Extralingo Privacy Policy

1. Who is responsible for your data

The controller is Lingodays B.V., trading as Extralingo, Eeuwigelaan 3, 1861 CL Bergen (NH), the Netherlands, Chamber of Commerce number 69857652.

Questions about privacy? Email privacy@extralingo.com, or write to the address above, marked for the attention of Privacy.

This policy covers extralingo.com, all associated (sub)domains, your Extralingo account and booking file, our emails and notifications, our online level tests, our online meeting environment and all other services we provide (together: the "platform"). VerifiedEducators.com is operated by the same company and is also covered by this policy.

If you follow a link from the platform to a language school's website or another third party, that party's privacy policy applies there.

Language. This policy is published in English, Dutch, Danish and Swedish. The English version is the original; the other versions are translations of it. In the event of any discrepancy between the versions, the English version prevails. This does not affect your rights under the data protection law that applies to you.

2. What data we collect

Data you provide yourself

• Account details: first and last name, email address, password (stored encrypted), language preference and currency preference. You do not need an account simply to browse the platform.
• Enquiry and booking details: the school, course, dates, accommodation and extras you choose, your intended language level, date of birth, phone number, address, nationality, gender (optional), emergency contact details, and anything else you tell us.
• Payment details: name, billing address and payment details. Card details are handled by our payment provider; we do not store full card numbers ourselves.
• Communication: messages in your booking file, emails, forms, chat messages with the language school, and WhatsApp messages if you have opted into those notifications. Chat messages are stored encrypted.
• Online meetings: if you hold an online meeting with a language school through our environment, the recording, the transcript and the summary of that meeting. See section 6.
• Level tests: your answers, your score and the resulting CEFR level. You choose whether the result is saved to your account or only sent to you by email.
• Reviews and profile details: whatever you post or fill in, including a profile photo if you add one.
• Surveys and research: your answers, unless you take part anonymously.

Data we collect automatically

• IP address, browser type, device type and operating system.
• Pages visited, searches on the platform, clicks, time spent and the referring website.
• Whether you open our emails and which links you click.
• Your approximate location based on your IP address, which we use to suggest a language and currency.
• Data from cookies and similar techniques; see our cookie declaration.

Data from other sources

• Signing in with an external account: if you sign in using Google or Facebook, for example, we receive your name, email address and profile photo from that service, to the extent you allow it.
• Language schools: status information about your booking, availability, and messages the school sends about your booking file.
• Advertising and analytics services: aggregated data about how visitors reach our platform.

Data about other people that you give us. If you provide someone else's details, for example your child's or an emergency contact's, you are responsible for making sure that person knows about this and about this privacy policy.

Special category data. We do not ask for health data. If you tell us of your own accord about an allergy, a diet or a medical consideration relevant to your stay, we process it solely to carry out your booking and share it only with the language school or accommodation that needs it. Please do not share information in the chat that is not needed there, such as copies of passports or payment details.

3. Why we use your data, and on what legal basis

Where we rely on a legitimate interest, we have weighed that interest against your privacy and limited the processing to what is necessary. You can object to it; see section 10.

4. When your data goes to the language school

To handle an enquiry, we initially share only what the school needs in order to confirm availability and price, such as the course requested, the dates and the level stated. Your full contact details are shared with the language school only once your booking has been confirmed and your deposit has been received. Until then, communication stays on our platform.

After that point, the school receives the data it needs to organise your stay, including your name, date of birth, nationality, contact details, arrival details, emergency contact and any special requirements you have given us. The language school is its own controller for the use of that data and applies its own privacy policy. Where you book with a school outside the European Economic Area, see section 8.

5. Who else we share data with

• Language schools, accommodation providers and transfer providers, as described above.
• Mollie, our payment provider, for processing payments and refunds.
• Suppliers that process data on our behalf, under a data processing agreement and only on our instructions:
• Hetzner — hosting and server infrastructure (Germany)
• Cloudflare — content delivery, performance and security
• Postmark — sending transactional email
• Klaviyo — email notifications and marketing email
• Meta Platforms (WhatsApp Business Platform) — WhatsApp notifications
• Daily — video and audio for online meetings, and the transcription service it uses for that purpose
• Google — website analytics, advertising measurement, and reCAPTCHA to protect our forms against automated abuse
• Moneybird — invoicing and accounting administration
• Advisers and accountants, where necessary.
• Authorities, where we are legally required to do so or where it is necessary to protect our rights.
• An acquiring party, in the event of a merger, acquisition or transfer of all or part of the business. We will inform you if this happens.
• In aggregated or anonymised form, for example statistics on bookings per destination. You cannot be identified from that data.

