PRIVACY POLICY
Identification of data controller: JAIK s.r.o., ID no. 21536112, with its registered seat at Primátorská 296/38, Libeň, 180 00 Praha 8 (“we”).
Contact details: hello@kubaenglish.com.
We are creators of Kuba English App (“App”) and by this Privacy policy, we would like to inform you about how we process your personal data when you use our App. More information about the App is available here: https://kubaenglish.com/ (“website”)
We recommend that you read this information carefully. If you have any questions, you can contact us at any time using the contact details below. As we are company located in European union, the processing of personal data is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).
A. TABLE OF CONTENTS
Our goal is to ensure maximum transparency in the processing of your personal data. We have divided this document into the following sections:
– the personal data processed, including examples of the data processed (part B);
– the purposes of the processing of personal data, as well as the legal bases and periods of processing (part C);
– sharing of personal data (part D);
– Your rights in data processing and how to exercise them (part E);
– the possibility to lodge a complaint (part F); and
– amendments to this document (part G).
Our App also uses cookies and other technical identifiers, beacons etc., a description of the different purposes and types of third parties is set out in section B and C of this Privacy policy and in cookie bar available on the website (in the section “Details”).
B. PERSONAL DATA PROCESSED
We will use your personal data to provide you with the functionalities of the App, which may also include e-mail notifications, ensure legal obligations, secure our claims etc. All purposes and usage of data is stipulated in this part C of the Privacy policy where you can find for what purposes we use your data, what type of data is processed and what is the data retention for processing.
We will not sell your data to third parties, but we may share it with our partners who help us provide our services (see Part D of this Privacy Policy). We follow industry standards including TLS 1.2+ in transit and AES-256 at rest (cloud provider default). Access is role-based and logged. Despite safeguards, no online service is 100 % secure; please protect your device and sign-in e-mail.
Personal data are stored within the period stipulated for each purpose in part C of this Privacy Policy. Generally, we will retain your personal data for the length of time needed to fulfill the purposes outlined in this Privacy policy unless a longer retention period is required or permitted by law. When the data retention period expires for a given type of data, we will delete/anonymize or destroy it.
You may also request for your data to be deleted by contacting us on hello@kubaenglish.com. We will assess it in accordance with GDPR.
Categories of personal data processed:
– Identifiers, such as account ID, user ID, device identifier.
– Contact info, such as first name, e-mail address, other contact details inserted to the App.
– Billing and payment information, such as information about payment method, plan type, card number, billing address. See Part C of the Privacy policy for payment processors of the payment.
– Purchases information, such as payments made and records of payments made, history of payments.
– User content, such as text, messages, your preferences, voice or sound recordings (if you allow your microphone when using the App), photo/video upload (if you allow it), saved content, customer support requests, content generated content by you (display name, age-band, gender, study motivation), learning data (lesson history, progress scores, feedback etc.).
– Usage data, such as information about how you interact with the App, information about which, your activity in the App, IP address, device type, OS, session length.
– Diagnostics data, such as crash logs, performance data.
– Cookies data, which include essential cookies, analytics data and advertising cookies and similar technologies.
Please, do not use our App to upload any sensitive information about you, such as health data, genetic data, biometric data, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning sexual orientation.
The App is not designated for children. By downloading or installing the App, you declare that you are older than 13 years old and are solely responsible for any damage or loss that we may suffer because of his untruthful declaration. If you want to use the App and you are younger then 13 years old, the usage of the App shall be made by your legal representative.
In most cases, data is gathered from your usage of the App or from your device on which you are using the App. We may obtain your data also from third parties that enable us to provide the App, in particular payment providers (e.g. Stripe, Apple, Google, RevenueCat) and app distribution platforms.
C. PURPOSES OF THE PROCESSING OF PERSONAL DATA
We process your personal data as a data controller for the processing purposes, legal bases and periods set out below.
In this section, we describe the processing of your data related to the provision of our App. In the second part of this section, we further describe the processing related to the cookies.
