Privacy Policy
Effective from: 18 September 2026
Quiz privacy update: 30 September 2026 (section 16).
Part II - TalkNative Privacy Policy
Effective date: 18 September 2026
1. Who is the data controller?
- The controller of personal data processed in connection with TalkNative is Fundacja Rozwoju Przedsiębiorczości “Twój StartUp”, with its registered office at ul. Żurawia 6/12, lok. 766, 00-503 Warszawa, Poland.
- This Privacy Policy concerns services provided through the organised part of the Foundation operating under the name TalkNative and the Website https://talknative.pl.
- Operational contact for TalkNative: Patrick O'Sullivan, office@talknative.pl, +48 727 702 000.
- For matters concerning personal-data rights, the Foundation may also be contacted at rodo@twojstartup.pl.
2. What personal data may be processed?
- Identification and contact data, such as name and email address, and telephone number where voluntarily provided or required for a particular contact method.
- Booking data, including selected date/time, Service selected, booking status and communications concerning the booking.
- English-level assessment data, including quiz answers, result and information needed to identify and communicate the assessment.
- Lesson and customer-service information, including learning goals, lesson history, attendance, communications, complaints and information voluntarily provided during lessons or consultations.
- Payment and transaction information needed to identify and reconcile a payment. Full card details are ordinarily processed by Stripe rather than stored by TalkNative.
- Technical and security data, such as IP address, device/browser information, server logs, authentication events and other information necessary to operate and secure the Website.
- Analytics information where the user has consented to optional analytics technologies, including information generated through Google Analytics 4.
3. Why is personal data processed and on what legal basis?
| Purpose | Typical data | Legal basis |
|---|---|---|
| Provide and manage paid lessons, packages and bookings | Name, email, booking, lesson and payment/transaction data | Art. 6(1)(b) GDPR - performance of a contract or steps requested before entering into a contract. |
| Provide the free 25-minute consultation | Name, email, booking details and information voluntarily provided | Art. 6(1)(b) GDPR where the consultation is requested as a step before a possible contract; where appropriate, Art. 6(1)(f) GDPR - legitimate interest in responding to an enquiry and administering the requested consultation. |
| Provide the English-level assessment | Name, email, quiz answers and result | Art. 6(1)(b) GDPR where the assessment is requested as a pre-contractual step; where appropriate, Art. 6(1)(f) GDPR - legitimate interest in providing and administering the requested assessment. |
| Process and reconcile payments | Transaction identifiers, amount, payment status and billing information | Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR where processing is required by accounting/tax law. |
| Meet legal, accounting and tax obligations | Contract, transaction, invoice and related records | Art. 6(1)(c) GDPR - compliance with legal obligations. |
| Establish, exercise or defend legal claims | Relevant contract, communication and transaction records | Art. 6(1)(f) GDPR - legitimate interest in protecting legal rights and resolving disputes. |
| Operate, secure and troubleshoot the Website | Technical logs, IP/device data, security and authentication records | Art. 6(1)(f) GDPR - legitimate interest in secure and reliable operation; where a technology legally requires consent, Art. 6(1)(a) GDPR may apply. |
| Measure Website use through Google Analytics 4 | Online identifiers and analytics events, depending on configuration | Art. 6(1)(a) GDPR - consent, where consent is required. Analytics should not be activated before the required consent is obtained. |
| Respond to ordinary enquiries | Name, email and enquiry content | Art. 6(1)(f) GDPR - legitimate interest in responding to communications; Art. 6(1)(b) GDPR where the enquiry concerns steps toward a contract. |
| No newsletter |
|---|
| TalkNative does not currently operate a newsletter. Personal data collected for a consultation, level assessment, booking or lesson are not treated as consent to receive an unrelated newsletter or recurring marketing emails. |
4. English-Level Assessment
- The level assessment is intended to provide an approximate indication of English level and may be used to discuss suitable lessons or course level.
- The assessment result is not an official qualification, does not result in a certificate and may not fully reflect all language skills.
- Name and email address are collected so the assessment can be associated with the participant and the result or relevant follow-up can be communicated.
5. Free Consultation
- When a person books a free 25-minute consultation, TalkNative may process their name, email address, appointment details and information they voluntarily provide during the consultation.
- The information is used to arrange and conduct the consultation, understand the prospective student’s learning needs and provide information about suitable TalkNative services.
- Attending the free consultation does not create an obligation to purchase services and does not create an entitlement to further free lessons.
6. Recipients and Service Providers
- Personal data may be made available to entities which process data on behalf of the controller where this is necessary to operate TalkNative, subject to appropriate contractual and legal safeguards.
- Depending on the feature used, relevant service providers may include: Vercel (website hosting and infrastructure), Google Analytics 4 (analytics, where consented), Google Firebase (teacher/admin authentication and related backend functions), Google Calendar (booking and availability management), Google Workspace (business email and Google services) and Stripe (online payment processing).
- Data may also be disclosed to professional advisers, accounting/legal providers, public authorities or other recipients where required or permitted by law.
7. International Data Transfers
- Some technology providers used by TalkNative are international groups and processing may involve countries outside the European Economic Area.
