Privacy Policy

Introductory provisions

This Privacy Policy (hereinafter: the Policy) explains which personal data the Controller processes when the User uses the Slovenian language learning platform “Govori slovensko”, available through the website www.govorislovensko.si and the Telegram bot @govori_slovensko_bot (hereinafter together: the Platform), for which purposes and on which legal basis the data is processed, to whom it is disclosed, how long it is kept and which rights the User has.

The Policy is adopted to fulfil the obligation to inform data subjects, in accordance with the regulations of the United Kingdom (UK GDPR and the Data Protection Act 2018), the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679 – GDPR) and the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of the RS, No. 87/2018 – ZZPL), to the extent that these regulations apply to the User.

The Policy forms an integral part of the Terms of Use of the Platform. Terms defined in the Terms of Use (Platform, Service, Account, AI tutor, Premium, Premium subscription, Premium pass and others) have the same meaning in this Policy. The use of cookies is governed in more detail by the Cookie Policy.

Article 1.

Subject of the Policy

This Policy governs the types of personal data processed, the purposes and legal bases of processing, the recipients of data, transfers of data to other countries, retention periods, protective measures, and the rights of the User and how to exercise them.

The Policy applies to processing of data through the website, the learning app and the Telegram bot, as well as to processing of data of persons who do not have an Account but access the public parts of the Platform.

The Policy does not apply to third-party websites and services that the User reaches through links on the Platform, nor to processing that Telegram carries out as an independent controller.

Article 2.

Controller and contact details

The controller of personal data is Belcorp International Ltd, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

The Controller is registered with the Information Commissioner’s Office (ICO) of the United Kingdom, under registration number ZC206064.

For all questions concerning the processing of personal data and for exercising the rights under this Policy, the User may contact the Controller by email at dalibor@govorislovensko.si or by post at the address of the registered office.

The Controller has not appointed a data protection officer, since the scope and nature of the processing do not create a legal obligation to appoint one. All questions in this area are handled by the Controller directly, through the contact details above.

Article 3.

Principles and legal bases of processing

The Controller processes personal data lawfully, fairly and transparently, only for specified and explicit purposes, to the extent necessary for those purposes, taking care of the accuracy of the data, for no longer than necessary and with appropriate protective measures.

Data is processed on the following legal bases:

• performance of a contract – where processing is necessary to provide the Service in accordance with the Terms of Use or to take steps at the request of the User before entering into a contract (Article 6(1)(b) GDPR and UK GDPR, or Article 12(1)(2) ZZPL);
• legal obligation – where processing is necessary to comply with a legal obligation of the Controller, in particular in the areas of accounting and tax (Article 6(1)(c) GDPR and UK GDPR, or Article 12(1)(3) ZZPL);
• legitimate interest – where processing is necessary for the purposes of the legitimate interests of the Controller, and those interests are not overridden by the interests, rights and freedoms of the User (Article 6(1)(f) GDPR and UK GDPR, or Article 12(1)(6) ZZPL); the User may request information about the legitimate interest assessment;
• consent – where the User has given consent for a specific purpose (Article 6(1)(a) GDPR and UK GDPR, or Article 12(1)(1) ZZPL); consent may be withdrawn at any time, without affecting the lawfulness of processing before its withdrawal.

The Controller does not collect special categories of personal data (data concerning health, religious or political beliefs, ethnic origin and the like). The User should not enter such data, identity document numbers, passwords or data of other persons into lessons. If the User nevertheless does so, the data is processed only within the lesson and is not used for other purposes.

Article 4.

Account and sign-in data

When an Account is opened on the website, the name, email address, chosen language and password are processed. The password is stored only in hashed (unreadable) form.

If the User signs in with a Google account, the Controller receives the User’s email address and name from Google.

When the Telegram bot is used, the Telegram ID is processed, together with the name and username that Telegram passes to the bot. A one-time linking code is used to link the Account on the website with the Telegram bot.

The purpose of processing is to open and maintain the Account, verify the email address, sign in, reset the password, link Accounts and communicate about the Service.

Legal basis: performance of a contract.

Article 5.

Learning data

While the Service is used, the following is processed: the User’s written answers and text obtained from voice messages, the AI tutor’s questions and corrections, chosen topics, the assessed level of knowledge, words and review cards, progress and learning statistics, the number of consecutive days of learning and the User’s frequent mistakes.

To keep track of earlier mistakes, corrections are converted into a numerical representation through the OpenAI service, which allows the AI tutor to recognise similar mistakes in later lessons.

The purpose of processing is to provide the Service, adapt lessons to the User’s level and mistakes, review words according to the algorithm and show progress.

Legal basis: performance of a contract.

Article 6.