D. PROCESSING OF PERSONAL DATA IN OUR APP
D.1 Provision of App core functionalities
We primarily process personal data to provide you with our App as an AI English tutor, create you account and plan, process payments and to treat you as our customer, when you download the App and agree with our Terms & Conditions. Personal data is processed to authenticate you as the user, enable our features, customize user experience, ensure your progress when using the App, perform customer support, ensure functionality of our App, process necessary payments. As part of this, we may also send you messages about the conclusion and performance of a contract, authentication of contact details, payment reminders or approvals, etc.
For this purpose, we process these categories of personal data:
– Identifiers, Contact info, Billing and payment information, Purchases information, User content, Usage data, Cookies data (essential cookies to ensure functionality of the App)
The legal basis for this processing is the performance of the contract between you and us and the need to take steps at your request before entering the contract (gathering necessary info to create user account).
The data are processed for the duration of the mutual relationship and for the period necessary for the performance of the obligations under such contract, plus 24 months after termination of the user account. It is possible to delete the account in the App directly in the settings of the App.
D.2 Personalized content, avatars and difficulty
We process your profile and learning data to build and update a custom learning plan for you, recognize your level (beginner to advanced), identify your gaps, adapt lesson difficulty with AI, and personalize content and avatars so the app focuses on what is important, helps you get rid of the fear of speaking and lets you progress quickly with short daily sessions.
For this purpose, we process these categories of personal data:
– Identifiers, User content, Usage data.
The legal basis for this processing is legitimate interest in improving and personalizing the service for effective language learning.
Personalization data are retained in line with your learning history, i.e. while the account in the App is active and for an additional 24 months before anonymization.
D.3 Fulfilling legal obligations
We may also process your personal data in order to comply with our legal obligations, particularly in the area of tax and accounting. At the same time, we need to be prepared to provide cooperation to state authorities if we are required to do so by law. We process your data to execute payments, manage your subscription or access (including free periods, discounts, and money-back guarantee offers), and handle any refunds via providers such as Stripe, Apple, Google and RevenueCat.
For this purpose, we process these categories of personal data:
– Identifiers, Contact info, Billing and payment information, Purchases information
The legal basis for this processing is the fulfilment of our legal obligations.
The data is processed for the period required by law. Specifically for the period of 7-10 years for tax and audit purposes.
D.4 Internal records, statistics, and protection of our rights
We may process your data for the purposes of keeping internal records within our company, recording subscriptions made, producing statistical reports, protecting our rights and legal claims, and to ensure that only you use our App in accordance with their terms.
For this purpose, we process these categories of personal data:
– Identifiers, Contact info, Billing and payment information, Purchases information, User content, Usage data, Diagnostics data.
The legal basis for this processing is our legitimate interest in keeping internal records, statistics, and the protection of our rights. The data is processed until a maximum of 10 years after the termination of the concluded contract (or longer in the event of a dispute), or for a maximum of 3 years after the collection of personal data if no contract has been concluded.
D.5 Service e-mails and push notifications
We use your contact details and device identifiers to send service-related emails and push or in-app notifications about your access, billing and essential changes to the service, so that you can use the App smoothly and stay informed about your plan and important updates.
For this purpose, we process these categories of personal data:
– Identifiers, Contact info.
The legal basis for this processing is our legitimate interest in informing users and ensuring proper operation of the App.
The data is processed only as long as strictly necessary to provide you with such e-mail or push notification (while using the App).
D.6 Newsletters and promotional communication
We process your contact data and basic usage or subscription information to send you newsletters and promotional messages about Kuba English and our App, such as information about new features (e.g. audiobooks, conversation modes, personal notebook), special prices, discounts and limited time offers for the App.
For this purpose, we process these categories of personal data:
– Contact info, Purchases information, Identifiers.
The legal basis for this processing is your freely given consent. You may withdraw this consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The data is processed for the period of mutual relationship, maximum up to 5 years from giving consent.
D.7 App diagnostics and analytics
We process your personal data also for the purpose of analytics and diagnostics of proper functionality of the App and ensure proper security of the App and improve the overall learning experience.
For this purpose, we process these categories of personal data:
– Identifiers, Usage data, Diagnostics data.
The legal basis for this processing is legitimate interest in monitoring performance, ensuring stability and improving the App.
