1. Who processes your data
Controller (správce) of personal data:
BFine.Academy – Institut jazykové a odborné přípravy s.r.o.
Karlovo náměstí 313/8, 120 00 Praha 2
IČO: 21058466
Contact for personal data matters: email@bfine.academy
We process data under Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing.
2. What data we collect
About the student: first and last name (in Cyrillic and Latin script), date of birth, citizenship, residential address, passport details (number, validity, issuing authority), phone, e-mail, Telegram, education background, fields of interest, nostrification status, housing needs and address in Prague, preferred language of communication, and any comment you leave yourself.
About the parent or legal guardian – if the student is under 18: first and last name (in Cyrillic and Latin script), date of birth, passport details, address, phone, e-mail, Telegram.
Documents: scans or photos of the passport, school certificate, nostrification documents and other documents you upload for admission.
Contract and payments: contract number and text, study period, amounts, currency, payment schedule, invoices, payment records, the signed copy of the contract.
Technical records required by law: the date, time and IP address at the moment you gave consent and signed the contract, e-mail address confirmation, the signatory's role. These records prove that it was you who signed; without them an electronic signature has no legal force.
Operational records: e-mails sent to you and their delivery status, staff actions on your record (who changed or confirmed data and when).
The website uses the Microsoft Clarity analytics service – it starts only after you agree in the cookie banner and helps us understand how visitors use the site. Without your consent the analytics does not run and its cookies are not set. There are no advertising trackers. The personal account stores in the browser only what is needed to sign in and to remember the interface language. You can change your cookie decision at any time: change cookie preferences.
3. Where the data comes from
- From you – when you fill in the application form on the site or upload documents.
- From an academy partner – if the application was filled in on your behalf by a representative you work with. In that case we record that consent was confirmed through the partner, and you can request a copy of your data from us at any time.
4. Why we process data and on what legal basis
| Purpose | GDPR legal basis |
|---|---|
| Review the application and contact you before a contract is concluded | your consent, Art. 6(1)(a); you can withdraw it at any time |
| Conclude and perform the study contract: enrolment, schedule, support | performance of a contract, Art. 6(1)(b) |
| Issue invoices, accept payments, keep accounting and tax records | legal obligation, Art. 6(1)(c) |
| Prepare the contract and verify the signature (audit trail) | performance of a contract and legal obligation |
| Protect our rights in a dispute, preserve evidence | legitimate interest, Art. 6(1)(f) |
| Understand how visitors use the website (Microsoft Clarity analytics) | your consent, Art. 6(1)(a) – via the cookie banner; you can withdraw it at any time |
We process a minor's data on the basis of the contract signed by their parent or legal guardian.
5. How long we keep the data
- Contracts, their annexes and related correspondence – 5 years after the studies end or the contract is terminated.
- Accounting and tax documents, including invoices, – 10 years, as required by Czech law.
- An application that did not lead to a contract – 1 year, after which it is deleted.
- Documents you uploaded (passport, school certificate) – until the end of the contract retention period; at your request we can delete them earlier if they are no longer needed to perform the contract and are not required by law.
Some documents are also kept by the academy on paper. Deleting data in the system does not affect the paper archive – it has to be requested separately, and we will handle it the same way.
6. Who we share the data with
We do not sell or pass your data to third parties – not to other schools, not to advertisers, not to anyone else for their own purposes.
The data is processed only by service providers acting on our instructions who may not use it for anything else (processors):
| Who | What they do | Where the data is stored |
|---|---|---|
| Váš Hosting s.r.o. | application server | Czechia |
| Amazon Web Services | file storage and e-mail delivery | Frankfurt, Germany |
| Neon Inc. | database | Frankfurt, Germany |
| Netlify Inc. | website and DNS | content delivery network |
| Make (Celonis SE) | receiving and routing website requests | EU (eu1 region) |
| Microsoft Ireland Operations Ltd. (Clarity) | website usage analytics: page views, clicks, session recordings – only with your consent | EU and USA |
| Google Ireland Ltd. | the academy's work e-mail | EU |
Neon Inc., Netlify Inc. and Microsoft are US companies, although the main data is hosted in European data centres. Any transfer outside the EEA, where it occurs, relies on the EU standard contractual clauses (SCC) and the provider's participation in the EU–U.S. Data Privacy Framework.
We are also obliged to provide data to public authorities where the law requires it (for example, to the tax office or the police upon an official request).
7. Your rights
You have the right to:
- access your data and receive a copy of what we hold;
- have inaccurate data corrected;
- request deletion – with the proviso that documents we are legally required to keep (contracts, accounting) will be deleted once their retention period expires;
- request restriction of processing or object to it;
- receive your data in a machine-readable format and transfer it to another controller;
- withdraw consent at any time – this does not affect the lawfulness of processing before withdrawal and does not cancel obligations under a contract already concluded.
Send your request to email@bfine.academy. We will reply within one month. To make sure no one obtains someone else's data, we may ask you to confirm your identity.
If you believe we are violating your rights, you can lodge a complaint with the supervisory authority:
Úřad pro ochranu osobních údajů
Pplk. Sochora 27, 170 00 Praha 7
uoou.gov.cz
8. Automated decisions
We make no automated decisions about you and do no profiling. Applications are reviewed by a person.
9. How we protect the data
The connection to the personal account is protected by TLS. Only academy staff have access to the data, within the scope of their role: a teacher sees their students, a partner sees their clients, and passport details and contract amounts are available to a narrow circle. Every change and confirmation is logged with the author and time. Files are stored encrypted and released only after an access check.
10. Changes to this policy
If the policy changes, we will publish the new version on this page and update its number. If the changes affect the legal grounds for processing, we will notify you by e-mail and, where required, ask for your consent again.