Privacy & Cookies Policy

This Privacy & Cookies Policy applies to the website available at https://cambridge-ai.center, its online purchase interfaces, user portals, AI-supported educational tools and related digital services.

The Website Operator and controller of personal data is Cambridge School of English Sp. z o.o., with its registered office at Widok 10/LU 1, 00-023 Warsaw, Poland.

The Controller may be contacted by e-mail at contact@cambridge-ai.center.

The Controller processes personal data voluntarily provided by Users and data generated when Users access or use the Website, Products and Digital Services.

This Policy explains how the Controller collects, uses, stores and protects personal data and how cookies and similar technologies are used.

This Policy is intended to fulfil information obligations arising from Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), applicable Polish data protection law, electronic services law, consumer protection law and regulations concerning Digital Content and Digital Services.

The Terms & Conditions and GDPR Compliance Statement are available at https://cambridge-ai.center/terms-conditions-and-gdpr-compliance-statement/.

Depending on how the User interacts with the Website and services, the Controller may process the following categories of personal data:

• first name and surname
• e-mail address and telephone number
• postal address, billing address and country of residence
• company name, professional title, Tax ID or other invoicing information
• account registration, login and access information
• information concerning purchases, subscriptions, courses, platforms and Products
• communications, support requests, survey responses, feedback and testimonials
• information voluntarily entered into forms, chats or AI Tools
• technical information such as IP address, browser type, operating system, device identifiers, referral source, visited pages, session duration and timestamps

When a User purchases a Product, transaction and billing information necessary to process and document the purchase may be collected.

Payment card details and information used to authorise payments are generally processed directly by the selected payment service provider and are not stored by the Controller.

The Controller may process anonymous or aggregated statistical information that does not directly identify a natural person.

Users should not provide special-category data, confidential information or third-party personal data unless this is necessary, lawful and appropriate for the relevant service.

Cambridge AI Speech Tutor and other AI-supported Products may process audio samples, text strings, pronunciation attempts, language exercises, generated feedback and technical information necessary to provide an assessment or educational response.

Audio submitted for assessment should be processed in a manner designed to separate it from directly identifying account information wherever technically possible.

An AI or speech-assessment interface may receive an audio file and corresponding text and return assessment results, including pronunciation scores, corrections or recommendations.

The Controller does not require Users to include names, e-mail addresses or other identifying information within audio recordings or prompts submitted to AI Tools.

Users should not submit personal data of third parties, special-category data, confidential business information or information that is not necessary for the educational purpose of the Product.

Data entered into AI Tools may be processed by external technology providers engaged by the Controller to operate speech recognition, language analysis, hosting, storage or AI functionality.

AI-generated content may be stored temporarily or for a limited period where necessary for service delivery, security, troubleshooting, quality assurance or compliance with legal obligations.

The Controller may use anonymised or aggregated information to improve software, educational functionality and service quality, provided that such information does not identify the User.

AI Tools are educational aids. Users should independently verify important information generated by such systems.

Personal data may be processed for the following purposes:

• concluding and performing agreements
• processing orders, payments, subscriptions and refunds
• creating and maintaining User accounts
• providing access to platforms, AI Tools and Digital Services
• performing speech, pronunciation and language assessments
• organising courses, lessons and educational support
• responding to enquiries, complaints and technical support requests
• issuing invoices, certificates, confirmations and accounting documents
• operating, maintaining, securing and improving the Website and Products
• preventing fraud, abuse, security incidents and unlawful activity
• conducting surveys and collecting feedback
• sending newsletters and promotional communications where legally permitted
• establishing, exercising or defending legal claims
• complying with legal and regulatory obligations

Depending on the circumstances, the legal basis for processing may be:

• performance of an agreement or steps taken at the User’s request before entering into an agreement
• compliance with a legal obligation
• the Controller’s legitimate interests, including service administration, security, fraud prevention, service improvement and the defence of claims
• the User’s consent, where consent is required

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The Controller does not knowingly collect personal data from children without an appropriate legal basis and the required consent or authorisation.

Where a school, educational institution, parent or legal guardian enables a minor to use a Product, that entity or person is responsible for providing any consent or authorisation required by applicable law.

If the Controller becomes aware that personal data of a child has been collected without the required legal basis, reasonable steps will be taken to delete or appropriately restrict such data.

Concerns regarding a child’s personal data may be reported to contact@cambridge-ai.center.

Personal data may be disclosed to recipients where this is necessary to operate the Website, provide Products, perform an agreement or comply with legal obligations. Such recipients may include:

• payment service providers, banks and card issuers
• hosting, cloud, storage and IT infrastructure providers
• AI, speech-recognition and language-analysis technology providers
• e-mail, newsletter and communication service providers
• online chat providers, including Tawk where used
• analytics and advertising providers, including Google and Meta where enabled
• teachers, trainers, authorised employees and contractors
• accounting, legal, marketing and cybersecurity service providers
• public authorities where disclosure is required by law

The Controller may use reputable infrastructure and cloud providers, including providers offering services through Amazon Web Services, Google Cloud Platform or comparable environments.

Service providers receive only the data reasonably necessary to perform the relevant service and are required to process it in accordance with applicable law and contractual safeguards.

The Controller does not sell or rent personal data to third parties for their independent marketing purposes.

Personal data may also be disclosed where necessary to comply with lawful requests, protect the rights or safety of the Controller or Users, prevent fraud, or in connection with a corporate restructuring, merger or transfer of business assets, subject to applicable law.