Crash logs are retained for 90 days. Other analytics and diagnostic data are retained only as long as necessary for this purpose, at max for the duration of existing user profile.
D.8 Processing related to the cookies and technical functioning of App
D.9 App and website operation and security (a necessity)
We process your personal data for the operation of the App and its security, i.e. for the presentation of information in the App, the internal functioning of the App, your identification as a user when using and repeated visits to the App, and for ensuring your security. We use SDK-level identifiers in the App and essential cookies on the website to enable sign-in, load balancing, security, and other strictly necessary technical operations that allow you to access the Service, open lessons, track progress and maintain your account.
For this purpose, we process your:
– Usage data and Cookies data
The legal basis for this processing is performance of the contract, legitimate interest in the proper functioning and safe operation of our App. Data are processed, as a rule, for the duration of your visit the App, for a maximum of 1 year from the date of collection.
For this purpose, third party tools are also used, especially:
– Functional Software, Inc. – Monitoring of errors and exceptions (error tracking) via Sentry – Provider based in the United States. Personal data may be transferred outside the EU/EEA on the basis of SCCs as set out in Sentry’s data processing terms.
– Firebase Crashlytics – Crash reporting for the mobile app – Service provided by Google (Google Ireland Limited and US parent). Personal data may be transferred to the United States; such transfers are based on SCCs and/or the EU–US Data Privacy Framework, as described in Google’s data protection terms.
– Authorization platforms:
– Google OAuth – Login via Google account – Service provided by Google (Google Ireland Limited and US parent). Personal data may be transferred to the United States. Such transfers are based on SCCs and/or the EU–US Data Privacy Framework, as described in Google’s data protection terms.
– Apple Sign-In – Login via Apple ID – Service provided by Apple’s EU entity with possible involvement of Apple Inc. in the US. Personal data may be transferred to the United States; such transfers are based on SCCs and/or the EU–US Data Privacy Framework, as described in Apple’s data protection terms.
For the necessary cookies used on the website, please see cookie banner on the website.
D.10 Analysis of the App traffic (analytics) and of the website
With your consent, we may also process Cookies data for the purpose of analytics, which facilitates us to make more detailed analyses of your visits of the App (analytical cookies), in which case your personal data may also be transferred to third parties.
The legal basis for processing here is thus your consent. The personal data is processed until your consent is withdrawn, but in any case, until a maximum of 1 year after your visit to the App.
For this purpose, third party tools are also used, especially:
– Mixpanel, Inc. – Product analytics – Provider based in the United States. Transfers of personal data outside the EU/EEA (to the US) are based on the European Commission’s standard contractual clauses (SCCs) and/or the EU–US Data Privacy Framework, as described in Mixpanel’s data protection terms.
– Adjust GmbH – Attribution and ROAS measurement – EU-based provider; processing is primarily carried out within the EU/EEA.
– Google Ireland Limited – Firebase Analytics – Basic analytics for the app – Service provided by Google’s EU entity with possible involvement of Google LLC (US). Personal data may be transferred to the US; such transfers are based on SCCs and/or the EU–US Data Privacy Framework under Google’s data protection terms.
– Microsoft Ireland Operations Limited – Microsoft Clarity – Heatmaps and session recordings – EU-based Microsoft entity; personal data may be transferred to the US to Microsoft Corporation under SCCs and/or the EU–US Data Privacy Framework, as described in Microsoft’s data protection terms.
For analytics cookies used on the website, please see cookie banner on the website.
D.11 App support and promotion (marketing)
We process your personal data to obtain information about your personal preferences and to display relevant advertising. In doing so, we may promote and offer products and services on the App and show you marketing communications relating to the products and services you have enquired about and promote our brand online. We use identifiers such as hashed email addresses or advertising IDs to measure the performance of advertising campaigns for Kuba English (e.g. “Start Risk-Free Now” or limited soft-launch discount campaigns) and to support behavioral advertising on platforms like Meta, Google and TikTok.
For this purpose, we process your:
– Cookies data.
