Data protection

1. Why GDPR applies

Alin Li OÜ is an Estonian company, so the EU General Data Protection Regulation applies to the personal data we handle about students (including children), parents, clients and staff. This page summarises our internal data protection policy. For what we collect, why, how long we keep it and how to exercise your rights, read our privacy notice.

2. Principles we work by

• Lawful, fair and transparent: we have a lawful basis for each use of data and tell people about it.
• Purpose limitation: enrolment data is not used for unrelated marketing.
• Minimisation: we collect the least we need.
• Accuracy: we correct records when told they are wrong.
• Storage limitation: we delete data on a retention schedule.
• Security and accountability: we protect data and can show how we comply.

3. Children’s data

For learners below the age of digital consent, we rely on verifiable consent from a parent or legal guardian. Photo and media consent is requested separately. See also our child safety and safeguarding statement.

4. Service providers

We use third-party services that handle personal data only where they meet GDPR requirements, and we put data processing agreements in place with them.

5. Your rights

You can ask to access, correct or delete your personal data. We verify the identity of the requester (or that they are the child’s parent or guardian) and respond within one month, as the GDPR requires. The privacy notice explains how to make a request.

6. Data breaches

Any suspected breach is contained and reported internally at once. Where a breach is notifiable, we report it to the supervisory authority within 72 hours and inform the people affected if there is a high risk to them.

Questions: Info@AlinLi.com.