Privacy Policy
Version / last updated: 3 November 2026. This notice applies from the moment you sign up.
This Privacy Policy explains how your personal data is handled when you use englisylessons.com and take online English lessons with me. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Italian Privacy Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, "Codice privacy").
I have tried to keep it short and in plain, clear English that younger students can understand too (Art. 2-quinquies(2) Codice privacy). If anything is unclear, just email me at info@englisylessons.com.
1. Who is responsible for your data (the "controller")
Amir H. Moghisi, individual English tutor
Via Bontempi 4, 06122 Perugia (PG), Italy
Email: info@englisylessons.com
VAT number and tax code: see the Legal Notice.
I am a sole tutor, so "I", "me" and "my" in this policy mean the controller named above. I have not appointed a Data Protection Officer, because the law does not require one for an activity of this size (Art. 37 GDPR).
2. What data I collect
| Category | What exactly | Where it comes from |
|---|---|---|
| Account data | Name, email address, password (stored only as a secure hash — I can never see it) | You, at sign-up |
| Onboarding / needs-analysis data | Age range, current English level, learning goals, exam plans (e.g. Cambridge, IELTS), lesson preferences; for students under 14: the parent/guardian's name and their consent | You (or your parent/guardian) via the onboarding form |
| Lesson notes | Homework, vocabulary lists, grammar mistakes and progress notes I write for each student | Me, during and after lessons |
| Booking data | Name, email address, lesson date/time, any message added to the booking, whether the lesson is part of a weekly series, who made the booking (you or me), and which credit or pack paid for it | You, when booking on the Englisy website, or me, when I book a lesson we have agreed for you; the booking is then added as an event (with the Google Meet link) to my Google Calendar |
| Purchase and billing data | Which lesson pack you bought, amount, date, payment status, billing name and address, and tax code (codice fiscale) where Italian law requires it for invoicing. For a bank transfer: your name, the IBAN/account details of the paying account, bank name, amount, date and payment reference. I never see or store your full card details — when you pay by card, Stripe handles those | You / your bank via the transfer; or you, via Stripe Checkout; Stripe (and PayPal, Apple Pay or Google Pay if you pay with them) |
| Lesson credit data | Number of credits bought, used, cancelled or remaining; trial lesson status | Generated by the site |
| Employer / organisation data | Your name, work email and the package you're enrolled in | Your employer (your name, work email and the package you're enrolled in) |
| Correspondence | Emails you send to info@englisylessons.com and my replies | You |
| Technical data | IP address, browser type, date/time of requests, error logs; the login session and other technical storage in your browser (see the Cookie Notice). The country you connect from, derived from your IP address, is used only to show Italian visitors the Italian version of the site automatically; I do not store it | Your device, automatically |
| Video lesson data | Your name/username and the audio/video stream during the live lesson on Google Meet. Lessons are not recorded. | You, during lessons |
I do not ask for special categories of data (health, religion, etc.). Please do not include them in forms or notes. If you choose to tell me about something like a learning difficulty so I can adapt lessons, I will use it only for that purpose, on the basis of your (or your guardian's) explicit consent (Art. 9(2)(a) GDPR), and you can ask me to delete it at any time.
3. Why I use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account; letting you log in | Performance of a contract (Art. 6(1)(b)) |
| Understanding your needs and planning lessons (onboarding form) | Performance of a contract / pre-contractual steps you request (Art. 6(1)(b)) |
| Giving lessons, writing lesson notes, setting homework, tracking progress | Performance of a contract (Art. 6(1)(b)) |
| Booking, rescheduling and cancelling lessons; managing credits and the free trial (one per student) | Performance of a contract (Art. 6(1)(b)); for the "one trial per student" check, my legitimate interest in preventing misuse (Art. 6(1)(f)) |
| Processing payments and refunds | Performance of a contract (Art. 6(1)(b)); for payment and accounting records, also legal obligation (Art. 6(1)(c)) |
| Issuing invoices/receipts and keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) — Italian tax and civil-law rules |
| Sending service emails (account confirmation, password reset, booking and purchase confirmations, important changes) | Performance of a contract (Art. 6(1)(b)) |
| Answering your emails and questions | Pre-contractual steps / contract (Art. 6(1)(b)), or my legitimate interest in replying to people who contact me (Art. 6(1)(f)) |
| Collecting the consent of a parent/guardian for students under 14 | Consent given by the holder of parental responsibility (Art. 6(1)(a) and Art. 8 GDPR; Art. 2-quinquies Codice privacy), and legal obligation to be able to prove it (Art. 7(1) GDPR) |
| Keeping the website and accounts secure; preventing fraud and abuse | Legitimate interest (Art. 6(1)(f)) |
| Defending or exercising legal rights | Legitimate interest (Art. 6(1)(f)) |
No marketing, no profiling. I do not send newsletters or promotional emails, I do not sell your data, and I do not use advertising or tracking tools. The only statistics I look at are visitor counts from Netlify Analytics (see below). No decisions about you are made by automated means, including profiling (Art. 22 GDPR). If I ever want to send you a newsletter, I will ask for your separate consent first.
