Privacy Policy

1. Who We Are and Our Responsibilities

The Controller responsible for the processing of your personal data is:

• Lovely Academy OÜ
• Registry Code: 14354368
• Registered Address: Punane tn 16-1/503, 13619 Tallinn

For all questions regarding the processing of your data and the exercise of your rights, please contact our Data Protection Officer:

• E-mail: privacy@lovelyacademy.ee

2. What Personal Data We Collect and Process

We collect only the data necessary to provide you with high-quality educational services.

• Enrollment and Contact Data: Your first name, last name, email address, phone number, chosen language of instruction, and course information.
• Document Processing Data: Date of birth and/or personal identification code (isikukood), if required by law for the issuance of an official certificate or completion reference.
• Educational Data: Information regarding your attendance, test results, practical assignment outcomes, exam protocols, as well as the number and date of the document issued to you (certificate or reference).
• Payment Data: Details necessary for invoicing, as well as information regarding the fact of payment (amount, date, method). Important: we do not collect or store your bank card details on our website. All payments are processed through secure payment gateways.
• Communication Data: The history of your correspondence with us via email or website forms, as well as your reviews, survey responses, and feedback questionnaires.
• Technical Data: IP address, browser and device type, cookies, and similar technologies that help us ensure the website functions correctly and improve it. Read more about this in our Cookie Policy.

3. Purposes and Legal Bases for Processing

We process your data strictly in accordance with legislation, including the General Data Protection Regulation (GDPR).

• For the conclusion and performance of a contract (Basis: Article 6(1)(b) GDPR): Processing your training application, enrolling you in a course, organizing the learning process, assessing knowledge, and issuing certifying documents.
• For compliance with legal obligations (Basis: Article 6(1)(c) GDPR): Accounting (processing invoices and payments), as well as storing educational documentation for periods established by law.
• For our legitimate interests (Basis: Article 6(1)(f) GDPR): Analyzing course demand to improve our programs, ensuring the security of the learning process, and defending our rights in the event of disputes.
• With your consent (Basis: Article 6(1)(a) GDPR): Sending marketing materials, news, and special offers. Publishing your reviews, photos, or videos from training events.

You may withdraw your consent at any time by writing to us. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4. Who We May Share Your Data With

We do not sell your data. We may transfer it to trusted partners (processors) who help us provide services. We have a Data Processing Agreement (DPA) with each such partner, obliging them to protect your data. These partners include:

• Hosting and cloud service providers;
• Email marketing services and CRM systems;
• Accounting and legal services.

5. How Long We Keep Your Data

We do not keep your data longer than necessary for the purposes for which it was collected:

• Enrollment data and correspondence: up to 2 years after the end of your training or last contact.
• Training protocols and registries of issued documents: at least 5 years.
• Accounting documents: 7 years in accordance with Estonian legislation.

After these periods expire, data is securely deleted or anonymized.

6. Your Rights Regarding Personal Data

You have the following rights:

• Right of access: To request a copy of the data we hold about you.
• Right to rectification: To request the correction of inaccurate or incomplete data.
• Right to erasure («right to be forgotten»): To request the deletion of your data if there are no longer legal grounds for keeping it.
• Right to restriction of processing: To ask us to temporarily stop processing your data.
• Right to data portability: To receive your data in a structured format.
• Right to object: To object to the processing of your data based on our legitimate interests.
• Right to withdraw consent: If processing is based on consent, you may withdraw it at any time.

To exercise these rights, please send a request to privacy@lovelyacademy.ee. We will respond within 30 days. You also have the right to lodge a complaint with the supervisory authority — the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

7. How We Protect Your Data

We take all necessary technical and organizational measures to protect your data: we use encryption (SSL), restrict data access to authorized personnel, regularly create backups, and work only with verified contractors.

8. Processing Data of Minors

Our courses are intended for persons over 16 years of age. For persons aged 16 to 18, written consent from parents or legal guardians is required.

9. Use of Photos, Videos, and Reviews

We publish your photos, videos from events, or text reviews only with your prior written consent. You may withdraw this consent at any time by contacting us.

10. Changes to This Policy

We may update this Policy. The current version will always be available on our website with the date of the last update.