Privacy Policy

Personal Data: Personal data is information that identifies an individual as a specific or identifiable person. An individual is identifiable when they can be directly or indirectly identified, particularly by reference to an identifier such as a name, identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual. Data Subject: A determined or identifiable natural person whose personal data is processed by the controller responsible for the processing. Processing of Personal Data: Means any operation or set of operations which is performed on personal data, particularly collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data. The processing can be manual or automated. Restriction of Processing: Is the marking of stored personal data with the aim of limiting their processing in the future. Profiling: Means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyze or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements. Automated Decision-Making: Means a decision based solely on automated processing (including profiling) that produces legal effects concerning an individual or similarly significantly affects an individual. Anonymization: Is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific individual without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. Data Controller: Is a natural or legal person or another entity of the public or private sector that alone or jointly with others determines the purposes and means of processing of data; or a person designated by law which also specifies the purposes and means of processing. Data Processor: Is a natural or legal person, public authority, agency or body which processes personal data on behalf of the controller. User of Personal Data: Is a natural or legal person, public authority, agency or body to whom personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with EU or member state law shall not be regarded as users; the processing of those data by those public authorities must comply with the applicable data protection rules according to the purposes of the processing. Third Party: Is a natural or legal person, public authority, agency or body other than the data subject, controller, processor, or persons who, under the direct authority of the controller or processor, are authorized to process personal data. Individual’s Consent: The individual’s consent to whom the personal data relates is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

The personal data controller is Capito App (Xar Tech), e-mail: support@getcapito.com. In our company, we have appointed a Data Protection Officer, contact: privacy@getcapito.com

a.) Processing Based on Consent We process personal data based on clear and unambiguous consent from the individuals concerned for the following purposes: • completion of the contact form, • participation in promotional activities published on the website, • consent to use the telephone number and email address for sending information and offers about products and services, • sending newsletters, • protection of our products and services. b.) Processing Based on Contract (contractual processing) We also process personal data on the basis of contractual processing in the following cases: If you register and use the website, it is necessary for the smooth operation of the website to comply with our rules of engagement, which are set out in the General Terms and Conditions. Entering into a subscription relationship with registered users, for the performance of which we need, in addition to registration, your personal data. c.) Processing Based on Legitimate Interest: If required by circumstances, we process personal data based on a legitimate interest for the purposes of: • responding to your inquiries about products and/or services, • measuring satisfaction with the purchase, via email or telephone communication, • email communication based on your initiation of the online purchasing process, • informing about new products and services (direct marketing), • website optimization, • ensuring the security of IT systems, • prevention of abuse and/or fraud. d.) Processing Based on the Law Based on the law and in accordance with relevant legislation, we process personal data: • For example, in connection with our cooperation for lawful purposes (e.g., reasons of tax legislation).

Voluntarily Provided Data For the purposes of conducting business, responding to inquiries, participating in promotional offers, and processing your order of products/services, we collect the following personal data, which we obtain if you explicitly communicate them: – Name and surname, – Email address, – Educational programme, – Class, – Year of secondary school, – School grades, – Other data that you provide. The provision of personal data is a condition for the use of our services or for ordering products, as without the necessary personal data we cannot execute the order. Automatically Generated Data We automatically collect data about your device or other log data when you use our website. We collect anonymous data from each visitor for traffic monitoring and error resolution. This information helps us understand who uses our website, which serves to improve and market our website, especially our online products and services. We collect data such as IP address, web requests, data sent in response to such requests, browser type, browser language, timestamp of the request, and other anonymous statistical data involving the use of our website. This information by itself cannot be used to identify or contact you. We may combine automatically collected data with other, non-personal data. In this case, we will treat the combined data as personal data in accordance with this Privacy Policy and will use it for marketing purposes.

We do not engage in the sale of your personal data. We may share your personal data with third parties only as specified in this Privacy Policy. We share personal data with third parties: • With your consent, we may share your personal data with those third parties for whom you have given consent. • With our service providers, business partners, and contractors who provide services on our behalf or whom we use to support our business. • We may report any activities to law enforcement that we reasonably believe to be unlawful. • We may disclose your personal data when required by law, regulations, or official orders to protect the safety of any person, to prevent fraud or abuse, or to protect our proprietary rights. We disclose your personal data if necessary to fulfill our obligations to you and only to the minimum extent necessary. The personal data collected are not transferred to third countries. Your data is processed only within the territory of the European Union. For the purposes of web analytics, we use Google Analytics 4 and PostHog. The data collected for this purpose are anonymized and may be stored outside the EU.

We recognize the importance of safeguarding the privacy of children online and ensuring internet safety. While our services, including online tutoring, are available to children under the age of 15, it is mandatory that they obtain consent from a parent or guardian before using our services. We do not knowingly collect or solicit personal data from children under 15 without parental consent.

The personal data of individuals are not subject to automated decision-making, nor are they subject to profiling.

We take appropriate technical and organizational measures to ensure a high level of data protection (use of firewalls and data encryption, control of physical access, and control over access authorizations). We limit access to personal data to our employees, service providers, and agents who need to know it in order to develop or improve our services.

In accordance with the provisions of the GDPR, the individual has the right of access to personal data, the right to rectification, the right to erasure (“right to be forgotten”), the right to data portability, the right to request restriction of processing of personal data, the right to object, and the right to lodge a complaint with the supervisory authority. For exercising your rights or obtaining additional information, you can contact us at the email address: support@getcapito.com. A response to your request will be given within 10 days in accordance with the GDPR.