Voice messages

Voice messages that the User sends on the website or in the Telegram bot to practise speaking are passed to the OpenAI service (Whisper) to be converted into text. The Controller does not keep audio recordings and further processes only the resulting text.

Voice messages sent in the Telegram bot remain in the User’s chat with the bot, which Telegram keeps in accordance with its own rules. The User can delete them in the Telegram app.

The AI tutor’s voice replies are generated from the text of the reply through the Google Cloud Text-to-Speech service.

The User’s voice is not used to identify the User or to create a voiceprint, and is not processed as biometric data.

Legal basis: performance of a contract.

Article 7.

Review of answers and improvement of the AI tutor

The Controller occasionally reviews selected answers of Users and replies of the AI tutor, in particular when a User reports a mistake, in order to detect and correct the AI tutor’s mistakes and improve the quality of the Service. The review is carried out only by authorised persons of the Controller, who are bound by confidentiality.

Records used for this purpose are kept for 90 days.

The Controller does not use User Content to train artificial intelligence models. The language model providers referred to in Article 13 of this Policy process data under contractual terms for business customers, which do not permit the use of that data to train their models.

Legal basis: the legitimate interest of the Controller in ensuring the accuracy and quality of the Service. The User may object to this processing in accordance with Article 19 of this Policy.

Article 8.

Payment data

Payments are processed by the Stripe service. The Controller does not receive or store payment card data, only the customer and subscription identifiers in the Stripe system, the type and status of the Premium subscription or Premium pass, the amount, currency and dates of payment, renewal and expiry.

The purpose of processing is to charge for Premium, keep records of payments, issue refunds and fulfil accounting and tax obligations. Legal basis: performance of a contract and legal obligation.

Stripe also processes payment data as an independent controller, to prevent fraud and fulfil its own legal obligations, in accordance with its privacy policy.

Article 9.

Email and notifications

The Controller sends the following types of email messages:

• messages necessary for using the Account (verification, password reset, payment confirmations, notices about the subscription and about changes to the Terms of Use and this Policy) – on the basis of performance of a contract and legal obligation;
• practice reminders – a short email when the User has not had a lesson for a few days, at most one a day; they are sent by default, on the basis of the legitimate interest of the Controller in helping the User keep up the practice, and the User can turn them off at any time on the “Account” page or through the link in each reminder;
• messages about Premium – after the free lessons run out, at most three emails about the paid plans, on the basis of the legitimate interest of the Controller in offering its own Service to a User who has tried it; the User can stop them at any time through the link in each message;
• other tips, news and promotional messages – only with separate consent.

Messages are sent from the address dalibor@govorislovensko.si through the Amazon Simple Email Service (Amazon SES) of Amazon Web Services.

Every reminder and every message about Premium contains a link that stops them in one click, and the User may object to this processing in accordance with Article 19 of this Policy. Unsubscribing does not affect receipt of messages necessary for using the Account.

Article 10.

Technical data and activity records

When the Platform is used, technical data is processed automatically: IP address, date and time of access, device and browser type, requests sent to the server and error messages. Server records (logs) do not contain the content of lessons.

Reports of errors in the app are sent to the Sentry service. Visit statistics are collected through the Vercel Analytics service, without cookies and only in aggregate form. Events in the app (for example a lesson started or completed) are recorded with a random Account identifier, without the email address, to monitor that the Service works correctly.

On the first sign-in on the website, the Controller records once the country from which the User connects. The country is determined from the IP address, which is not stored for this purpose; only the country is stored. The price of Premium does not depend on the country.

The purpose of processing is the operation and security of the Platform, detecting and preventing abuse and fraud, fixing errors and providing evidence in the event of a dispute, in accordance with the Terms of Use.

Legal basis: legitimate interest.

Article 11.

Cookies, analytics and marketing

Necessary cookies and the browser’s local storage are used without consent, because the Platform cannot work without them (sign-in, chosen language, cookie choice, a payment in progress).

Measurement cookies (Google Analytics, loaded through Google Tag Manager, and data on the campaign through which the User arrived – UTM) and marketing cookies (Meta pixel) are used only with the User’s consent, given through the cookie notice on the first visit. Refusing is as easy as accepting.

With consent, Meta receives data on visited pages and on sign-up events, to measure the effectiveness of ads. As regards the collection and transmission of that data, the Controller and Meta are joint controllers, while Meta carries out further processing as an independent controller, in accordance with its privacy policy.

Campaign data (UTM) is kept in the browser for 30 days and is attached to the Account on sign-up.

The User may change or withdraw consent at any time through the “Cookie settings” option in the footer of the page. The list of cookies, their purpose and duration are set out in the Cookie Policy.

Legal basis: consent for measurement and marketing cookies, and legitimate interest and performance of a contract for necessary cookies.

Article 12.

