Privacy Policy

Who is the data controller

The controller of your data is [PRAVNO LICE / LEGAL ENTITY], with its registered seat at [ADRESA / ADDRESS], registration number [MATIČNI BROJ / REG. NUMBER], tax ID [PIB / TAX ID].

For any questions about privacy and data protection, you can contact us at support@balkanonlineschool.com ([potvrditi] / [confirm]).

What data we collect

We collect only the data we need to provide the learning service and run the parent account. Specifically, we collect the following categories of data:

• Parent account data: email address and password. Passwords are stored only in hashed form and are never stored as plaintext. We verify your email address via a confirmation link.
• Child profile data: a display name (which can be a nickname), grade, an avatar choice, and an optional short PIN (4–6 digits). The PIN is stored in hashed form. Children do not have their own email accounts or their own logins.
• Learning and progress data: recorded practice attempts, progress, and mastery estimates per child. We use this data to personalise learning and to show the parent progress reports.
• Technical and usage data: basic data needed to run the service, such as session data for login and basic diagnostics. We deliberately minimise personal data in logs and analytics.
• We do not collect a phone number and we do not send SMS messages. We do not store payment-card data — payments are handled by Paddle (see the "Payment processing" section and the section on subprocessors).

Why we process data and on what lawful basis

We only process personal data when we have a lawful basis to do so. The main bases we rely on are:

• Performance of a contract: to open and run your account, provide access to lessons, and process your subscription.
• Parental consent: because the learning users are minors, the parent gives consent and controls the child profiles. You can withdraw consent at any time (see the section on your rights).
• Our legitimate interests: to keep the service secure, prevent abuse, and improve the quality of learning, while respecting your rights.
• Compliance with legal obligations: where we are required by law to retain or process certain data.

Payment processing

Payments are handled by Paddle (Paddle.com Market Ltd), acting as the Merchant of Record. This means Paddle processes payments and handles VAT and sales tax.

BOS does not store your payment-card data — that data is tokenised and held by Paddle. The billing currency is EUR. There is no free trial; the first topic of each grade is free, and an active subscription unlocks the rest.

Who we share data with (subprocessors)

We do not sell your data. To provide the service, we rely on carefully selected service providers (subprocessors), each of which processes only the data necessary for its role:

• Paddle — payment processing and billing (Merchant of Record).
• Resend — delivery of transactional email (for example, email confirmation and system notifications).
• Neon — PostgreSQL database hosting.
• Wistia — hosting and delivery of lesson videos (CDN).
• Vercel — application hosting.

Transfers outside Serbia and the EU

Some of our subprocessors may process data outside Serbia or the European Union. In those cases we rely on appropriate safeguards (for example, standard contractual clauses and other recognised mechanisms) so that your data remains protected in line with applicable data-protection law.

Children's privacy

Our learning users are minors (roughly aged 11–15), so protecting their privacy is a priority for us.

Child profiles are created and controlled by the parent, who provides consent for processing the child's data. We deliberately do not collect more data about a child than is needed to run the learning service.

Children do not communicate with each other, there is no user-generated content shown to other users, and there are no external links on student-facing surfaces.

How long we keep data and deletion

We keep data for as long as needed to provide the service and to meet legal obligations. When you request deletion, or when data is no longer needed, we honour a retention window and then permanently purge it.

If you want to delete your account or your child's data, contact us and we will process the request (see the section on your rights).

Your rights

As the parent who runs the account, in relation to your data and your child's data you have the following rights:

• Access to the data we hold about you and your child.
• Export (portability) of that data.
• Correction of inaccurate or incomplete data.
• Deletion of data, subject to a retention window before permanent purge.
• Withdrawal of any consent you have given, at any time, without affecting the lawfulness of processing before withdrawal.
• Lodging a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (or another competent supervisory authority).

Security

We take reasonable technical and organisational measures to protect your data. Passwords and PINs are stored in hashed form, never as plaintext. Payment data is tokenised by Paddle and is not stored by us.

Data in transit is protected by encryption (HTTPS/TLS). Access to administrative and content-authoring functions is restricted and controlled.

Cookies and essential storage

We use essential cookies and similar storage to make the core service work — primarily session cookies for login and for idle-timeout of a session. These cookies are necessary to keep you signed in and to use your account securely.

We do not use advertising cookies and we do not track children for marketing purposes.

Contact

For any questions about this Privacy Policy, or to exercise your rights, contact us at support@balkanonlineschool.com. We review requests individually and aim to respond within a reasonable time.

Changes to this policy

We may update this Privacy Policy from time to time as the service evolves or as regulations change. We will notify you of significant changes in an appropriate manner. We recommend reviewing this page periodically so you are aware of the current version.