PRIVACY POLICY

Algorithmics OÜ (operating under the brand “Algorithmics School”)
Last updated: 23 December 2025

 

1. GENERAL INFORMATION

Algorithmics OÜ (registry code 16680942), operating under the brand name Algorithmics School, is a private educational institution registered in Estonia (EHIS ID: 2121711).

Algorithmics OÜ acts as the Data Controller within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”) and is responsible for determining the purposes and means of processing personal data.

This Privacy Policy explains how we process personal data of (i) students aged 6–18, (ii) parents and legal guardians, and (iii) prospective clients and website users.

We process personal data in accordance with GDPR and applicable Estonian legislation and apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction.

2. SCOPE OF DATA PROCESSING

Algorithmics OÜ processes personal data only in relation to its own educational activities in Estonia.

• Personal data of Estonian students and leads is not shared with Algorithmics schools.
• Personal data is never sold, rented, or shared for commercial purposes.
• In exceptional cases, where a foreign individual (e.g. from another country) contacts us seeking education services that we cannot provide locally, their contact details may be referred once to a relevant local school solely to assist the individual, and not for marketing or sales purposes.

3. CATEGORIES OF PERSONAL DATA PROCESSED

3.1 Students and Parents / Legal Guardians

We process only personal data that is necessary for providing education services and fulfilling legal obligations.

Parents / legal guardians:

• full name
• phone number
• email address
• personal identification number (isikukood)

Students:

• full name
• personal identification number (isikukood)

Personal identification numbers are processed strictly where required by Estonian law, including registration in the Estonian Education Information System (EHIS), reporting to the Ministry of Education and Research, the Tax and Customs Board, and statutory declarations (e.g. INF3). Such data is not used for any other purpose.

We:

• do not photograph students,
• do not record lessons,
• do not collect biometric data,
• do not process special category personal data beyond legal requirements.

3.2 Website Users and Prospective Clients

When individuals voluntarily submit inquiries via our website or online campaigns, we may process:

• name
• email address
• phone number

No cold contact policy: As a school policy, we do not send cold emails or make cold calls. We contact individuals only when they have voluntarily submitted their contact details (e.g. via our website or campaigns) or when there is an existing contractual relationship.

Keeping contact for future enrolment (optional request): If a parent requests to be contacted in the future (e.g. the child is currently 5 and the parent wishes to enroll when the child turns 6), we may keep the parent’s contact details and contact them later based on our legitimate interest and/or the parent’s request. The parent may ask us to delete these details at any time.

4. CHILDREN’S DATA AND CONSENT

We provide educational services to children aged 6–18.

• Children cannot register independently.
• All enrolments are completed by a parent or legal guardian.
• Personal data processing is based on a digitally signed contract concluded with the parent or legal guardian.

5. LEGAL BASES FOR PROCESSING

We process personal data on the following lawful grounds:

• Performance of a contract (Article 6(1)(b) GDPR)
• Compliance with legal obligations (Article 6(1)(c) GDPR), including education and tax laws
• Legitimate interest (Article 6(1)(f) GDPR), such as school administration, operational communication, and dispute resolution

Where consent is required, it is obtained through the signed contract or other clear consent mechanism.

6. CALL RECORDING

Telephone calls may be recorded with a prior notice, such as: “This call may be recorded for dispute resolution purposes.”

Call recordings are used only for:

• resolving disputes,
• confirming agreements or registrations,
• legal protection of Algorithmics OÜ.

Recordings are retained only until the relevant issue is resolved and are not used for marketing, profiling, or monitoring behaviour.

7. DATA STORAGE AND SECURITY

Personal data is stored in secure systems, including:

• customer relationship management (CRM) systems,
• learning management systems (LMS),
• accounting and invoicing systems.

All systems are hosted within the European Economic Area (EEA) (to our knowledge). Access to personal data is limited to authorised personnel only.

In the event of a personal data breach, we will notify the supervisory authority and affected individuals in accordance with GDPR.

8. DATA RETENTION

We retain personal data only for as long as necessary for the purposes described above and as required by law:

• Accounting and invoice data: typically 5–7 years, in accordance with Estonian legal requirements and standard accounting practices
• Student education records (EHIS): as required by applicable education regulations
• Prospective clients who do not enrol: deleted once communication ends, unless the person requests future contact (see Section 3.2) or requests deletion earlier

9. THIRD PARTIES

We may disclose personal data only to the extent necessary to provide our services and comply with legal obligations, for example:

• payment and accounting service providers (e.g. invoice references such as invoice number / payment reference)
• SMS service providers (name and phone number for lesson-related communication)

All third parties process personal data solely on our instructions and do not reuse or disclose it further for their own purposes.

10. COOKIES

Our website uses cookies necessary for basic functionality. A cookie banner is displayed to inform users.

Users may disable cookies in their browser settings; however, some website features may become unavailable.

11. RIGHTS OF DATA SUBJECTS

Data subjects have the following rights under GDPR:

• the right to access personal data
• the right to rectify inaccurate data
• the right to restrict processing
• the right to have personal data erased (where applicable)
• the right to data portability (where applicable)
• the right to object to processing (where applicable)
• the right to withdraw consent at any time (if processing is based on consent), without affecting the lawfulness of prior processing
• the right to lodge a complaint with a supervisory authority

12. SUPERVISORY AUTHORITY

Complaints may be submitted to the supervisory authority:

Estonian Data Protection Inspectorate (AKI)
https://www.aki.ee

13. CONTACT INFORMATION

For all questions related to personal data processing, please contact us:

Email: [email protected] 
Phone: +372 5311 7070