Personalisation and automated decision-making

The AI tutor automatically adapts lessons based on the User’s assessed level of knowledge, progress and frequent mistakes. This adaptation is profiling for the purpose of learning, but it does not produce legal effects concerning the User or similarly significantly affect the User.

The Controller does not make decisions that produce legal effects concerning the User based solely on automated processing. Decisions on measures for breach of the Terms of Use are made by an authorised person of the Controller.

Article 13.

Recipients of data

The Controller does not sell personal data. Data is disclosed only to persons who provide the Controller with services necessary for the operation of the Platform (processors), under contracts by which they undertake to process the data only on the Controller’s instructions and with appropriate protective measures:

• DeepSeek – the language model that generates the AI tutor’s replies (lesson content, the User’s answers and questions); People’s Republic of China;
• OpenAI – conversion of voice messages into text and numerical representation of corrections; United States of America;
• Google – speech synthesis, sign-in with a Google account and, with consent, Google Tag Manager and Google Analytics; United States of America;
• Stripe – payment processing; United States of America;
• Amazon Web Services – storage of Account and learning data and sending email (Amazon SES); Frankfurt, Federal Republic of Germany (EU);
• Vercel – website hosting and visit statistics; United States of America;
• Sentry – error reports; United States of America;
• Meta – with consent, the data referred to in Article 11 of this Policy; United States of America and Ireland.

Telegram is not a processor of the Controller, but an independent controller for the data it processes within its app, including the User’s chat with the bot.

Data may also be disclosed to the Controller’s professional advisers (legal, accounting, tax) who are bound by confidentiality, and to competent authorities, where required by law.

An up-to-date list of recipients is available in this Policy, and the Controller notifies Users of changes in recipients in accordance with Article 24 of this Policy.

Article 14.

Transfers of data from the United Kingdom, the European Union and the Republic of Serbia

The Controller has its registered office in the United Kingdom, which is recognised as providing an adequate level of data protection in relation to the European Union, and, in relation to the Republic of Serbia, as a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. Account and learning data is kept in the European Union, on servers in Frankfurt.

Some of the recipients referred to in Article 13 of this Policy process data in countries outside the United Kingdom, the European Union and the Republic of Serbia, primarily in the United States of America, and the provider DeepSeek in the People’s Republic of China. Transfers to those countries are made on the basis of:

• adequacy decisions, including the EU-US Data Privacy Framework and its extension for the United Kingdom (UK-US Data Bridge), for recipients certified under that framework;
• standard contractual clauses (the standard contractual clauses of the European Commission, the International Data Transfer Agreement of the United Kingdom – IDTA, or the addendum to the European Commission’s clauses, and the standard contractual clauses of the Commissioner for Information of Public Importance and Personal Data Protection), with a prior transfer impact assessment and supplementary protective measures where necessary.

Only lesson content is passed to the provider DeepSeek, without the name, email address or other data that directly identifies the User.

The User may, on request, obtain information about the safeguards applied to a specific transfer and a copy of them.

Article 15.

Retention periods

Data is kept only as long as necessary for the purpose of processing, as follows:

• data on the Account, lessons, words and progress – until the User deletes the Account, or until an inactive Account is deleted in accordance with the Terms of Use;
• records of answers and corrections used to fix the AI tutor’s mistakes – 90 days;
• events in the app linked to a random Account identifier – up to 12 months;
• server logs and error reports – up to 12 months;
• Account linking codes – 10 minutes;
• payment data and accounting records – for the periods prescribed by the accounting and tax regulations of the United Kingdom, as a rule 6 years from the end of the financial year to which they relate;
• email address for promotional messages – until unsubscribing or withdrawal of consent;
• complaints and correspondence with the User – 2 years from resolving the complaint or the end of the correspondence;
• cookie choice – 6 months;
• campaign data (UTM) in the browser – 30 days.

After these periods expire, data is deleted or permanently anonymised. Data is deleted from backups in their regular renewal cycle, within 30 days at the latest.

Data may be kept longer only where necessary to establish, exercise or defend legal claims or where a competent authority so orders.

Article 16.

Data protection measures

The Controller applies appropriate technical and organisational protective measures, in particular: an encrypted connection (HTTPS/TLS), storing passwords in hashed form, keeping Account and learning data in the European Union, access to data only for authorised persons and only to the extent needed for their work, a duty of confidentiality, regular system updates, monitoring of logs and errors, backups and processing agreements with processors.

Since no system connected to the internet can be fully protected, the Controller cannot guarantee absolute data security, but regularly reviews and improves the measures applied.

Article 17.

Personal data breach

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of Users, the Controller notifies the competent data protection authority without undue delay, and no later than 72 hours after becoming aware of it.

