Privacy Policy

This policy explains how I process personal data when you visit the website, contact me or take Italian lessons with me. The EU General Data Protection Regulation (GDPR) and applicable Italian data-protection law apply.

Data controller

The controller responsible for your personal data is:

Viktoriia Laskina
Self-employed professional under the Italian flat-rate tax regime
Verona, Veneto, Italy
viktoriialaskina@gmail.com
Partita IVA / VAT: IT05230550237

Lessons are delivered entirely online and there are no premises open to the public. For any question about personal data, use the email address above.

Data I may process

The data processed depends on how you use the website and my services:

Website technical data. Vercel, the hosting provider, may process IP address, date and time, requested page, device information and security logs needed to deliver and protect the website.
Enquiries and communications. If you contact me by email, Telegram or another channel linked from the website, I process your contact details, message content and any information you choose to share so I can reply.
Bookings and lessons. I process name, age range, language, level, goals, availability, appointments, attendance, exercises, learning materials and teaching notes needed to organise and provide lessons.
Payments and tax records. Payments take place outside the website by bank transfer, including where Wise is used to initiate the transfer. I may process the payer name, amount, date, payment reference and data needed for receipts, invoices and tax compliance. No payment-card details are collected on the website.
Reviews and testimonials. If you authorise publication of a testimonial, I may process the agreed name or public name, review text, lesson language and format, study period, frequency, progress and source. I publish only the information agreed with you.
Usage data, with consent. When you enable Analytics, Google Analytics 4 may process online identifiers, visited pages, events, approximate location, device information and page interactions.
Advertising data, with consent. When you enable Marketing, Google Ads and Meta Pixel may process online identifiers, visits, conversions and attribution information to measure campaigns, build audiences and, where permitted, personalise advertising. Their tags are managed through GTM and remain blocked before consent.

How I receive data

I receive data directly from you, from a parent or guardian where necessary, from the device used to visit the website, and from providers you use to communicate, attend lessons or make a payment. A review published on another platform is reused on this website only with your authorisation.

Purposes and legal bases

I process data only for defined purposes and under a GDPR legal basis:

Replying to enquiries and arranging a trial. Steps taken at your request before entering a contract.
Providing lessons, materials, support and schedule management. Performance of the contract.
Managing bank transfers, accounting records and tax obligations. Performance of the contract and compliance with legal obligations.
Protecting the website, preventing abuse and defending legal rights. Legitimate interests in security and legal protection, balanced against your rights.
Publishing a testimonial on the website and in related structured data. Your consent, which you may withdraw at any time without affecting processing carried out before withdrawal.
Measuring and improving the website with GA4. Your consent, which you may withdraw at any time.
Measuring and personalising Google Ads and Meta campaigns. Your separate consent to Marketing, which you may withdraw at any time.

Required and optional data

Requested contact, organisational and payment data is needed to reply, enter into or perform the teaching relationship. Without it, I may be unable to organise lessons. Analytics, Marketing and testimonial publication are always optional: refusing them does not limit access to the website or lessons.

Providers and recipients

Only providers needed for the stated purpose may receive data, acting as processors, sub-processors or independent controllers depending on the service:

Hosting and security: Vercel.
Email, tag management, analytics, video lessons, notes and Google services: Google (Gmail, Google Meet, Tag Manager, Analytics, Ads and Drive; Google Ads processes data only with Marketing consent).
Messaging and social media: Telegram and Meta for Facebook, Threads and Meta Pixel; the Pixel processes data only with Marketing consent.
Lessons and materials: VK, Telemost, Holst, Wordwall and Quizlet when selected for a lesson.
Published testimonials: Website visitors and search engines, limited to the information you authorised for publication.
Payments: Banks involved in a transfer and Wise if it is used to initiate the transfer.
Professional compliance: Accountants, advisers or public authorities where necessary or required by law.

I do not sell personal data. External links open services governed by their providers’ own privacy notices.

Main provider notices: Vercel (opens in a new tab) , Google (opens in a new tab) , Telegram (opens in a new tab) , Meta (opens in a new tab) , Wordwall (opens in a new tab) , Quizlet (opens in a new tab) , Wise (opens in a new tab) .

International transfers

Some providers operate or store data outside the European Economic Area. Where an international transfer occurs, the provider and controller must use a GDPR mechanism such as an adequacy decision, the EU–US Data Privacy Framework where applicable, or standard contractual clauses together with any necessary supplementary safeguards.

Retention periods

Enquiries that do not become lessons: up to 12 months after the last contact, unless needed to protect legal rights.
Teaching and organisational data: for the relationship and normally up to 24 months after the last lesson, unless you request deletion or the data is needed to protect legal rights.
Accounting and tax data: for the period required by applicable law, normally 10 years.
Technical logs: for the minimum period needed for security and under the hosting provider’s settings.
Published testimonials: until consent is withdrawn or the testimonial is no longer used; evidence of consent may be kept as long as needed to demonstrate that publication was lawful.
Google Analytics 4: user-level data will be retained for 14 months to analyse consented return visits across a year; other event-level data will be retained for 2 months. The retention period will not reset with each new activity. Google may keep standard aggregate reports for longer.
Consent choice: in your browser for no more than 180 days, unless you delete it or the purposes change materially.

Students under 18

Lessons are offered to students aged 16 and over. For a student under 18, I may ask a parent or guardian to take part in agreements, payments and necessary communications. Please do not send sensitive data that is not needed for the lesson.

Automated decision-making

I do not make solely automated decisions that produce legal or similarly significant effects. Advertising tools may create segments or measure campaigns only after Marketing consent.

Cookies and preferences

For details about identifiers, categories and withdrawing consent, read the Cookie Policy.

Your rights

Where the GDPR provides, you may request:

access to your data and a copy
correction of inaccurate data
erasure
restriction of processing
data portability
objection to processing based on legitimate interests
withdrawal of consent without affecting processing carried out before withdrawal

To exercise a right, email viktoriialaskina@gmail.com. You may also lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali.

Changes to this policy

I will update this policy when services, providers or purposes change. If a change affects consent, the website will ask for your choice again.

Last updated: 19 October 2026