With your consent, we process information from cookies for this purpose, which facilitate our ability to get to know you better and to better target advertisements (marketing cookies), in which case your personal data may also be transferred to third parties. The legal basis for processing here is thus your consent given via the cookie bar. The personal data is processed until your consent is withdrawn, but in any case, until a maximum of 1 year after your visit the App.
For this purpose, third party advertisers are also used, especially:
– Meta Platforms Ireland Limited – Display and measurement of ads on Facebook and Instagram – EU-based Meta entity; personal data may be transferred to Meta Platforms, Inc. (US) and other group entities. Such transfers are based on SCCs and/or the EU–US Data Privacy Framework under Meta’s data protection terms.
– TikTok Technology Limited – Display and measurement of ads on TikTok – EU/UK-based entities; personal data may be transferred to third countries (incl. to the US and to group entities in other jurisdictions) on the basis of SCCs and other safeguards described in TikTok’s data protection terms.
– Google Ireland Limited – Online advertising platform (Search, YouTube, Display Network) – EU-based Google entity; personal data may be transferred to the US and other countries on the basis of SCCs and/or the EU–US Data Privacy Framework.
– Snap Inc. – Display and measurement of ads on Snapchat – US-based provider; personal data may be transferred outside the EU/EEA (incl. to the US) under SCCs and/or the EU–US Data Privacy Framework.
For marketing cookies used on the website, please see cookie banner on the website.
E. SHARING OF PERSONAL DATA
We do not transfer or disclose your information to third parties for purposes other than the ones provided in this Privacy policy (Part C).
At the same time, we may share personal information with third parties who help us provide our App to you. These parties act as our data processors and process personal data for us, within the scope of our processing purposes set out above. Those data processors may be:
– Payment processors processing payments within the App:
– Stripe Payments Europe – EU-based Stripe entity; personal data may be transferred to the US and other third countries. Such transfers are safeguarded by SCCs and, where applicable, the EU–US Data Privacy Framework as described in Stripe’s data transfer documentation.
– RevenueCat, Inc. – US-based provider; transfers of personal data outside the EU/EEA (to the US) are based on SCCs.
– Apple Distribution International Limited and Google Ireland Limited – EU-based entities.
– Klaviyo, Inc. – E-mail marketing and automation – US-based provider; transfers of personal data to the US are based on SCCs and/or the EU–US Data Privacy Framework as described in Klaviyo’s data protection terms.
– Google Cloud EMEA Limited – Cloud hosting and infrastructure provider – EU based company.
– OneSignal, Inc. – Mobile push notifications and email automation – US-based provider; transfers of personal data outside the EU/EEA (to the US) are based on SCCs and/or the EU–US Data Privacy Framework as set out in OneSignal’s DPA.
– OpenAI Ireland Ltd – AI text generation and speech-to-text/text-to-speech services – EU-based entity. Personal data may be transferred to the US and other third countries on the basis of SCCs and, where applicable, the EU–US Data Privacy Framework.
– Deepgram Inc. – Voice and speech services – US-based provider; transfers of personal data outside the EU/EEA are based on SCCs.
– Eleven Labs Inc. – AI text-to-speech – US-based provider; transfers of personal data outside the EU/EEA are based on SCCs.
– External service providers (tax, law, auditors).
Your personal information may also be shared with others, such as social or advertising networks, if we have obtained your consent for such sharing. Specifically, this includes Meta (Facebook, Instagram), TikTok, Google (Google Ads). Those third-party networks are mentioned in the Part C of the Privacy policy.
In addition to this, if we process your personal data for fulfilling legal obligations, we may share your personal data with certain third parties as data controllers for this purpose where we are obliged to do so under applicable legislation (in particular, administrative authorities, police authorities and judicial authorities). Similarly, we may be obliged to share your data with persons who claim to have been harmed by your conduct.
We require any third party with whom we share personal data, such as analytics tools, advertising networks and third-party SDK providers, to implement appropriate technical and organisational measures to protect personal data and to process your data only in accordance with our documented instructions and this Privacy Policy.
Where we share your personal data with controllers and processors in third countries (outside the EEA), we only do so where there is a decision by the European Commission that a particular country outside the EEA provides an adequate level of data protection, including where controllers or processors have adopted additional data protection measures such as Binding Corporate Rules (BCRs) or Standard Contractual Clauses (SCCs).