Some technology, cloud, analytics, advertising or communication providers may process personal data outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, the Controller applies safeguards required by applicable law, such as an adequacy decision, standard contractual clauses or another lawful transfer mechanism.

Information concerning particular providers and the applicable transfer safeguards may be obtained by contacting the Controller.

Personal data is retained no longer than necessary for the purpose for which it was collected.

Data connected with purchases, invoices and accounting documentation may be retained for the period required by tax and accounting law.

Account and service data may be retained for the duration of the agreement and afterwards for the period necessary to handle complaints, fulfil legal obligations or establish, exercise or defend claims.

Marketing data is processed until consent is withdrawn, an objection is submitted or the applicable retention period expires.

Audio samples, AI prompts, generated results and technical records are retained only for the period required for service delivery, troubleshooting, security, quality assurance or another clearly stated purpose.

Anonymised or aggregated information may be retained for longer where it no longer identifies a natural person.

Subject to the conditions laid down in applicable law, the User has the right to request:

• access to personal data
• rectification of inaccurate or incomplete data
• erasure of personal data
• restriction of processing
• data portability
• information concerning the processing of personal data

The User has the right to object to processing based on the Controller’s legitimate interests, including profiling.

The User may object at any time to processing for direct marketing purposes, including related profiling.

The User may withdraw consent at any time where processing is based on consent.

The User may unsubscribe from newsletters or promotional communications using the unsubscribe link included in the message or by contacting the Controller.

The User has the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

Requests concerning personal data may be submitted to contact@cambridge-ai.center.

The Controller will respond within the period required by applicable law. In some cases, the Controller may need to verify the identity of the requesting person.

The Website collects information voluntarily provided through contact forms, registration forms, order forms, surveys, chats, e-mails and User accounts.

Data provided in a form is processed for the purpose indicated by the context and description of that form.

The Website may record technical connection information, including IP address, timestamps, browser information, device details and security events.

Information concerning User behaviour may be logged for Website administration, troubleshooting, security, fraud prevention and statistical analysis.

Where online lessons, webinars, video calls or chats are provided, the relevant service may process information such as the participant’s name, session duration, messages, poll responses, audio or video shared during the session.

Information voluntarily posted in public areas, including comments, blogs or testimonials, may be visible to other Users.

Testimonials are published with the person’s consent and may be updated or removed following a justified request.

The Controller may use Google Analytics or similar tools to understand how Users interact with the Website and to improve Products and services.

Analytics tools may collect information such as page visits, device type, approximate location, session duration, referral source, errors and interactions with Website elements.

The Controller may use Meta Pixel or similar advertising technologies to measure campaigns, create audiences and adapt advertising messages, subject to the User’s consent choices and applicable law.

The Controller may use Tawk or another live-chat solution to communicate with Users and respond to enquiries.

The Controller may use automation tools that trigger messages or actions on the basis of User activity, provided that the applicable legal requirements have been met.

The Controller does not intentionally combine analytics data with directly identifying personal data unless this is necessary, lawful and clearly communicated.

Third-party analytics and advertising providers process data according to their own privacy policies and terms.

The Website uses cookies and may use similar technologies such as pixels, local storage and web beacons.

Cookies are small text files stored on the User’s device. They may contain a unique identifier, the name of the Website and information concerning their retention period.

Cookies may be used for:

• maintaining User sessions and login status
• remembering language, currency and other preferences
• supporting security and fraud prevention
• operating purchase, subscription and payment functions
• measuring Website traffic and performance
• analysing User interaction with the Website
• providing chat, video and embedded services
• personalising content and advertising where permitted

The Website may use session cookies, which expire after the browser is closed, and persistent cookies, which remain stored for a specified period or until deleted.

Third-party providers may place or access cookies where their services are used on the Website.

Non-essential cookies should be used in accordance with the User’s consent choices and applicable law.

Restricting cookies may affect certain Website functions and may prevent some Products or services from operating correctly.

The outdated technology historically known as Flash Cookies is not relied upon as a standard Website tracking mechanism.

Users may give, refuse or withdraw consent for non-essential cookies using the cookie settings tool available on the Website, where provided.

Users may also delete or block cookies through their browser or device settings.

Instructions are generally available for Microsoft Edge, Google Chrome, Safari, Mozilla Firefox, Opera, Android devices and Safari on iOS.

Disabling cookies required for authentication, security, account access, payments or User preferences may make some parts of the Website unavailable.

The Controller uses reasonable organisational and technical measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

Such measures may include SSL encryption, access controls, password policies, backups, software updates, firewalls, vulnerability testing, two-factor authentication, API keys, OAuth tokens and monitoring of security events.

Access to personal data is limited to persons who require it for their duties or for the provision of the relevant service.

Despite these measures, no internet transmission or electronic storage method can guarantee absolute security.

Users are responsible for protecting their passwords, access links and account credentials and should promptly report suspected unauthorised access.

Questions, comments and requests concerning this Privacy & Cookies Policy may be sent to contact@cambridge-ai.center.

Correspondence may also be sent to Cambridge School of English Sp. z o.o., Widok 10/LU 1, 00-023 Warsaw, Poland.

Company details: Tax ID (NIP) 5252147188, KRS 0000085970, REGON 016153582.

The Controller may update this Policy where the Website, Products, providers, technologies or applicable legal requirements change.

The current version of the Policy will be published on the Website together with the applicable update or effective date.