Privacy policy

PRIVACY AND COOKIE POLICY OF KULIN LANGUAGE CENTRE Version: 10 November 2026 GENERAL PROVISIONS 1. Kulin Language Institute attaches great importance to protecting personal data and respecting the privacy of website visitors, prospective students, enrolled students and other individuals concerned. 2. This Privacy and Cookie Policy explains which personal data we process, why we process it, the legal basis for processing, how long we retain data and the rights individuals have regarding their personal information. 3. This policy applies to the Kulin Language Centre website, the digital learning environment, registration procedures, waiting lists, course administration and all other services involving the processing of personal data by Kulin. 4. Kulin Language Centre is a trade name of Tochict, a business established in the Netherlands. 5. Tochict is generally the data controller, within the meaning of the General Data Protection Regulation (GDPR), for the processing activities described in this policy. 6. Tochict is registered with the Dutch Chamber of Commerce under registration number 77830326 and establishment number 000045498822. 7. The registered business address is Verdunplein 17, UNIT C2582, 5627 SZ Eindhoven, the Netherlands. 8. Visits to the registered business address are by appointment only. 9. For questions regarding privacy and the processing of personal data, individuals may contact info@kulin.nl. 10. Kulin can also be contacted via WhatsApp at +31 6 18939762. 11. Kulin processes personal data in accordance with the GDPR, the Dutch GDPR Implementation Act, the applicable provisions of the Dutch Telecommunications Act and other relevant Dutch and European legislation. 12. Kulin processes personal data only for specific, explicitly defined and legitimate purposes. 13. Kulin aims to collect no more personal data than is necessary for the relevant purpose. 14. Personal data will not be processed without a valid legal basis. PERSONAL DATA WE PROCESS 15. Kulin may process personal data provided directly by individuals or generated during the use of our services. 16. When completing a contact form, we may process the individual's name, email address, telephone number, subject and message content. 17. When registering a user account, we may process the individual's name, email address, securely hashed password and relevant account information. 18. When registering for a course, we may process the individual's name, contact details, selected course, preferred language, language proficiency level and stated availability. 19. When registering lesson preferences, we may process information about preferred lesson days, times of day, teaching formats and other relevant preferences. 20. During the waiting list procedure, we may process information about the registration date, waiting list status, placement offers sent and responses to those offers. 21. When accepting or declining a placement offer, we may record the date, time and details of the relevant decision. 22. During participation in a course, we may process information about the course group, lesson schedule, participation, attendance, study progress and relevant administrative arrangements. 23. Where a course includes assignments, exercises or assessments, we may process the educational information necessary for these activities. 24. When processing payments, we may process information about the amount paid, payment status, transaction reference, invoice details and any refunds. 25. Kulin does not generally process full payment card details when payments are handled through an external payment service provider. 26. When communicating by email or WhatsApp, we may process contact details, message content, transmission information and relevant correspondence. 27. When handling complaints, we may process information necessary to investigate and resolve the complaint carefully. 28. When visiting our website, technical information may be processed, including IP addresses, browser types, device types, pages visited, error messages and security-related information. 29. Where cookies or similar technologies are used, additional information may be processed in accordance with the cookie provisions of this policy. 30. Kulin does not request special categories of personal data, such as medical information, religious beliefs or other sensitive information, unless processing is necessary in exceptional circumstances and a valid legal basis exists. 31. Individuals are requested not to share unnecessary sensitive personal information through contact forms, email or WhatsApp. PURPOSES AND LEGAL BASES FOR PROCESSING 32. Kulin processes personal data only where a legal basis exists under Article 6 of the GDPR. 33. To respond to general enquiries, we process contact details and message content based on our legitimate interest in responding to requests or, where the enquiry concerns a potential agreement, taking steps prior to entering into a contract. 34. To create and manage user accounts, we process the necessary information based on the performance of a contract or the implementation of pre-contractual measures. 35. To process course registrations and manage waiting lists, we process personal data necessary for providing the registration service. 