If the breach is likely to result in a high risk to the rights and freedoms of Users, the Controller also notifies the affected Users without undue delay, with a description of the breach, its likely consequences and the measures taken, and recommendations on what the User can do to protect themselves.

The Controller keeps a record of all personal data breaches, whether or not it has notified the competent authority of them.

Article 18.

Minors

The Platform is intended for persons aged 16 or over. The Controller does not knowingly collect data of persons under 16. If it learns that such a person has opened an Account, the Controller deletes the Account and the data about that person without delay.

A parent or guardian who learns that a child under 16 has used the Platform may contact the Controller at dalibor@govorislovensko.si.

The Terms of Use apply to the purchase of Premium by persons aged 16 to 18.

Article 19.

Rights of the User

The User has the following rights in relation to the processing of personal data:

• the right to information and access – to obtain confirmation as to whether their data is being processed, information about the processing and a copy of the data;
• the right to rectification and completion – to request correction of inaccurate data and completion of incomplete data;
• the right to erasure – to request deletion of data where there is no legal basis for keeping it further;
• the right to restriction of processing – to request that processing be restricted, for example while the accuracy of the data or the merits of an objection are being verified;
• the right to data portability – to receive the data they provided on the basis of a contract or consent in a structured, commonly used and machine-readable format, or to request its transfer to another controller, where technically feasible;
• the right to object – to object at any time to processing based on legitimate interest, and to processing for direct marketing purposes without giving reasons;
• the right to withdraw consent – at any time, without affecting the lawfulness of processing before its withdrawal;
• the right not to be subject to a decision based solely on automated processing, where that decision produces legal effects concerning them or similarly significantly affects them;
• the right to lodge a complaint with a competent authority, in accordance with Article 21 of this Policy.

Article 20.

How to exercise rights

The User submits a request to exercise their rights to dalibor@govorislovensko.si. The User may also exercise some rights directly, through the functions on the “Account” page (changing data, turning off reminders, deleting the Account), and through the unsubscribe link in email messages.

The Controller responds to the request without delay, and no later than 30 days from receipt. This period may be extended by a further 60 days where necessary because of the complexity and number of requests, of which the User is informed within the original period, with the reasons.

Exercising rights is free of charge. If a request is manifestly unfounded or excessive, in particular because it is repetitive, the Controller may charge a reasonable fee for the necessary costs or refuse to act on the request, giving reasons.

If there is reasonable doubt about the identity of the person making the request, the Controller may ask for additional information to confirm their identity, for example that the request be sent from the email address linked to the Account or confirmed through the Telegram bot.

Deleting the Account through the “Delete account” option on the “Account” page deletes the Account, the sign-in data, lessons, words and progress, and any active subscription is cancelled beforehand. If the Account is linked with the Telegram bot, the learning data and subscription tied to the Telegram bot are deleted at the User’s request sent to dalibor@govorislovensko.si, within the period referred to in paragraph 2 of this Article.

Article 21.

Competent data protection authorities

A User who considers that their data is being processed in breach of the regulations has the right to lodge a complaint with:

• the Information Commissioner’s Office of the United Kingdom, through the website www.ico.org.uk;
• the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, Bulevar kralja Aleksandra 15, 11000 Belgrade, email: office@poverenik.rs, website: www.poverenik.rs;
• the data protection supervisory authority in the Member State of the European Union where the User has their habitual residence or place of work, or where the breach occurred.

The Controller recommends that the User contact it first, so that the problem can be resolved faster, but this is not a condition for lodging a complaint. A complaint does not affect the User’s right to judicial protection.

Article 22.

Changes of status and transfer of business

In the event of a change in the Controller’s legal status, a sale or other transfer of the business or the Platform, personal data may be transferred to the legal successor or acquirer, who must process it in accordance with this Policy.

The Controller notifies Users of such a transfer before it takes place.

Article 23.

Third-party websites

The Platform may contain links to third-party websites and services, which are not under the Controller’s control and to which this Policy does not apply. The Controller recommends that the User read their privacy policies before leaving data on those websites.

Article 24.

Changes to the Policy

The Controller may change this Policy to bring it in line with regulations, changes to the Service or changes in the recipients of data.

The Controller notifies Users of material changes by email or through the Telegram bot, and by publishing them on the Platform, before they take effect. If a change involves processing that requires consent, the Controller obtains it separately.

The date of the last change is stated at the beginning of the Policy published on the Platform, and earlier versions of the Policy are available to the User on request.

Article 25.

Final provisions

The Policy is published in English, Serbian, Croatian, Macedonian and Albanian. The English and Serbian versions are the original texts; the Croatian, Macedonian and Albanian versions are translations provided for convenience. In the event of a discrepancy between the language versions, the Serbian version prevails for Users who use the Platform in Serbian, and the English version for all other Users.

This Policy enters into force and applies from the day of its publication on the Platform.