Visitor statistics. To see how many people visit the site and which pages they read, I use Netlify Analytics. It works on Netlify’s servers from the normal server logs (IP address, page requested, date and time, browser type, referring site). It uses no cookies and no tracking script, and nothing is stored on your device. I only see totals (for example visits per day, top pages, referring sites), never individual visitors, and I don’t combine this with your account data. Legal basis: my legitimate interest in understanding how the site is used and keeping it working (Art. 6(1)(f) GDPR). You can object at any time (see Your rights).
Do you have to give me your data? Account, onboarding and billing data are needed to provide lessons and comply with tax law; without them I cannot offer the service. Anything marked "optional" in a form is up to you.
4. Children and teenagers
My lessons are open to adults and to minors.
- Students aged 14 to 17 can create an account and, where processing is based on consent, give that consent themselves, as allowed by Art. 2-quinquies of the Italian Privacy Code. However, purchases must be made by a parent or legal guardian (see the Terms and Conditions).
- Students under 14: a parent or legal guardian must give their name and consent on the onboarding form before lessons start. I may contact the parent/guardian to confirm. If I find out that an account for a child under 14 was created without this consent, I will suspend it and delete the data.
- For minors I collect only what I need to teach (I ask for an age range, not a date of birth). Lesson notes are about learning — vocabulary, grammar, homework — not about personal life.
- Parents/guardians of students under 14 can exercise all the rights in section 8 on the child's behalf, and can ask me at any time what data I hold about their child.
If your employer pays for your lessons
If your lessons are part of a corporate package bought by your employer (or another organisation), I share some information about your lessons with that organisation's authorised HR contacts through a private company page.
Where your data comes from. If your employer enrolled you, it gave me your name and work email so I could create your account and send you an invitation. If you don't set a password within 60 days, I delete these details and tell your employer the invitation has expired.
- Always shared: your name and work email, your attendance for each lesson (attended, rescheduled, cancelled, late-cancelled or missed), your upcoming lessons and the hours you have used. Legal basis: my legitimate interest, and the organisation's, in managing the lesson package it has paid for, and the performance of my contract with it (Art. 6(1)(b) and (f) GDPR).
- Shared only if you agree: your lesson goals, the progress report I write after each lesson (goal, what we did, strengths, things to work on, next steps) and your level progress. Legal basis: your consent (Art. 6(1)(a) GDPR). Saying no has no effect on your lessons, and you can withdraw consent at any time in your account settings. From then on HR no longer sees this information.
- Never shared: my private teaching notes, your messages to me, and anything about lessons you pay for yourself.
Once your employer has received this information, it uses it as an independent controller under its own privacy notice. I ask employers to use it only to manage the training they pay for. When the corporate package ends, or you leave the programme, HR access to your information stops. Your own account stays yours.
5. Who I share your data with
I do not sell or rent your data. I share it only with the service providers below, who process it on my behalf and on my instructions as processors under a data processing agreement (Art. 28 GDPR), or — where stated — as independent controllers.