36. To organise course groups and offer suitable placements, we process information about course selections, language levels and availability based on the performance of the agreement. 37. To send placement offers and process acceptances or refusals, we use personal data necessary for performing the registration or course agreement. 38. To organise and deliver lessons, we process the necessary information based on the performance of the course agreement. 39. To administer payments, invoices and refunds, we process personal data based on the performance of the agreement and applicable legal obligations. 40. To comply with tax and administrative retention requirements, we process information based on a legal obligation. 41. To handle complaints, we process personal data based on the performance of the agreement, applicable legal obligations or our legitimate interest in handling complaints carefully. 42. To secure the website, prevent misuse and investigate technical incidents, we may process information based on our legitimate interest in providing secure digital services. 43. To send necessary service communications, such as registration confirmations, placement offers, payment notifications and timetable changes, we process information based on the performance of the agreement. 44. We obtain prior consent for sending commercial newsletters and other marketing communications where required by law. 45. Where commercial communications are legally permitted without separate consent on the basis of an existing customer relationship, we always provide a simple opportunity to object or unsubscribe. 46. Where personal data is processed based on consent, that consent may be withdrawn at any time. 47. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. 48. Where we process personal data based on a legitimate interest, we balance our interests against the rights and freedoms of the individuals concerned. ONLINE REGISTRATIONS AND WAITING LISTS 49. Kulin uses a digital registration system through which interested individuals can apply for available language courses. 50. During registration, the information necessary to process the application administratively is recorded. 51. Where a course place is not immediately available, the student may be placed on a waiting list. 52. Waiting list information is used to inform students about suitable course opportunities. 53. When organising course groups, Kulin may take into account the selected language level, available lesson days, preferred times of day and other relevant preferences. 54. When a course place becomes available, Kulin may send a placement offer to the registered email address. 55. Kulin may record whether a placement offer has been accepted, declined or left unanswered. 56. This information is used only to manage the placement procedure, course administration and any related disputes. 57. When a registration is terminated, personal data will be deleted or anonymised once it is no longer necessary for the purposes for which it was collected, unless a statutory retention obligation or another valid legal basis applies. USER ACCOUNTS AND DIGITAL LEARNING ENVIRONMENT 58. Where Kulin provides user accounts, the necessary account information is processed to manage access to digital services. 59. Passwords are not stored in readable form but are protected using an appropriate cryptographic hashing method. 60. Users are responsible for handling their login credentials carefully. 61. Kulin may process technical information about login attempts, sessions and account activities to maintain system security. 62. Where a digital learning environment is provided, information about course participation and study activities may be processed insofar as necessary for delivering education. 63. Access to educational information is restricted to individuals who require it for their work. 64. Teachers are granted access only to personal data necessary for teaching, guidance and any assessments. 65. Kulin may delete or anonymise accounts and associated information when they are no longer necessary, subject to statutory retention periods. PAYMENTS THROUGH STRIPE 66. Kulin may use Stripe as an external payment service provider to process online payments. 67. When a payment is processed through Stripe, the personal data necessary for the payment is processed by Stripe in accordance with the applicable contractual arrangements and privacy terms. 68. Depending on the payment method, Stripe may process information such as names, payment details, transaction information, IP addresses and information necessary for fraud prevention. 69. Kulin generally receives the information necessary to establish payment status and maintain financial records. 70. Kulin does not store full payment card numbers or card security codes in its own course administration system. 71. Stripe may act as an independent data controller for certain processing activities and as a data processor for others. 72. For more information about Stripe's processing of personal data, individuals can consult Stripe's privacy policy at https://stripe.com/privacy. 73. Where Stripe processes personal data outside the European Economic Area, appropriate safeguards must be in place in accordance with the GDPR. COMMUNICATION BY EMAIL AND WHATSAPP 74. Kulin uses email to communicate about registrations, waiting lists, placement offers, course participation, payments and other education-related matters. 