This policy explains, in plain words, how English Academy by Oana Neicu uses your personal data when you visit the website, create an account, buy lessons or take the courses. We apply it in line with Regulation (EU) 2016/679 (GDPR) and Romanian data protection law.
Who is responsible for your data
The data controller is:
- Name
- KEFI GROUP S.R.L., trading as English Academy by Oana Neicu
- Tax ID (CUI)
- 55584551
- Trade Register
- J2026054224001
- Registered office
- Ipotești nr. 2, Municipiul Brăila, județul Brăila
- contact@academiadeengleza.ro
- Phone
- 0745 055 310
For any question about your data, just write to us at the email address above. The Academy is not required to appoint a Data Protection Officer (DPO), so Oana Olivia Neicu will reply to you directly.
What data we process
We only process the data we need to provide your courses:
- Account data: first and last name, email address, phone number, preferred language and password. We never see your password: it is only stored in an irreversibly encrypted form (hash).
- Order data: the programme you chose, the number of lessons, your preferred days and time, the format (online or in person) and the level of English you told us you have.
- Payment data: the amount, date, payment status and transaction code. Your card details never reach us: you enter them directly on the secure page of the payment processor, NETOPIA Payments.
- Course data: lessons booked, moved or cancelled, attendance, the group you belong to, the course materials you can access and the teacher’s notes on your progress.
- Level test result: your answers, how many you got right in each group of questions, your estimated level (CEFR) and how long the test took. The level is only a guide and helps us prepare your lessons and choose the right group; it is not the basis of any automated decision that has legal effects on you. If you take the test on the website without signing in, the result is kept without your name or contact details.
- Your messages: what you write to us on WhatsApp or by email, or tell us over the phone.
- Withdrawal from the contract: if you use the “Withdraw from contract here” form, your name, email address, the order you are withdrawing from and the date and time you sent it.
- Technical data: the cookie that keeps you logged in, a security log of important account actions (for example logins, payments, bookings) and your cookie choice, stored under a random code, without your IP address. The details are in the Cookie Policy.
Students under 18. For a student under 18, the account is created and payment is made by a parent or legal guardian, who gives us the child’s details and exercises the child’s rights on their behalf.
We do not ask for or process sensitive data (for example about health, religion or political opinions). Please do not send it to us.
Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, buying lessons, booking and teaching the lessons, access to materials | Performance of the contract with you, Art. 6(1)(b) |
| Answering your questions before you enrol | Steps taken at your request before entering into a contract, Art. 6(1)(b) |
| Payment records, issuing tax documents and accounting | Legal obligation, Art. 6(1)(c) (Accounting Law no. 82/1991 and the Tax Code) |
| Security of the account and the website, backups, fraud prevention | Our legitimate interest in protecting the data and the service, Art. 6(1)(f) |
| Receiving and acknowledging your withdrawal from the contract and refunding the money | Legal obligation, Art. 6(1)(c) (Romanian Government Emergency Ordinance no. 34/2014 on consumer rights) |
| Handling complaints and defending our rights in case of a dispute | Legitimate interest, Art. 6(1)(f), and legal obligation, point (c) |
| Preference cookies | Your consent, Art. 6(1)(a), which you can withdraw at any time |
We do not send you newsletters or advertising messages and we do not use your data for ads. We do not sell or rent out your data.
Without your account and order data we cannot sell you lessons or teach the courses; any other information you give only if you want to.
Who we share it with
Only Oana sees your data. We pass it on only when necessary, to:
- NETOPIA Payments (NETOPIA Financial Services S.A.), which processes card payments. For card data, NETOPIA is an independent controller and applies its own privacy policy.
- The hosting provider of the website, with servers in Romania, which stores the data on our behalf under a contract.
- The email service provider, when we send you messages about your account (for example the access link or a password reset).
- The accountant who keeps the Academy’s financial and accounting records, for the details on payment documents.
- The video conferencing platform used for online lessons, only as far as needed for you to join the lesson.
- Public authorities, only when the law requires us to.
If you write to us on WhatsApp, the conversation goes through the WhatsApp service (Meta Platforms Ireland Ltd.), under its own terms and privacy policy. If you prefer, you can just as easily contact us by email or phone.
Transfers outside the European Union
The website and the database are hosted in Romania. The website’s fonts are served from our own server, so we do not send your IP address to Google or other external services while you browse.
Some providers (for example WhatsApp or the video conferencing platform) may transfer data outside the European Economic Area. In these cases, the transfer is based on an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework) or on standard contractual clauses approved by the Commission.
How long we keep it
- Your account and course history: for as long as you have an account. You can delete it at any time (see below). Accounts with no activity for 3 years are deleted automatically.
- Payment documents: for the period required by financial and accounting law, even if you delete your account. In that case we keep only the details on the payment document.
- Security log: 3 years, the general limitation period for any possible claims.
- Withdrawal requests: 3 years from when they were sent, as proof in case of a disagreement.
- WhatsApp or email messages: as long as needed to reply to you and keep in touch during the course.
- Backups: made daily and deleted automatically after 14 days.
- Your cookie choice: the cookie expires after 6 months; we keep the proof of your choice (the random code, the choice and the date) for 13 months.
Your rights
Regarding your data, you have the right:
- of access: to find out what data we hold about you and to receive a copy;
- to rectification: to correct data that is wrong or incomplete;
- to erasure: to ask for your data to be deleted, except for data the law requires us to keep;
- to restriction: to ask us to stop using your data for a while, for example while we check a correction;
- to portability: to receive your data in an electronic format that is easy to reuse;
- to object: to object to processing based on our legitimate interest;
- to withdraw your consent at any time, without this affecting anything done before;
- to lodge a complaint with the supervisory authority (see below).
Straight from your account: in My account › Profile you can correct your data, download a copy of it and delete your account, without having to write to us.
For any other request, write to us at contact@academiadeengleza.ro. We will reply free of charge within one month at most. We may ask for additional information to make sure the request comes from you.
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București · www.dataprotection.ro · anspdcp@dataprotection.ro
How we protect it
- Passwords are only stored irreversibly encrypted (hashed), and account sessions expire automatically.
- Course materials and account data can only be accessed by the students enrolled on that course and by Oana.
- The admin pages can only be accessed by Oana, with a password, and important actions are recorded in the security log.
- The database is backed up daily.
If a security breach that puts your data at risk were to happen anyway, we will notify the authority within 72 hours and, when the risk is high, we will let you know too.
Cookies
The website only uses the cookies it needs to work and, only with your consent, a few preference cookies. We do not use analytics, advertising or tracking cookies. The details and the full list are in the Cookie Policy, and you can change your choice at any time from .
Changes to this policy
When we change something important, we update the date at the top of the page and, if you have an account, we let you know in your account or by email. The version in force is always the one published here.