Template document
This policy is a working draft written to reflect how the website actually behaves. Have it reviewed by a solicitor and complete the company details before the site goes live.
Key to Learn Ltd (“we”, “us”) is the data controller for the personal data described in this policy. We are registered in Ireland and we process personal data in line with the General Data Protection Regulation (EU) 2016/679 and the Irish Data Protection Act 2018.
If you have any question about this policy, write to us at keytolearnacademy@gmail.com.
1. What we collect
We collect only what we need to teach you and to run the academy.
- Account details — your name, email address, phone number and password (stored only as a salted Argon2 hash, never in readable form).
- Student profile — date of birth, learning goals, preferred way of being contacted, and, for students under 18, a parent or guardian's name and phone number.
- Booking records — the courses you buy, the classes you book, attend or cancel.
- Payment records — the amount, date, course and a Stripe reference. We never see or store your card number. Card details are entered on Stripe's own hosted page.
- Enquiries — anything you send us through the contact form or by email.
- Technical data — strictly necessary cookies that keep you signed in, and standard server logs.
2. Why we use it, and our legal basis
- To provide classes (contract) — creating your account, taking bookings, running your classes, issuing receipts.
- To answer enquiries (legitimate interests) — replying to the messages you send us.
- To take payment (contract) — processing your purchase through Stripe.
- To meet legal duties (legal obligation) — keeping accounting records for the period Irish tax law requires.
- To send news and offers (consent) — only if you tick the box. You can withdraw that consent at any time, from your profile page or by using the unsubscribe link in any email.
3. Students under 18
Children's courses are booked and paid for by a parent or guardian, who provides the child's details and holds the account. We collect the minimum needed to teach the child safely and to keep the parent informed. Every teacher working with under-18s is Garda vetted. A parent or guardian may ask us at any time to show, correct or delete their child's data.
4. Who we share it with
We do not sell your data. We share it only with:
- Stripe Payments Europe Ltd — to take payments. See Stripe's own privacy policy for how they handle your card data.
- Our email provider — to deliver booking confirmations, receipts and replies.
- Our hosting provider — which stores the database on our behalf, within the European Economic Area.
- Your teacher — who sees your name, level and learning goals so they can teach you well.
- Public authorities — where we are legally required to do so.
5. Where your data is stored
Your data is stored on servers within the European Economic Area. Where a provider processes data outside the EEA, we rely on the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Account and booking records: while your account is open, then two years.
- Payment and invoice records: six years, as required by Irish tax law.
- Contact enquiries: two years from your last message.
- Marketing consent records: until you withdraw consent, then two years.
7. Your rights
Under the GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where we have no ongoing legal reason to keep it;
- restrict or object to how we use it;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting past processing.
To exercise any of these, email keytolearnacademy@gmail.com. We respond within one month. If you are unhappy with our response you can complain to the Irish Data Protection Commission at dataprotection.ie.
8. Cookies
This website uses strictly necessary cookies only. Two of them keep you signed in (ktl_access and ktl_refresh); they are httpOnly, meaning no script on the page can read them, and they are removed when you sign out. We do not use advertising or tracking cookies, so there is no consent banner to click through.
9. Security
Traffic is encrypted with TLS. Passwords are hashed with Argon2. Session tokens are short-lived, rotated and held in httpOnly cookies. Administrator access is restricted by role and audited. Card data never touches our servers.
10. Changes to this policy
If we make a material change we will update the date at the top of this page and, where the change affects you directly, tell you by email.
11. Contact
Key to Learn Ltd
Rathdrum, Co. Wicklow, Ireland
keytolearnacademy@gmail.com
See also our terms and conditions.