75. These messages are considered necessary service communications where they are directly related to a requested or agreed service. 76. Separate marketing consent is not automatically required for necessary service communications. 77. Kulin may also use WhatsApp to answer questions and provide practical information. 78. When an individual contacts Kulin through WhatsApp, their telephone number, profile name and message content may become visible to Kulin. 79. WhatsApp is offered as an additional communication channel and is not mandatory for participation in a course. 80. Individuals who do not wish to use WhatsApp may communicate through email instead. 81. When using WhatsApp, personal data may be processed by WhatsApp and its associated service providers in accordance with their own privacy terms. 82. Kulin requests that individuals do not send sensitive documents, identity documents or other unnecessary personal information through WhatsApp. 83. Kulin does not use contact details to send unsolicited commercial WhatsApp messages without a valid legal basis. SHARING PERSONAL DATA WITH THIRD PARTIES 84. Kulin does not sell personal data to third parties. 85. Personal data is shared with external parties only where necessary for our services, required by law or supported by another valid legal basis. 86. Kulin may use hosting providers and technical service providers to operate and maintain the website and digital learning environment. 87. Kulin may use email service providers to send necessary messages and manage electronic communications. 88. Kulin may use payment service providers to process payments and refunds. 89. Teachers and other educational staff may be granted access to personal data necessary for their educational activities. 90. When handling complaints, relevant information may be shared with an independent complaints handler where such a person has actually been appointed and the sharing is necessary and lawful. 91. Where an external party processes personal data on behalf of Kulin, we enter into a data processing agreement when required by the GDPR. 92. Kulin requires relevant service providers to implement appropriate measures to protect personal data. 93. External parties may not use personal data for their own purposes when acting solely as processors on behalf of Kulin. 94. Where an external party acts as an independent data controller, that party is subject to its own legal obligations. INTERNATIONAL DATA TRANSFERS 95. Kulin aims to process personal data within the European Economic Area wherever possible. 96. When using international service providers, personal data may be processed outside the European Economic Area. 97. Such transfers take place only where the applicable GDPR requirements have been met. 98. Where necessary, appropriate safeguards are applied, such as an adequacy decision by the European Commission or approved Standard Contractual Clauses. 99. Individuals may contact Kulin for further information about the safeguards applicable to international data transfers. DATA RETENTION PERIODS 100. Kulin does not retain personal data longer than necessary for the purpose for which it was collected, unless a statutory obligation or another valid legal basis requires a longer retention period. 101. Information from general contact enquiries will generally be deleted no later than twelve months after the last substantive communication, unless further retention is necessary. 102. Information relating to terminated waiting list registrations will generally be deleted or anonymised no later than six months after termination, unless a statutory retention obligation, ongoing dispute or another valid reason justifies longer retention. 103. Information relating to active students will be retained for as long as necessary to perform the course agreement. 104. Administrative course information will generally be retained for a maximum of two years after course completion, unless a longer period is necessary or legally required. 105. Financial records, including relevant invoices and payment information, will be retained for the applicable statutory tax retention period, which is generally seven years for basic financial records in the Netherlands. 106. Complaint records will generally be retained for a maximum of two years after final resolution, unless longer retention is necessary for an ongoing dispute or another lawful reason. 107. Technical log files will generally be retained for a maximum of ninety days, unless longer retention is necessary for security investigations, incident handling or legal obligations. 108. Information processed exclusively on the basis of marketing consent will be deleted when consent is withdrawn and no other legal basis for continued retention exists. 109. Once a retention period has expired, personal data will be deleted or irreversibly anonymised. SECURITY OF PERSONAL DATA 110. Kulin implements appropriate technical and organisational security measures to protect personal data. 111. These measures are proportionate to the nature of the personal data, the purposes of processing and the risks to individuals. 112. Where appropriate, Kulin uses secure connections, access restrictions, password protection and other technical security measures. 