ENGLISH BOSS PRIVACY POLICY

Version 1.1 — effective 28 August 2026

1. Data controller

1. The controller of personal data relating to the English Boss platform is English Boss sp. z o.o., with its registered office in Lubin at ul. Leśna 6, 59-300 Lubin, Poland, entered in the Register of Entrepreneurs of the Polish National Court Register (KRS), maintained by the District Court for Wrocław-Fabryczna in Wrocław, 9th Commercial Division of the National Court Register, under KRS No. 0001255897, NIP (tax identification number) 6922551332, REGON 545303939, with share capital of PLN 10,000.00.

2. Privacy and data-rights contact: support@englishboss.org. General contact: support@englishboss.org, telephone +48 693 989 839.

3. This Policy covers data processed by English Boss in connection with accounts, learning, security and platform operation. Transaction data processed by Paddle as Merchant of Record is also subject to Paddle’s own privacy notice.

2. Data we may process

Depending on how the platform is used, we may process in particular:

1. Account and authentication data: email address, user identifiers, password hash and login-method information, roles, account status, verification and login dates, MFA and account-security information.

2. Profile data: display name, first name, last name, date of birth, country, time zone, locale/language settings, avatar, preferred exam level and optional bio. Some of these fields are optional and may remain empty.

3. Technical and security data: IP address, User-Agent, device information, sessions, successful and failed logins, password resets, blocks and security events. We also record the accepted legal-document type, version, language, checksum, date/time and source channel. Some log values may be stored in hashed form.

4. Learning data: started and completed lessons, task attempts, answers, correctness, points and scores, time spent, number of attempts, answer changes, hints, audio plays, transcript opening, Smart Revision activity, vocabulary progress, dictionary searches, notes, XP, streaks, achievements, statistics, skill-level results, exam and diagnostic results, and configured learning plans.

5. Writing: text or structured answers, links to the user and task, timing, scores, status, self-assessment and, where applicable, teacher feedback.

6. Payment and subscription data: English Boss may receive from Paddle data necessary to recognise purchase/subscription status, such as customer or transaction identifiers, product, payment status and subscription status. Full payment-instrument details are handled by Paddle and its payment providers rather than English Boss.

3. Speaking and voice recordings

1. The current version of English Boss does not record, upload or store the user’s voice in Speaking activities.

2. Speaking currently relies primarily on self-assessment. Course audio is stored by English Boss but is not user-recorded audio.

3. If speech recognition or voice storage is introduced in the future, this Policy will be updated before such processing begins.

4. Artificial intelligence

1. English Boss currently does not send Writing answers, Speaking recordings or user profiles to an external AI model for automated evaluation.

2. Technical infrastructure may be prepared for future AI features, but the existence of a technical schema does not mean user data is currently being sent to an AI provider.

3. Before enabling AI features that require external data transfers, English Boss will update information about the purpose, legal basis, provider, international transfers and retention.

5. Purposes and legal bases

We may process personal data for the following purposes:

1. Creating and operating an account, providing the service, maintaining learning history, enabling course features and delivering purchased access — where necessary to perform a contract or take steps requested before entering a contract.

2. Managing paid access and synchronising transaction/subscription status with Paddle — performance of a contract and our legitimate interest in administering access correctly.

3. Security, fraud and abuse prevention, session management, account protection and establishing, exercising or defending legal claims — our legitimate interests.

4. Compliance with legal, tax, accounting and authority-request obligations — compliance with a legal obligation.

5. Optional consent-based activities, such as future electronic marketing or non-essential analytics — only where valid consent is required and obtained.

6. Product improvement — where based on legitimate interests and carried out with data minimisation and user rights in mind; technical analytics should be aggregated or pseudonymised where reasonably possible.

6. Educational profile and automation

1. English Boss creates an educational profile based on activity such as scores, progress, errors, revision and use of platform features in order to provide learning and personalisation features.

2. We currently do not use external AI to make decisions about users that produce legal or similarly significant effects.

