Політика конфіденційності

This Privacy Policy explains how BBE School, operated by a private entrepreneur (ФОП) registered in Ukraine ("BBE School," "we," "us," "our"), collects, uses, and protects your personal data when you use bbe-school.com (the "Site") and the BBE School Full Course exam preparation service (the "Service").

This Policy should be read together with our Умови використання. Capitalized terms not defined here have the meaning given in the Terms of Service.

We are committed to complying with the EU General Data Protection Regulation (GDPR) for Users located in the EU/EEA, as well as applicable Ukrainian data protection law.

Contact: info@bbe-school.com

1. Who We Are

BBE School is operated by a private entrepreneur (ФОП) registered in Ukraine. For the purposes of the GDPR, we act as the data controller for personal data collected through the Site and the Service.

We have not appointed a Data Protection Officer, as this is not currently required given the scale of our processing. Any privacy-related questions should be sent to info@bbe-school.com.

2. What Personal Data We Collect

We collect the following categories of personal data:

• Account data. When you register for an Account: your email address, first name, last name, phone number, display name, a hashed password (if you register with email), and your account creation date. If you sign in with Google, we also receive basic profile information from Google (such as name, email, and avatar) as part of the sign-in flow.
• Purchase and payment data. When you purchase the Full Course: your name, billing details, purchase history, and transaction status. Card and full payment details are handled directly by our payment processor Monobank Acquiring — we do not receive or store full card numbers.
• Usage and learning data. Your activity within the Service, including practice question attempts, answers selected, mock exam results, timed practice performance, flashcard progress, and statistics generated from this activity.
• Technical data. IP address, browser type, device type, general location (country/city level), and log data collected automatically when you use the Site, including through cookies and similar technologies (see Section 7).
• Communications. Information you provide when you contact us at info@bbe-school.com, including the content of your message and any attachments.
• Content submitted to AI features. If you use AI-generated explanations or interact with AI-powered features, the relevant question, your response, and any related input may be processed by our AI provider(s) in order to generate that content (see Section 12).

We do not intentionally collect any special categories of data (e.g., health, religious beliefs, political opinions) and ask that you do not submit such information to us.

3. How We Use Your Personal Data

We use your personal data to:

• Create and administer your Account
• Provide access to the Full Course and its features
• Process payments and maintain purchase records
• Generate AI-based explanations and personalize your practice experience
• Track your progress and display statistics within your dashboard
• Respond to support requests sent to info@bbe-school.com
• Send transactional emails (e.g., purchase confirmation, password reset, access issues)
• Detect and prevent fraud, abuse, or violations of our Terms of Service
• Maintain and improve the Site and Service, including basic analytics on usage
• Comply with legal obligations (e.g., accounting and tax records)

We do not sell your personal data to third parties, and we do not use your data to serve third-party advertising.

4. Legal Basis for Processing (EU/EEA Users)

Where the GDPR applies, we rely on the following legal bases:

5. Third Parties We Share Data With

We share personal data only with service providers who process it on our behalf ("processors"), or where legally required. Current processors include:

• Supabase, authentication, database, and related backend infrastructure
• Monobank Acquiring, payment processing
• Google, Google sign-in (when you choose that option), and Search Console / Analytics for website indexing and usage analytics where enabled
• AI providers (e.g., Anthropic, OpenAI), generating AI-based explanations and related features
• Hosting and email delivery providers, operating the Site and sending transactional messages

These providers are contractually restricted from using your data for any purpose other than providing services to us, and are required to apply appropriate security measures. We do not permit them to sell your data.

We may also disclose personal data where required by law, to protect our legal rights, or in connection with a merger, acquisition, or sale of business assets (in which case we will notify affected Users).

6. International Data Transfers

We are based in Ukraine, and some of our service providers (including Supabase, hosting providers, and AI providers) may process or store data outside your country of residence, including in the United States or other countries outside the EU/EEA.

Where we transfer personal data of EU/EEA Users outside the EU/EEA, we rely on appropriate safeguards required by the GDPR, such as Standard Contractual Clauses, or on the fact that the recipient is located in a country recognized by the European Commission as providing adequate protection, where applicable. You may contact us at info@bbe-school.com for more information about the safeguards used for a specific transfer.

7. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you logged in to your Account (strictly necessary)
• Remember your preferences on the Site
• Understand how the Site and Service are used, so we can improve them (analytics)

You can control or disable non-essential cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the Service, such as login, from working correctly.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

• Account and usage data, for as long as your Account remains active, and for a reasonable period afterward in case you wish to reactivate it, unless you request earlier deletion.
• Payment and transaction records, for the period required by Ukrainian tax and accounting law (typically several years).
• Support communications, for as long as needed to resolve your request and for a reasonable period afterward for record-keeping.

When personal data is no longer needed, we delete it or anonymize it so that it can no longer be linked to you.

9. Your Rights

If you are located in the EU/EEA, you have the following rights under the GDPR regarding your personal data:

• Доступ, request a copy of the personal data we hold about you
• Rectification, request correction of inaccurate or incomplete data
• Erasure, request deletion of your data, subject to certain exceptions (e.g., legal retention obligations)
• Restriction, request that we limit how we use your data in certain circumstances
• Portability, request your data in a structured, commonly used, machine-readable format
• Objection, object to processing based on legitimate interest, including for analytics
• Withdraw consent, where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at info@bbe-school.com. We will respond within the timeframe required by applicable law (generally within one month under the GDPR).

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection supervisory authority in the EU/EEA, in addition to contacting us directly.

Users outside the EU/EEA may also contact us to exercise similar rights where applicable under local law; we will handle such requests on a reasonable-efforts basis.

10. Children's Privacy

We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental or guardian consent, we will take steps to delete that data. Eligibility to use the Service is described in Section 2 of our Умови використання.

11. Data Security

We use reasonable technical and organizational measures to protect your personal data, including encrypted connections (HTTPS), access controls on our database and admin systems, and reliance on established infrastructure providers that maintain their own security standards.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify affected Users and relevant authorities as required by applicable law.

12. AI Features and Your Data

When you use AI-powered features, relevant content (such as the question and your input) may be sent to our AI provider to generate a response. This data is processed under contractual terms that restrict our AI providers from using it to train their models on your personal data, except where a provider offers this by default and we have not opted out: we will update this section if that changes. Accuracy limitations of AI-generated explanations are described in Section 9 of our Умови використання.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified via email or a notice on the Site. The "Last updated" date at the top of this Policy indicates when it was last revised. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Contact Us

Questions about this Privacy Policy or how we handle your personal data: info@bbe-school.com