113. Access to personal data is restricted to employees, teachers and service providers who require the information for their work. 114. Kulin aims to keep systems and software up to date and assess security risks in a timely manner. 115. In the event of a personal data breach, Kulin assesses whether notification to the Dutch Data Protection Authority is required. 116. Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, those individuals will be informed when required by the GDPR. RIGHTS OF DATA SUBJECTS 117. Individuals have various rights concerning their personal data under the GDPR. 118. Individuals have the right to receive information about the processing of their personal data. 119. Individuals may request access to the personal data that Kulin processes about them. 120. Individuals may request the correction of inaccurate or incomplete personal data. 121. Individuals may request the deletion of personal data under the conditions established by law. 122. Individuals may request restriction of processing under the applicable legal conditions. 123. Individuals may object to processing based on legitimate interests. 124. Individuals may exercise the right to data portability under the applicable legal conditions. 125. Where processing is based on consent, that consent may be withdrawn at any time. 126. Kulin generally responds to requests concerning privacy rights within one month of receipt. 127. Where a request is particularly complex or multiple requests have been submitted, the response period may be extended in accordance with the GDPR. 128. Where an extension is necessary, the individual will be informed within the original response period. 129. Kulin may request additional information where necessary to verify the identity of the requester in a proportionate manner. 130. Kulin will not request more personal data than necessary for identity verification. 131. Requests may be submitted to info@kulin.nl. 132. Individuals also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) through https://autoriteitpersoonsgegevens.nl. USE OF COOKIES AND SIMILAR TECHNOLOGIES 133. The Kulin website may use cookies and similar technologies to ensure that the website functions properly, support security and provide certain features. 134. Cookies are small text files that may be stored on a device when visiting a website. 135. Similar technologies may include local browser storage, session storage and other mechanisms through which information is stored on or accessed from a device. 136. Not all cookies process personal data, but where cookies or similar technologies process personal data, the GDPR also applies. 137. Kulin distinguishes between necessary cookies, functional cookies, analytical cookies and marketing cookies. 138. Cookies are placed or accessed only where a valid legal basis exists. NECESSARY AND FUNCTIONAL COOKIES 139. Necessary cookies are cookies technically required for the operation of the website or for providing a service expressly requested by the visitor. 140. These cookies may be used to manage user sessions, secure forms, process login information and support the registration procedure. 141. The website may use session cookies to keep users logged in while navigating the website and to enable forms to function properly. 142. The website may use security cookies, including cookies that help protect against unauthorised form submissions and other forms of misuse. 143. Prior cookie consent is not required for strictly necessary cookies. 144. Functional cookies may be used to remember settings selected by visitors, such as their preferred language or other website preferences. 145. Functional cookies that do not qualify for a statutory exemption from the consent requirement will be placed only after valid consent has been obtained. 146. Wherever possible, Kulin limits the retention period of necessary and functional cookies to what is required for their purpose. ANALYTICAL COOKIES 147. Kulin may use analytical cookies to gain insight into website usage and performance. 148. Analytical information may relate to pages visited, technical errors, general usage patterns and the operation of website features. 149. Kulin aims to process analytical information in aggregated or pseudonymised form wherever possible. 150. Analytical cookies that have no or only a limited impact on visitors' privacy may qualify for an exemption from the consent requirement under the applicable legal conditions. 151. Analytical cookies that do not meet the conditions for this exemption will be placed only after prior consent. 152. Kulin does not automatically use analytical information to personally identify individual visitors. MARKETING COOKIES AND EXTERNAL SERVICES 153. Marketing cookies may be used to personalise advertisements, measure campaign reach or track visitors across different websites. 154. Kulin places marketing cookies only after the visitor has provided valid prior consent. 155. Refusing marketing cookies does not affect the visitor's ability to use the basic features of the website. 156. Where Kulin integrates external services, such as videos, maps, social media or other third-party content, these services may use cookies or similar technologies. 157. Non-essential cookies from such external services will not be placed before the required consent has been obtained. 158. Where necessary, Kulin informs visitors about the external parties involved and their privacy and cookie policies. 