We do not sell your personal data and we do not share personal data with advertisers.

6. Online meetings with a language school

If you hold an online meeting with a language school through our platform, that meeting is recorded and transcribed. All participants must consent beforehand; without consent the meeting does not take place. If you withdraw your consent during the meeting, the meeting is ended.

We use the recording to produce a summary for you and for the school, for the quality of our service, and to check that the agreements between us and the language school are being observed. The recording is kept for 90 days and then deleted. The transcript and summary are kept with your booking file.

7. How we use automation and AI

We use automated systems, including AI models, to work faster and more consistently. In practice this means:

• drafting proposed replies and draft quotes, which a member of staff reviews before anything is sent to you;
• translating messages and information about schools and destinations;
• summarising meetings and booking files;
• analysing earlier enquiries and messages to improve our service.

We do not send your personal data to external AI providers. Before content is processed by such a provider, personal data is removed or replaced, so that the provider receives only the substance of the text and not information identifying you. The transcription of online meetings is the exception: that is carried out by the supplier named in section 5 as part of the meeting service, under a data processing agreement.

We do not take decisions with legal or similarly significant effects based solely on automated processing.

8. Transfers outside the EEA

We are based in the Netherlands and process your data within the European Economic Area as a matter of principle.

If you book a language trip outside the EEA, transferring your data to the school in that country is unavoidable. That transfer is necessary to perform the contract you enter into with us (Article 49(1)(b) GDPR).

Suppliers may also process data outside the EEA. Where they do, we base the transfer on an adequacy decision of the European Commission or on the European Commission's standard contractual clauses, together with appropriate additional safeguards. If you want to know which safeguard applies to a specific transfer, email privacy@extralingo.com.

9. How long we keep your data

We keep data no longer than necessary. Some data we are required to keep: invoices and accounting records must be kept for seven years under Dutch tax law.

After the retention period, we delete or anonymise the data, unless we have to keep it longer because of a legal obligation or an ongoing dispute.

10. Your rights

You have the right to:

• access the data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• have processing restricted;
• object to processing based on a legitimate interest, and to object to direct marketing at any time;
• receive your data in a common format and have it transferred (data portability);
• withdraw consent you have given, without affecting processing that took place before you withdrew it.

You can view and change much of your data yourself in your account. For other requests, email privacy@extralingo.com. We respond within one month; for a complex request we may extend that by two months and will tell you if we do. We may ask for additional information to verify your identity.

If we delete your account, we may still have to keep some data, such as invoices, because of the tax retention obligation.

If you are unhappy with how we handle your data, we would like to hear it from you first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in the EU country where you live.

11. Security

We take appropriate technical and organisational measures, including encrypted traffic (TLS), encrypted storage of chat messages, access on a need-to-know basis, logging and regular updates. No system is completely secure. If you suspect misuse of your account or discover a vulnerability, please report it to support@extralingo.com.

12. Children and young people

You can create an Extralingo account if you are 18 or older. If the participant is younger, a parent or legal guardian creates the account and makes the booking. We process a minor participant's data solely in order to carry out the booking.

If we find that we have collected a child's data without the required permission, we delete it as soon as possible. If you think this has happened, email privacy@extralingo.com.

13. Cookies

We use cookies and similar techniques to make the platform work, to measure how it is used and, if you consent, to show and measure advertising. We also use Google reCAPTCHA to protect our forms against automated abuse; this involves data being sent to Google, including in the United States. Our cookie declaration sets out which cookies these are and how to change your choice. That declaration forms part of this privacy policy.

14. Changes

We may update this privacy policy. The current version is always published on the platform, with the date of the last change. If we make a substantial change, we will inform registered users by email or through a notice in their account.

15. Contact

Lingodays B.V. (Extralingo)

Eeuwigelaan 3, 1861 CL Bergen (NH), the Netherlands

privacy@extralingo.com