4. Categories of Personal Data Processed by the Operator

4.1. To achieve the purposes specified in this Policy, the Operator processes the following categories of personal data of Clients:

- Full name (surname, first name, and middle name, if applicable);
- Email address;
- Mobile phone number.

5. Methods and Conditions of Processing Client Personal Data

5.1. The Operator processes personal data through both automated and non-automated methods.

5.2. Clients' personal information is kept confidential, except in cases where the Client voluntarily provides information about themselves for public access.

5.3. The Operator discloses Client information to third parties only when required by applicable law, requests from government authorities, legal proceedings, court orders, or other legal processes.

5.4. The processing and storage of Client personal data is carried out until the Client terminates the services the Operator provides.

5.5. If the Client terminates the services, the personal data will be deleted by destroying the account. Once deleted, the account cannot be restored.

5.6. The Operator provides its services through its website hosted on https://getcourse.ru/. This website uses a software platform called “GETCOURSE 2.0” designed for creating online schools and organizing the learning process over the Internet. The getcourse.ru site uses the HTTPS extension to the HTTP protocol to enhance security and protect information.

5.7. Hosting and dedicated server services are provided by JSC "Selectel" (https://selectel.ru/about/details).

6. Ensuring the Security of Personal Data

6.1. The Operator takes the necessary organizational and technical measures to protect the Client’s personal information from unlawful or accidental access, destruction, alteration, blocking, copying, dissemination, and other unlawful actions by third parties. The Operator adheres to generally accepted industry standards to safeguard the personal information provided at all stages of personal data processing.

6.2. By the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, the Operator independently determines the measures necessary and appropriate to ensure compliance with the legal obligations outlined in the personal data protection legislation.

6.3. Personal data protection is achieved by:

6.3.1. Appointing a person responsible for the processing and protection of personal data;

6.3.2. Approving this Policy;

6.3.3. Regulating employee access to information containing client personal data in accordance with their job (functional) duties.

6.4. The Client can protect their data by withdrawing their consent to process their data or by other means provided by law.

6.5. The Operator and the Client take all necessary measures to prevent losses or other negative consequences caused by the loss or disclosure of the Client’s personal data.

6.6. In the event of a loss or disclosure of personal data, the Operator informs the Client of the incident.

7. Responsibilities of the Parties

7.1. In accordance with Spanish legislation, the Operator is responsible for losses incurred by the Client due to the improper use of personal data.

7.2. In the event of a loss or disclosure of confidential information, the Operator is not responsible if such confidential information:

7.2.1. Became publicly available before its loss or disclosure;

7.2.2. Was disclosed with the consent of the Client.