Priority of Documents
In case of any discrepancy between this document and its translations, the English version shall prevail. Additionally, the terms of Apple App Store and Google Play Store, and applicable regional legislation shall take precedence over this document where applicable.
1. Scope
This GDPR Policy applies to all individuals located in the European Economic Area (EEA) who use AtoC.ai. It supplements our Privacy Policy and sets out your rights under the General Data Protection Regulation (EU 2016/679).
2. Data Controller
Maksim Golitsyn
Mersin, Türkiye
The controller is not established in the EU/EEA. Under GDPR Article 27, we are evaluating the appointment of an EU representative. Until appointed, data subject requests and supervisory authority inquiries may be addressed directly to the controller.
3. Legal Basis for Processing
| Purpose | Legal Basis | Details |
|---|---|---|
| Provide app functionality | Art. 6(1)(b) — Contract | Account, learning data, language pairs. |
| Subscriptions & payments | Art. 6(1)(b)/(c) — Contract / Legal obligation | Transaction data retained for tax/accounting. |
| Security & operation | Art. 6(1)(f) — Legitimate interest | Crash logs, diagnostics, fraud prevention. |
| Analytics & improvement | Art. 6(1)(a)/(f) — Consent / Legitimate interest | Third-party analytics SDKs require consent; EU/EEA explicit opt-in. |
| Advertising | Art. 6(1)(a) — Consent | Ad personalization requires explicit consent in EU/EEA. |
| AI tutor & voice features | Art. 6(1)(a) — Consent | Planned features; voice recordings deleted after feedback. |
| Legal compliance | Art. 6(1)(c) — Legal obligation | Responses to lawful requests and tax obligations. |
4. Your Data Subject Rights
Under GDPR, you have the following rights:
- Right of access — Request a copy of the personal data we hold about you.
- Right to rectification — Request correction of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”) — Request deletion of your personal data, subject to legal retention obligations.
- Right to restriction of processing — Request that we limit processing under certain circumstances.
- Right to data portability — Receive your data in a structured, commonly used, machine-readable format.
- Right to object — Object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent — Withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact contact support. We will respond within 30 days.
5. Data Transfers Outside the EEA
When personal data is transferred outside the EEA, we ensure adequate protection through Standard Contractual Clauses (SCCs) or by ensuring the destination country has an adequacy decision from the European Commission. Personal data is stored primarily in Germany (Netcup). Russian users' personal data is stored in Russia (Selectel) under 152-FZ before any cross-border transfer.
6. Data Protection Officer
We are not currently required to appoint a Data Protection Officer under GDPR Article 37. If this changes, we will update this policy accordingly.
7. AI Processing
Current: AI generates grammar cards and exercises for the catalog. Content may be published before teacher/moderator review; priority in display is given to teacher-verified content. This is not AI tutoring and does not involve automated decision-making about users.
Planned: AI tutor for conversational practice, voice pronunciation check, and user-generated vocabulary/grammar from prompts. These features will require explicit consent and a Data Protection Impact Assessment (DPIA) before activation. Voice recordings will be deleted after pronunciation feedback is generated. Mascots and Command Competition are gamification features and do not involve automated decision-making about users.
8. Complaints
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority or with the data protection authority in the jurisdiction of the data controller.
9. UK GDPR
For users in the United Kingdom, the UK GDPR applies as retained EU law. Your rights are equivalent to those under EU GDPR, and you may lodge a complaint with the Information Commissioner's Office (ICO). The ICO Age-Appropriate Design Code applies to users under 18: high-privacy settings by default and data minimisation.