Priority of Documents
In case of any discrepancy between this document and its translations, the English version shall prevail. Additionally, the terms of Apple App Store and Google Play Store, and applicable regional legislation shall take precedence over this document where applicable.
1. Scope
This GDPR Policy applies to all individuals located in the European Economic Area (EEA) who use AtoC.ai. It supplements our Privacy Policy and sets out your rights under the General Data Protection Regulation (EU 2016/679).
2. Data Controller
Maksim Golitsyn
Mersin, Türkiye
The controller is not established in the EU/EEA. Under GDPR Article 27, we are evaluating the appointment of an EU representative. Until appointed, data subject requests and supervisory authority inquiries may be addressed directly to the controller.
3. Legal Basis for Processing
| Purpose | Legal Basis | Details |
|---|---|---|
| Provide app functionality | Art. 6(1)(b) — Contract | Account, learning data, language pairs. |
| Issue completion certificates | Art. 6(1)(a) — Consent | Certificate name is provided voluntarily; user may skip it. Stored encrypted (AES-256 at rest), not transferred to third parties, used solely to render the name on the certificate. |
| Subscriptions & payments | Art. 6(1)(b)/(c) — Contract / Legal obligation | Transaction data retained for tax/accounting. |
| Security & operation | Art. 6(1)(f) — Legitimate interest | Crash logs, diagnostics, fraud prevention. |
| Analytics & improvement | Art. 6(1)(a)/(f) — Consent / Legitimate interest | Third-party analytics SDKs require consent; EU/EEA explicit opt-in. |
| Advertising | Art. 6(1)(a) — Consent | Ad personalization requires explicit consent in EU/EEA. |
| Legal compliance | Art. 6(1)(c) — Legal obligation | Responses to lawful requests and tax obligations. |
4. Your Data Subject Rights
Under GDPR, you have the following rights:
- Right of access — Request a copy of the personal data we hold about you.
- Right to rectification — Request correction of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”) — Request deletion of your personal data, subject to legal retention obligations.
- Right to restriction of processing — Request that we limit processing under certain circumstances.
- Right to data portability — Receive your data in a structured, commonly used, machine-readable format.
- Right to object — Object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent — Withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact contact support. We will respond within 30 days.
5. Data Transfers Outside the EEA
When personal data is transferred outside the EEA, we ensure adequate protection through Standard Contractual Clauses (SCCs) or by ensuring the destination country has an adequacy decision from the European Commission. Personal data is stored primarily in Germany (Netcup). Russian users' personal data is stored in Russia (Selectel) under 152-FZ before any cross-border transfer.
6. Data Protection Officer
We are not currently required to appoint a Data Protection Officer under GDPR Article 37. If this changes, we will update this policy accordingly.
7. AI Processing
Current: AI generates grammar cards and exercises for the catalog. Content may be published before teacher/moderator review; priority in display is given to teacher-verified content. This does not involve automated decision-making about users.
Planned: Mascots and Command Competition are gamification features and do not involve automated decision-making about users.
8. Complaints
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority or with the data protection authority in the jurisdiction of the data controller.
9. UK GDPR
For users in the United Kingdom, the UK GDPR applies as retained EU law. Your rights are equivalent to those under EU GDPR, and you may lodge a complaint with the Information Commissioner's Office (ICO). The ICO Age-Appropriate Design Code applies to users under 18: high-privacy settings by default and data minimisation.