- Where personal data are transferred outside the EEA, the controller or relevant provider will rely on an applicable lawful transfer mechanism, such as a European Commission adequacy decision, the EU Standard Contractual Clauses or another mechanism permitted by data-protection law, as applicable to the transfer.
- Information on the safeguards applicable to a particular provider may be obtained from the provider’s privacy documentation or by contacting the controller where appropriate.
8. How long is personal data kept?
- Personal data are kept only for as long as reasonably necessary for the purpose for which they were collected, taking account of legal, accounting, tax, contractual and claims-related retention requirements.
- Contract and transaction records may be kept for the periods required by applicable accounting and tax law and for relevant limitation periods.
- Enquiry, consultation and assessment information that does not lead to a paid Service will be reviewed and deleted or anonymised when it is no longer reasonably needed for the purpose for which it was collected, unless a legal basis requires or permits longer retention.
- Analytics data are retained according to the applicable analytics configuration and consent choices and should not be kept longer than necessary for the stated analytics purpose.
- Authentication/security logs may be retained for a period reasonably necessary to protect the Website, investigate incidents and comply with legal obligations.
9. Is providing data mandatory?
- Providing data required for a booking, payment or paid Service is generally necessary to conclude and perform the relevant Contract. If required information is not provided, the Service may not be bookable or deliverable.
- Providing optional information is voluntary. A Client should avoid providing sensitive or irrelevant personal information.
10. Special-category and sensitive data
- TalkNative does not normally require health information, political opinions, religious beliefs or other special-category personal data in order to provide English lessons.
- During conversational lessons a student may voluntarily mention personal or sensitive matters. Students are encouraged not to disclose sensitive information unless genuinely necessary.
- Where special-category data are intentionally retained rather than merely mentioned transiently in a conversation, an appropriate legal basis under applicable data-protection law must exist.
11. Automated decision-making and profiling
- TalkNative does not use the English-level assessment to make decisions that produce legal effects or similarly significant effects solely by automated means.
- The assessment may calculate or present an approximate level result, but it is an educational indication rather than an official or legally significant determination.
- TalkNative does not currently use personal data for automated marketing profiling.
12. Your rights
- Subject to the conditions in the GDPR, a person may have the right to access their personal data, correct inaccurate data, request erasure, request restriction of processing, receive certain data in a portable format, object to processing based on legitimate interests, and withdraw consent where processing is based on consent.
- Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
- Requests may be sent to office@talknative.pl or rodo@twojstartup.pl.
- A person who believes that their personal data are processed in breach of data-protection law may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych - UODO).
13. Security
- TalkNative and the controller use organisational and technical measures appropriate to the nature of the processing to protect personal data against unauthorised access, loss, alteration or disclosure.
- No internet-based service can guarantee absolute security. Users should protect their devices, accounts and access links and should notify TalkNative if they suspect unauthorised access.
14. Changes to this Privacy Policy
- This Privacy Policy may be updated when the Website, services, technology providers or legal requirements change.
- The current version will be made available on the Website with its effective date.
15. Contact
TalkNative operational contact: office@talknative.pl | +48 727 702 000
FRP data-protection contact: rodo@twojstartup.pl
16. Quiz privacy and retention update
Quiz/prospect processing update - 30 September 2026. This section specifies the quiz lifecycle and takes precedence over the general assessment-retention wording above; unrelated service, transaction and rights provisions remain unchanged.
Name, email, numeric score, approximate CEFR level and learning goals are submitted through the website to server-controlled Google Firebase/Firestore for teacher review and contact about suitable lessons. The teacher explicitly verifies and approves the intended student account. Answers are used for scoring in the browser and are not sent to the review database. Quiz completion or score does not authorize payment.
Incomplete quiz drafts may contain contact details, goals, answers, questions and progress in local browser storage. They expire seven days after the draft was first saved, without extending that deadline on edits. Expired or undated legacy drafts are discarded when the website next runs; a closed browser cannot erase stored bytes by itself. Successful submission or leaving for booking clears the draft. Results are displayed on screen.
Pending quiz records expire 30 days after submission; dismissed/not-proceeding records expire seven days after dismissal; approved/reviewed quiz records expire 30 days after teacher review. These dates are set by the server. Expired records are unavailable in the teacher review workflow. An authenticated automatic cleanup is scheduled every 15 minutes to delete expired transient records; physical removal follows a successful run and can be delayed by service outages or a backlog. Missing or invalid historical timestamps require investigation rather than unsafe deletion.
Deletion of a transient quiz does not delete the permanent student identity, independent teacher approval/evidence, sign-in invitation state, credits, bookings or financial records, which have their own purposes and retention requirements. Vercel hosts the website and server requests; Google Firebase supports quiz storage and teacher/student authentication. Separate passwordless sign-in invitations continue to use Firebase and the configured email delivery provider.
This version sends no new quiz prospect data to Google Sheets or Apps Script and sends no quiz-result or quiz-notification emails. Analytics is disabled in this launch version, including after consent; quiz data and sign-in URLs are not sent to GA4 by this version. Historical Sheets, email, provider-log or backup copies are not erased by the application cleanup and must be handled separately by the controller. Contact the controller using the addresses above for relevant requests.