Polpo Privacy Policy

1. General provisions

1.1. This Privacy Policy (the "Policy") sets out how the personal data of persons using the Polpo service, which comprises the polpo.by website and the application on it (the "Service"), are processed: the categories of personal data processed, the purposes of processing, the recipients, the place and periods of storage, and the rights of data subjects and how to exercise them.

1.2. Personal data operator (controller): Pavel Senko, an individual, Republic of Belarus (the "Operator"). The Operator determines the purposes and means of the processing of personal data and is responsible for it. Email address for enquiries about the processing of personal data: polpo.site@gmail.com.

1.3. The Policy applies to all persons who use the Service, visit the website and the blog, contact the Operator or make donations (the "Users"). The Policy is not a contract and does not require acceptance. The rules for using the Service are set out in the Terms of Use, and the records stored in the browser are described in the Cookie Policy.

1.4. Personal data are processed in accordance with Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection" and, in respect of Users in the European Union, also in accordance with the General Data Protection Regulation (GDPR).

2. Personal data processed

2.1. The Operator processes the following personal data:

• account data: email address, name (by default the part of the email address before the "@" sign; the User may change it), PIN in hashed form, native and target languages, level and interests. When the User signs in with Google, the Operator receives from Google the email address, name, a link to the profile photo and the Google account identifier;
• learning data: the User's words and translations, word sets and their names, answers in practice sessions with date and time, word progress, stories of the day, the reef and prizes;
• notebook photos and voice recordings, if the User uses photo recognition or the pronunciation exercise. They are not stored on the Operator's server;
• technical data: IP address, browser information, request addresses and times. They are needed for the operation and protection of the Service;
• website visit statistics: if the User has clicked "Accept all" in the cookie banner on the home page or in the blog, Yandex Metrica collects information about visits (see the Cookie Policy for details);
• messages to the Operator: email address and the text of the message. To a message sent with the "Report a problem" function, the application automatically adds the application version, languages and browser information;
• donation data: name or nickname, amount and date and, for donations via Boosty and Patreon, also the email address. The Operator does not receive payment card data.

2.2. Only the email address is mandatory: an account cannot be created without it. Other data appear as the User uses the functions of the Service.

3. Purposes and legal grounds for processing

3.1. The Operator processes personal data for the following purposes:

• creating an account and providing access to it;
• storing the User's dictionary, running practice sessions and tracking progress;
• creating examples, translation suggestions, word selections and stories of the day, recognising notebook photos and pronunciation, voicing words;
• sending emails with sign-in codes and notices of material changes;
• handling the Users' messages and requests;
• protecting the Service against failures and abuse and restoring it after outages;
• counting visits to the home page and the blog.

3.2. Processing for these purposes, except for counting website visits, is carried out on the basis of the contract with the User, which is the Terms of Use: the Service cannot function without such processing. Website visits are counted only with the User's consent given in the cookie banner. Backups and security logs are also kept in compliance with the obligation to protect information established by law. In respect of Users in the European Union, backups, logs and replies to persons without an account are based on the Operator's legitimate interest in a reliable Service and in keeping in touch with those who have contacted it.

3.3. The Operator does not sell personal data, does not show advertising and does not take decisions based solely on automated processing that affect the User's rights. The Service selects words for practice based on the User's answers; the User may change the learning stage of any word manually.

4. Transfer of personal data to third parties

4.1. The Operator engages contractors to operate the Service. Contractors receive only the data they need to perform their functions; the User's email address, name and account number are not transferred to artificial intelligence services. Information that the User enters independently (words, interests, set names) and everything shown in a photo are transferred unchanged, so the User should not include information of a personal nature in them.

4.2. Personal data are received by:

4.3. If the pronunciation exercise is recognised by the browser itself (when the Operator's server has not responded), the browser transfers the sound to its provider: Google, Apple or Microsoft (USA).

4.4. Personal data are not transferred to any other recipients. Personal data are transferred to public authorities only in the cases provided for by the legislation of the Republic of Belarus. The Operator discloses the names of the contractors and the state in which the server is located upon a data subject's request concerning their data.

