt out of its sale or sharing for cross-context behavioural advertising. PyLand does not sell personal data for money. Requests may be sent to info@pylandschool.com; analytics and advertising can be disabled through the cookie banner.
10. Children
Persons under 18 may use the Platform only with a parent or legal guardian's consent and supervision where permitted by law. The Company does not knowingly collect children's data without proper authorisation. Such data will be deleted unless another lawful basis applies.
11. Data Security
The Company applies technical and organisational measures to protect personal data:The Company applies technical and organizational measures to protect personal data:
- data encryption in transit (TLS 1.2/1.3);
- passwords are stored only as strong one-way cryptographic hashes;
- restricted access to personal data within the organization;
- monitoring of technical errors and security events.
In the event of a data security breach that poses a high risk to the rights and freedoms of users, the Company will notify affected users within the timeframes established by applicable law.
12. Policy Changes
The Company may update this Policy periodically. The current version is published on this page; material changes are communicated by an available method where required by applicable law. The latest revision date appears in the document header.
13. Contacts
- Data Controller: pylandschool
- Email: info@pylandschool.com
- Address: Georgia, Kutaisi, Abashidze str. 8, office 83
- Phone: +995 551 00 62 54