F. YOUR RIGHTS IN PROCESSING AND THE POSSIBILITY OF EXERCISING THEM
Just as we have rights and obligations when processing your personal data, you have certain rights when processing your personal data as set out in the following paragraphs. You have the right to (i) request access to your personal data; (ii) withdraw your consent; (iii) request rectification of your personal data; (iv) request erasure of your personal data; (v) request restriction of the processing of your personal data; (vi) request portability of your personal data; (vii) object to the processing of your personal data; or (viii) lodge a complaint with the relevant supervisory authority.
In all matters related to the processing of your personal data, whether it is a question, the exercise of rights, sending a complaint to our hands, etc., you can contact us at hello@kubaenglish.com.
Your request will be processed without undue delay, at most within 1 month. In exceptional cases, in particular due to the complexity of your request, we are entitled to extend this period by a further 2 months. We will, of course, always inform you of any such extension and the reason for it.
You also have the right to lodge a complaint with the supervisory authority as described below.
F.1 Right of access
You have the right to obtain confirmation from us as to whether or not we are processing your personal data.
If we process your personal data, you also have the right to request access to information about the purpose and scope of the processing, the recipients of the data, the duration of the processing, the right to rectification, erasure, restriction of processing and to object to the processing, the right to lodge a complaint with a supervisory authority and the sources of the personal data (this information is already provided in this document).
You can also ask us for a copy of the personal data we process. We provide the first copy free of charge; further copies may be subject to a fee. The scope of the data provided may be limited so as not to interfere with the rights and freedoms of others.
F.2 Right to withdraw consent
You have the right to withdraw your consent to the processing of personal data at any time. However, the withdrawal of consent does not affect the lawfulness of the processing prior to such consent, nor does it lead to the termination of the processing of personal data that has already been anonymized.
F.3 Right to repair
You have the right to request us to correct inaccurate personal data concerning you. Depending on the purpose of the processing, you may also have the right to have incomplete personal data completed, including by providing an additional declaration.
F.4 Right to erasure (right to be forgotten)
You have the right to request the deletion of your personal data in cases where:
– we no longer need your personal data for the purposes for which it was collected or processed;
– you withdraw the consent on the basis of which the personal data was processed and there is no further reason for processing it;
– you object to processing and there are no other overriding reasons for processing, or you object to processing for direct marketing purposes;
– personal data is processed in violation of the law.
However, you cannot exercise this right where the processing is necessary for compliance with our legal obligations or tasks entrusted to us in the public interest or for the establishment, exercise, or defense of legal claims.
F.5 Right to restriction of processing
You have the right to request restriction of the processing of your personal data in cases where:
– you contest the accuracy of your personal data; in this case, you may request a restriction of processing until the accuracy of the personal data has been verified;
– the processing is contrary to the law and instead of erasure, you request a restriction of the processing of personal data;
– we no longer need your personal data for the purposes for which it was collected or processed, but you require it for the establishment, exercise, or defense of legal claims;
– you have objected to the processing of your personal data; in this case, you may request a restriction of processing until it is verified that our legitimate interests prevail.
F.6 Right to portability
You have the right to obtain a copy of your personal data that we process by automated means on the basis of your consent or for the performance of a contract. We will transmit this data in a commonly used and machine-readable format to you or to a controller designated by you, if technically feasible. The scope of the data provided may be limited so as not to interfere with the rights and freedoms of others.
F.7 Right to object
You have the right to object to the processing of your personal data that we process on the basis of our legitimate interest. We will stop processing your data if there are no other overriding reasons for processing or if the processing is not necessary for the establishment, exercise, or defense of legal claims or if you object to processing for direct marketing purposes.
G. RIGHT TO FILE A COMPLAINT
In addition to the possibility of exercising your rights with our company, you can also file a complaint with the relevant supervisory authority, which is the Office for Personal Data Protection located at Pplk. Sochora 27, 170 00 Prague 7.
H. CHANGES TO THIS INFORMATION
We are entitled to change this processing information from time to time, so please check it regularly. We will post any changes to this document on our website.