Livetea.ch Privacy Policy and Data Processing Agreement

Livetea.ch ("we," "us," or "our") respects your privacy and processes personal data responsibly. This document outlines how we handle personal data collected through Livetea.ch (the "Service") and explains the terms under which personal data is processed. It applies to all user roles ("Teachers," "Students," "Managers," and "Parents") who use Livetea.ch under the Terms and Conditions ("Terms") agreed upon registration.

1. Information Collection

1.1 Personal Information You Provide

• Registration Data: When creating a user account, we collect your name, email address, and user role (Teacher, Student, Manager, or Parent).
• Social Media Login: If you register using Facebook or Google, we receive the name and email associated with that account.
• Manager-Provided Data: If your account is managed under a multi-user subscription (e.g., Online Tutor, Online School, Online Campus), your Manager may provide us with your name and email address.

1.2 Payment Information

When purchasing a subscription, we collect transaction details, including payment methods and billing addresses. Sensitive payment information such as credit/debit card numbers is processed exclusively by PCI-DSS 3 certified payment gateways (e.g., PayPal or Espago or Stripe). Livetea.ch does not directly store or access full card numbers.

1.3 Usage Data

We collect information regarding your interaction with our Service, including session activity, accessed lessons or resources, student management data, and attendance frequency in virtual sessions.

1.4 Analytics Data

We use Google Analytics to collect logs of visits and interactions, including IP addresses, browser types, visited pages, and timestamps, to analyze and enhance our platform. We use the Hotjar service solely to record selected sessions in order to better optimize user journeys within the application and provide improved incident support.

2. Use of Collected Information

2.1 Service Improvement

Collected data helps us understand your interaction with our features, develop new tools, enhance existing functionalities, and improve the overall educational experience.

2.2 Communication

We may send you communications about service updates, new features, or relevant educational content. Users opting into newsletters may receive periodic emails with resources or platform tips, with the option to unsubscribe at any time.

2.3 Safety and Security

Data is utilized to verify accounts, investigate potential security breaches, and enforce compliance with our Terms.

2.4 Problem Resolution

Device and network data help us diagnose and resolve technical issues experienced during Service usage.

3. Data Processing Terms

3.1 Scope and Role

Livetea.ch, operated by Lingua House sp. z o.o., acts as both controller and processor of personal data collected upon user registration.

3.2 Processed Personal Data

Processed data includes name, email, payment details (payment method, bank account number, billing address, IP address), and user-defined role to personalize services and process payments.

3.3 Purpose and Duration

Personal data is processed:

• Solely to provide services, comply with fiscal obligations, or establish, exercise, or defend legal claims;
• Only as long as necessary for these purposes.

3.4 Data Transfer and Third Parties

We do not commercially transfer personal data to third parties. Data is shared with external processors only to fulfill fiscal obligations.

4. User Rights

Users have the right to:

• Confirm if their data is processed and obtain details regarding processing purposes, data categories, recipients, retention periods, data sources, and automated decision-making;
• Access, rectify, or erase personal data;
• Withdraw consent at any time by deleting their account;
• Request data processing restrictions;
• Receive personal data in a structured, machine-readable format to transfer to another controller;
• Lodge a complaint with the supervisory authority regarding data processing.

5. Data Security

We implement appropriate technical and organizational measures to protect personal data. In case of a data breach posing significant risk, we will notify affected users and relevant authorities promptly, within 72 hours.

6. Google User Data

Livetea.ch offers an optional Google Calendar integration. This section explains specifically how we access, use, store, share, and delete data obtained through Google APIs, and applies in addition to the rest of this policy.

6.1 Google Data We Access

We request only the minimum scopes required for the integration to function, and all of them are read-only:

• calendar.calendarlist.readonly — the list of calendars in your Google Account, so that you can choose which calendar to connect.
• calendar.events.readonly — the events on the calendar you connect, so that your existing commitments are visible alongside your Livetea.ch lessons.

Both scopes are read-only. Livetea.ch cannot create, modify, or delete any event in your Google Calendar. If you sign in with Google, we additionally receive the name and email address associated with your Google Account, as described in section 1.1.

6.2 How We Use Google Data

Google Calendar data is used for one purpose only: to display your existing calendar events inside Livetea.ch and to avoid scheduling conflicts when lessons are booked. We do not use it for any other feature or purpose.

6.3 How We Store and Protect Google Data

• Credentials. The OAuth access and refresh tokens issued by Google are encrypted before they are written to our database, using AES-256-GCM authenticated encryption with a key held outside the database. Tokens are never exposed to your browser, are not written to application logs, and are decrypted in memory only for the duration of a request to the Google Calendar API.
• Transport. All traffic between your browser, Livetea.ch, and Google is encrypted in transit using HTTPS/TLS.
• Synchronised event data. For each connected calendar we store a copy of the event fields needed to render your schedule: title, start and end time and time zone, recurrence rule, status, the event identifier assigned by Google, and, where present, location, description, meeting link, and attendee names and email addresses. This copy exists so that your calendar can be displayed without querying Google on every page load.
• Access control. Access to production systems holding Google user data is restricted to authorised personnel on a need-to-know basis.
• Breach handling. Google user data is covered by the breach notification commitment described in section 5.

6.4 Sharing and Transfer of Google Data

We do not sell Google user data, and we do not transfer it to data brokers, information resellers, advertising networks, or any other third party for their own purposes. Google user data is never used for advertising of any kind, for determining credit-worthiness, or for lending purposes. It is not transferred to any third party except where strictly necessary to provide the integration to you, where you direct us to do so, or where we are required to do so by law.

6.5 Retention and Deletion of Google Data

You may disconnect your Google Calendar at any time from the calendar settings in your Livetea.ch account. When you disconnect:

• we ask Google to revoke the access and refresh tokens we hold, so that our access ends immediately;
• we stop all change notification channels registered with Google;
• we permanently delete our stored copy of your synchronised calendar events; and
• we erase the stored credentials from our records.

You may also revoke Livetea.ch's access directly from your Google Account at myaccount.google.com/permissions. Deleting your Livetea.ch account, as described in section 7, removes Google user data together with the rest of your personal data.

6.6 Limited Use

Livetea.ch's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not use Google user data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models. No human reads your Google user data unless (a) you have given explicit consent for specific data, (b) it is necessary for security purposes such as investigating abuse, (c) it is required in order to comply with applicable law, or (d) the data has been aggregated and anonymised for internal operations.

7. Account Management and Deletion

You can access and manage your personal details anytime in your profile area. To delete your account, use the "Request Account Deletion" option in your profile. Personal data will be removed unless legally required retention applies. Subscription cancellations will end after the current billing cycle unless renewed.

8. Policy Updates

We may update this policy periodically. Users will be notified via the email linked to their account of any significant changes.

9. Contact Information

For questions regarding this policy or your personal data, please contact:

Acknowledgment

By continuing to use Livetea.ch, you acknowledge that you have read, understood, and agree to this Privacy Policy and Data Processing Agreement.