Privacy notice
Eddyson CS Lab (“Eddyson CS Lab”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Polish data-protection law.
This Privacy Notice explains what personal data we collect, why we use it, how we protect it, how long we retain it, and your rights.
1. Who is responsible for your personal data?
The data controller is:
Eddyson Trading & Markets Research
Wola Luborzycka, Poland
NIP: 6821800986 · REGON: 524436074 · Business Register Number (CEIDG/KRS): 0001018771
Email: josh@eddysons.com
Eddyson CS Lab operates through eddysons.com.
If we appoint a Data Protection Officer or dedicated privacy contact, their contact details will be provided here.
2. What personal data do we collect?
When you request a diagnostic, book a session or enrol in our coaching programmes, we may collect:
- student’s name;
- parent’s or guardian’s name and contact details where applicable;
- email address;
- country of residence;
- time zone;
- curriculum and examination session;
- programming language used at school;
- information about your current Computer Science knowledge, challenges and learning goals;
- information provided during diagnostic assessments;
- booking and payment information;
- communications between you and Eddyson CS Lab;
- consent records, where processing is based on consent;
- technical and security information necessary to operate our website and services.
We do not require students to provide their full date of birth unless this becomes necessary for a specific and clearly explained purpose.
You should not provide unnecessary sensitive personal information through our forms or communications.
Where you voluntarily provide accessibility or learning-support information, we may process it only to the extent necessary to adapt our services appropriately and on an applicable lawful basis. Where such information constitutes special-category personal data under Article 9 GDPR, we will process it only where an appropriate Article 9 condition applies.
3. How do we use your personal data?
We use personal data for purposes including:
- providing Computer Science diagnostics and coaching;
- arranging and managing lessons and bookings;
- tailoring teaching, feedback and learning support;
- communicating with students, parents and guardians;
- processing payments and maintaining transaction records;
- issuing invoices and complying with accounting and other legal obligations;
- maintaining the security and functionality of our website and services;
- responding to enquiries and providing customer support;
- preventing misuse, fraud or security incidents;
- maintaining appropriate business and legal records;
- sending marketing communications where you have provided the required consent.
We do not sell personal data.
4. Legal bases for processing
Depending on the purpose, we process personal data on one or more of the following legal bases under Article 6 GDPR:
- Performance of a contract – Article 6(1)(b): where processing is necessary to provide diagnostics, lessons, coaching or other services you have requested.
- Legal obligation – Article 6(1)(c): where processing is necessary to comply with accounting, tax or other legal requirements.
- Legitimate interests – Article 6(1)(f): where processing is necessary for legitimate business purposes such as maintaining service security, preventing fraud, protecting our rights and improving the operation of our services, provided that these interests do not override your rights and freedoms.
- Consent – Article 6(1)(a): where we ask for your consent for a specific optional purpose, such as certain marketing activities or other processing where consent is required.
Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Where special-category personal data is processed, an additional legal condition under Article 9 GDPR will apply where required.
5. Where is your data stored and who processes it?
We use selected third-party technology providers to operate Eddyson CS Lab, including:
- Supabase – database, authentication and related infrastructure;
- Stripe – payment processing;
- Resend – transactional email delivery;
- our hosting, analytics, security and other technology providers where applicable.
These providers may process personal data on our behalf and are required to handle it in accordance with applicable data-protection requirements and our instructions where they act as processors.
Details concerning our hosting providers, relevant sub-processors, processing locations and international data transfers will be provided in our Sub-processor and International Transfer Information section.
Where personal data is transferred outside the European Economic Area, we will ensure that an appropriate GDPR-compliant transfer mechanism and safeguards are in place where required.
6. How long do we keep your data?
We retain personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by applicable law.
Different categories of information may therefore be retained for different periods.
Our retention schedule will specify the applicable periods for categories such as:
- customer and student account information;
- booking and coaching records;
- diagnostic records;
- payment and accounting records;
- communications and support records;
- consent records;
- marketing information.
When personal data is no longer required, we will securely delete or anonymise it unless we are legally required to retain it.
7. Children’s and students’ data
Eddyson CS Lab provides educational services that may be used by students under 18.
Where a student is under 18, we require a parent or legal guardian to participate in the enrolment process and provide the relevant contact details and authorisations required for the service.
We aim to collect only information that is reasonably necessary to provide the educational service and to avoid collecting unnecessary information about children.
We do not require a student’s full date of birth as part of ordinary enrolment.
Parents or legal guardians may contact us regarding the personal data of a student for whom they have parental responsibility, subject to appropriate verification.
8. Your data-protection rights
Subject to the conditions and limitations established by the GDPR, you may have the right to:
- access your personal data;
- obtain a copy of your personal data;
- correct inaccurate or incomplete personal data;
- request deletion of your personal data;
- request restriction of processing;
- object to certain processing;
- withdraw consent where processing is based on consent;
- request data portability where the legal requirements for portability are met;
- lodge a complaint with a supervisory authority.
To exercise your rights, contact:
We may need to verify your identity before responding to a request.
We will normally respond to valid data-subject requests within one month, subject to the conditions and extensions permitted by the GDPR.
9. Right to complain
If you believe that we have processed your personal data unlawfully, you have the right to lodge a complaint with the relevant data-protection supervisory authority.
For Poland, the supervisory authority is the:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych / UODO)
ul. Stanisława Moniuszki 1A
00-014 Warszawa
Poland
You may also contact your local supervisory authority if you are located in another EU/EEA country.
UODO recommends that individuals normally contact the controller first so that the matter can be addressed directly.
10. Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration or unlawful processing.
No internet-based service can guarantee absolute security, but we take reasonable measures appropriate to the nature and risks of the personal data we process.
11. Updates to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services, technology, legal requirements or data-processing practices.
The latest version will always be published on eddysons.com with the version and effective date shown above.