159. Opening an external website through a link on the Kulin website may result in personal data being processed by the relevant external party. 160. Kulin is not responsible for the independent processing of personal data by external websites but aims to inform visitors clearly when they leave the Kulin website. COOKIE PREFERENCES AND CONSENT 161. Where the website uses cookies requiring consent, visitors will be informed in advance through a cookie banner or a comparable consent mechanism. 162. Visitors will be given the opportunity to accept or reject non-essential cookies. 163. Rejecting cookies will not be made unnecessarily more difficult than accepting them. 164. Non-essential cookies requiring consent will not be placed before the visitor has made a valid choice. 165. Closing a cookie banner, continuing to browse the website or failing to respond will not be regarded as valid consent. 166. Where different categories of non-essential cookies are used, visitors may adjust their preferences for each category. 167. Visitors may withdraw previously given consent at any time through the available cookie settings. 168. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. 169. Kulin may retain the visitor's cookie preferences to avoid repeatedly requesting the same choice during every visit. 170. A cookie or similar storage technology used exclusively to remember the visitor's cookie preferences may, under the applicable conditions, be used without separate consent. 171. Visitors may also manage or delete cookies through their internet browser settings. 172. Blocking strictly necessary cookies may prevent certain website features, such as logging in or registering online, from functioning correctly. COOKIE OVERVIEW 173. Kulin provides visitors with information about the cookies and similar technologies actually used, including their names, providers, purposes, categories and retention periods. 174. The specific cookie inventory is based on the cookies and similar technologies actually used by the website and its integrated external services. 175. Technical cookies generated by the web framework used may include cookies relating to session management and protection against unauthorised form submissions. 176. Where external payment services, analytics platforms or other integrated services use cookies, these will be included in the cookie overview insofar as they are placed or accessed through the Kulin website. 177. Kulin periodically checks whether the cookie overview corresponds to the actual operation of the website. 178. Where new non-essential cookies are introduced, visitors will be informed and, where necessary, asked to provide consent again. AUTOMATED DECISION-MAKING AND PROFILING 179. Kulin may use automated processes to register applications, manage waiting lists and administratively process placement offers. 180. These processes may use objective information such as course selection, language level and stated availability. 181. Kulin does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for individuals, unless a valid legal basis exists and the applicable GDPR requirements have been met. 182. If such decision-making is introduced in the future, Kulin will inform the individuals concerned in accordance with its legal obligations. PRIVACY OF MINORS 183. Where Kulin provides educational services to minors, it takes into account the additional protection required for their personal data. 184. Where legally necessary, consent or involvement from a parent or legal guardian will be requested. 185. Kulin does not collect personal data from minors that is unnecessary for the relevant educational service. 186. When offering online services to children, the applicable legal requirements concerning consent and information provision will be observed. AMENDMENTS TO THE PRIVACY AND COOKIE POLICY 187. Kulin may amend this Privacy and Cookie Policy when its services, technologies, data processing activities or applicable legislation change. 188. The most recent version will be published on the Kulin website. 189. Where substantial changes affect the rights or reasonable expectations of individuals, Kulin will provide additional information when legally required. 190. Where new processing activities require consent, such consent will be obtained before the relevant processing begins. CONTACT AND FINAL PROVISIONS 191. Individuals may contact Kulin Language Institute with questions, comments, requests or complaints concerning privacy and cookies. 192. Kulin Language Institute is a trade name of Tochict, registered with the Dutch Chamber of Commerce under number 77830326 and establishment number 000045498822. 193. The registered business address is Verdunplein 17, UNIT C2582, 5627 SZ Eindhoven, the Netherlands. 194. Visits to the registered business address are by appointment only. 195. Kulin can be contacted by email at info@kulin.nl and via WhatsApp at +31 6 18939762. 196. This policy must be read together with Kulin's study terms and conditions and separate complaints policy. 197. If any provision of this policy conflicts with mandatory applicable privacy law, the applicable law shall prevail. 198. Kulin is committed to processing personal data carefully, transparently and securely and to respecting the privacy rights of all individuals concerned.