3. Automated checking of selected tasks and generation of educational results is used to provide the course functionality.

7. Recipients

1. Our main infrastructure provider is Microsoft Azure / Microsoft. The core production infrastructure is located in Poland Central (Poland) and includes the application, MySQL database, Blob Storage, Redis, Key Vault and monitoring.

2. Once production payments are enabled, Paddle receives data required to process transactions, payments, transactional taxes, sales documents and subscriptions as Merchant of Record. For its own transaction-related purposes, Paddle processes data under its own privacy notice and may act as an independent controller.

3. Cyber_Folks S.A. may process the recipient address and transactional message content as the authenticated SMTP/email-hosting provider used to deliver account verification, password reset and other service messages. Data may also be disclosed to professional advisers, technical support providers or public authorities only where necessary and legally justified.

4. English Boss does not sell users’ personal data to advertisers and does not currently use children’s data for behavioural advertising.

8. Data location and international transfers

1. The main application, database, files and production cache are currently hosted in Microsoft Azure, Poland Central, Poland.

2. Some global service providers, including payment or infrastructure providers, may process data outside the European Economic Area through their organisations or subprocessors. Where a third-country transfer occurs, we use or require an appropriate GDPR transfer mechanism where required, such as an adequacy decision or Standard Contractual Clauses.

9. Retention

1. Account data and learning history are generally retained while the account is active and afterwards for as long as necessary for billing, complaints, security, legal claims or compliance with legal obligations.

2. Writing answers form part of learning history and remain linked to the account until deleted or anonymised under the account-deletion process or another applicable retention rule.

3. Security logs are retained for a period justified by account protection, abuse detection, incident analysis and legal claims. The period may vary by log category.

4. Azure MySQL backups are currently retained for up to 14 days. Data deleted from the active database may therefore remain in a historical backup until that backup automatically expires. Backup copies are not intended for ordinary use of a deleted account.

5. Data that must be retained under law is kept for the required legal period.

10. Account deletion

1. Users may request deletion of their data or account by contacting support@englishboss.org.

2. Requests are handled without undue delay in accordance with GDPR, subject to cases where some data must be retained due to legal obligations or the defence of claims.

3. We do not currently promise a fixed seven-day period for complete physical deletion from every system. Residual copies may remain in backups until the relevant backup expires, currently up to 14 days for MySQL backups.

11. Your rights

Subject to GDPR, users may have the right to:

1. access their data and obtain a copy;

2. rectify inaccurate data;

3. request erasure;

4. request restriction of processing;

5. data portability;

6. object to processing based on legitimate interests;

7. withdraw consent at any time where processing is based on consent;

8. lodge a complaint with a competent supervisory authority; in Poland, this is the President of the Personal Data Protection Office (UODO).

12. Children

1. English Boss may be used by minors through family or school arrangements, but purchases and legally required consents should be made or authorised by a parent, guardian or other authorised person.

2. Where, in Poland, processing of data relating to a person under 16 in an information-society service is based on consent, that consent must be given or authorised by the holder of parental responsibility in accordance with applicable law.

3. We do not use children’s data for behavioural advertising.

13. Security

1. Passwords are not stored in plain text; password hashes and information required for secure authentication are stored instead.

2. The production database and Blob Storage have public data-layer access disabled and use private endpoints in Azure.

3. We use session controls, security-event logging, access controls and other measures appropriate to the risk.

4. No system can guarantee absolute security, so safeguards are reviewed and developed over time.

14. Cookies and similar technologies

See the separate “Cookie Policy” for details. English Boss currently has no confirmed active marketing trackers such as Google Analytics/Ads, Meta Pixel, TikTok Pixel, Microsoft Clarity or Hotjar. If such tools are introduced, the necessary disclosures and consent mechanism will be implemented before activation where consent is legally required.

15. Changes to this Policy

This Policy may be updated when features, providers, laws, payment methods or processing practices change. The current version will be published on the website with its update date.

Effective date: 28 August 2026