| Provider | What they do | Where data is processed | Transfer safeguard (if outside the EEA) |
|---|---|---|---|
| Supabase Inc. (USA) | Database and user accounts (login, profiles, onboarding answers, lesson notes, credits) | EU — Frankfurt, Germany (AWS eu-central-1). Limited support/maintenance access from outside the EEA is possible | Standard Contractual Clauses (SCCs) in Supabase's DPA |
| Netlify, Inc. (USA) | Website hosting and delivery; visitor statistics (Netlify Analytics) | EU and USA (global content delivery network) | EU-U.S. Data Privacy Framework (DPF) where Netlify is certified, and/or SCCs |
| Stripe — Stripe Payments Europe, Limited (Ireland) and its affiliates incl. Stripe, Inc. (USA) | Payment processing, refunds, fraud prevention. For fraud prevention and its own legal obligations (e.g. anti-money-laundering), Stripe acts as an independent controller — see stripe.com/privacy | EU and USA | DPF and SCCs |
| Wise Europe SA (Brussels, Belgium) | Receives bank transfers as my payment-account provider (Wise euro account). Wise acts as an independent controller under its own privacy notice (wise.com/privacy). I receive the transfer details needed to match your payment | EU (Belgium). Wise may also process data in the UK and/or USA under its own safeguards | Wise's own safeguards for any UK/USA processing (see wise.com/privacy) |
| PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg); Apple (Apple Pay) and Google (Google Pay) | Only if you choose one of these at checkout: they process your payment as independent controllers under their own privacy policies (paypal.com, apple.com/legal/privacy, policies.google.com/privacy). I receive only the payment confirmation, not your account or card details | EU and USA | DPF and SCCs |
| Brevo ("Brevo" SAS, RCS Paris 498 019 298, 9-17 rue Salneuve, 75017 Paris, France) | Sending transactional emails from info@englisylessons.com (sign-up confirmation, password reset, booking and purchase emails) | EU | Not needed (EU) |
| ImprovMX Incorporated (USA) | Forwarding emails sent to info@englisylessons.com to my mailbox | France (AWS Paris) and USA | SCCs in ImprovMX's DPA |
| Google — Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) | Google Calendar (lesson booking events) and Gmail (the mailbox where info@ emails arrive) | EU and USA | DPF and SCCs |
| Google Meet — Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) | Live video lessons | EU and USA | DPF and SCCs |
| Your employer's authorised HR contacts | Managing the corporate lesson package | as described in "If your employer pays for your lessons" | Independent controller |
I may also disclose data to my accountant (commercialista), who processes invoicing and tax data as required by law, and to public authorities when the law requires it.
International transfers. Where data leaves the European Economic Area, it is protected by an adequacy decision of the European Commission — such as the EU-U.S. Data Privacy Framework (Commission Implementing Decision of 10 July 2023) for certified US companies — or by the Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) (Arts. 45–46 GDPR). You can ask me for more information or a copy of the relevant safeguards at info@englisylessons.com.
6. How long I keep your data
| Data | How long |
|---|---|
| Account and onboarding data | While your account is active. If you close your account, I delete it within 30 days. Accounts unused for 24 months (no log-in and no lessons) are deleted after an email warning |
| Lesson notes | While your account is active, then deleted together with your account, within 30 days (sooner if you ask) |
| Parent/guardian consent records | While the child's account is active, and then for as long as needed to prove the consent was given — up to 5 years after the account is closed (only the record of who gave consent, when, and for which wording; no lesson data) |
| Invoices, payment records and the checkout confirmations (T&C acceptance, request to start lessons) | 10 years, as required by Italian law (Art. 2220 Civil Code; Art. 22 DPR 600/1973) |
| Corporate package records (attendance and hours used) | 10 years, as accounting records for the invoice to the company |
| Unused invitations from an employer | Deleted after 60 days if the account is never activated |
| Booking data in Google Calendar | 24 months after the lesson |
| Emails | 24 months after the conversation ends, unless needed for an open issue |
| Technical logs | According to Netlify's and Supabase's standard log retention (usually a few days to a few weeks) |
Data may be kept longer only if needed to establish, exercise or defend a legal claim, and only for that purpose.
7. How I protect your data
Data is stored with reputable providers using encryption in transit (HTTPS) and at rest. Passwords are stored as hashes. Database access is restricted with row-level security so each student can see only their own data. I am the only person with administrator access. If a data breach is likely to put your rights at risk, I will notify the Garante and, where required, you (Arts. 33–34 GDPR).
8. Your rights
Under Articles 15–22 GDPR you can, free of charge:
- access your data and get a copy;
- correct inaccurate or incomplete data;
- delete your data ("right to be forgotten"), unless I must keep it by law (e.g. invoices);
- restrict processing in certain cases;
- receive your data in a portable format (e.g. your lesson notes) or have it sent to someone else;
- object at any time, on grounds relating to your particular situation, to processing based on my legitimate interest (Art. 21 GDPR);
- withdraw consent at any time (e.g. a guardian's consent), without affecting processing done before the withdrawal.
To exercise any right, email info@englisylessons.com. I will reply within one month (extendable by two months for complex requests, in which case I will tell you why). I may ask you to confirm your identity.
Complaints. If you think your data is handled unlawfully, you can lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it (Art. 77 GDPR; Art. 141 Codice privacy) — or with the authority of the EU country where you live or work. I'd appreciate the chance to fix things first, so please feel free to email me.
9. Cookies
This site uses only strictly necessary and functional technical storage (your login session, your language choice, and Stripe's payment security at checkout). No advertising or tracking, and no analytics cookies (the visitor statistics described above use no cookies). Details are in the Cookie Notice.
10. Changes to this policy
If I change this policy, I will update the date at the top. If the change is significant, I will tell registered users by email before it applies.