5. Storage and cross-border transfer of personal data

5.1. The personal data of Users from all states and their backups are stored on a server located in a foreign state included in the list of foreign states ensuring an adequate level of protection of the rights of personal data subjects, approved by the National Personal Data Protection Center of the Republic of Belarus (the "List"). The Operator processes personal data from the territory of the Republic of Belarus.

5.2. The USA, China, Singapore, the UAE and Hong Kong are not included in the List. The transfer of personal data to their territory involves the following risks: data protection legislation provides a lower level of protection or does not apply to public authorities; there is no independent authority to which a complaint can be made; the rights of data subjects are limited and harder to exercise; public authorities and intelligence services have broad access to data. In addition, Chinese law obliges organisations to assist public authorities.

5.3. For Users in the European Union: almost all recipients in the USA are certified under the EU-U.S. Data Privacy Framework; for the backup photo recognition service in the USA, as well as for transfers to China and Singapore, there are no mechanisms provided for by the GDPR.

6. Personal data retention periods

6.1. Personal data are retained for the following periods:

6.2. Backups are used solely to restore the Service after outages. Examples, translations and word audio are kept in a shared store without any link to the User and remain after the account is deleted. The retention periods for data held by contractors that process them under their own rules are determined by those rules.

7. Rights of the data subject

7.1. The User has the right to:

• obtain information about the processing of their personal data: which data are processed, from which sources they were obtained, for what purposes and to whom they are transferred, and obtain a copy of them;
• request that their personal data be modified if they are incomplete, outdated or inaccurate;
• obtain information about the transfer of their personal data to third parties over the past year;
• withdraw consent to the processing of personal data (for website visit statistics: the "Cookie settings" button on the Cookie Policy page);
• request that the processing of their personal data be stopped and the data be deleted;
• in respect of Users in the European Union, also request the restriction of processing, receive their data in a machine-readable format and object to processing based on the Operator's legitimate interest.

7.2. The User exercises some of these rights independently in the profile: changing the name, language and level, downloading their words, logging out everywhere, deleting the account.

7.3. To exercise other rights, the User sends a request to polpo.site@gmail.com from the email address of their account: this makes it possible to establish that the request was sent by the User. To send a request in writing or as an electronic document signed with an electronic digital signature, the User may ask the Operator for its postal address by email. Information on the processing of personal data is provided within 5 working days; other requests are considered within 15 days, free of charge. If a request cannot be fulfilled (in particular, if the law requires the data to be retained), the Operator gives the reasons for the refusal.

7.4. The User may lodge a complaint about the Operator's actions: in the Republic of Belarus, with the National Personal Data Protection Center (24-3 K. Tsetkin St., Minsk 220004, cpd.by), in writing or as an electronic document signed with a Belarusian electronic digital signature, within 3 months from the day the User learned of the violation; in the European Union, with the supervisory authority of their state; in the United Kingdom, with the ICO; in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC); in Ukraine, with the Ukrainian Parliament Commissioner for Human Rights.

8. Personal data of minors

8.1. The Service may be used from the age of 16, and from 14 to 16 with the permission of the parents (other legal representatives); persons under 14 may not use the Service. The Operator does not ask for the date of birth. Notebook photo recognition may be used only from the age of 16.

8.2. If the Operator becomes aware that an account is used by a person under 14 or by a person aged 14 to 16 without the permission of their parents (other legal representatives), the Operator deletes the account. A parent (other legal representative) may contact the Operator, stating the email address of the account.

9. Personal data protection measures

9.1. The connection to the website is encrypted. The PIN is stored only in hashed form, and the number of attempts to enter the PIN and the sign-in code is limited. Only the Operator has access to the server and backups. The "Log out everywhere" function is available in the profile.

9.2. The measures taken do not completely rule out a data breach. In the event of a breach, the Operator notifies the National Personal Data Protection Center within 3 working days, the supervisory authority of the European Union within 72 hours if the breach affects persons in the European Union, and the affected persons if the breach poses a threat to their rights.

10. Changes to the Policy

10.1. The date of the current version is stated at the beginning of the Policy, and previous versions are listed at the end of the page. The Operator notifies Users of material changes in advance by email to the account's email address.

11. Language of the Policy and contact information

11.1. The main text of the Policy is drawn up in Russian; translations into other languages are made from it. Questions about the processing of personal data should be sent to polpo.site@gmail.com.