Privacy Policy

1. Who We Are (Data Controller)

• Individual Entrepreneur Sukhodolov Yurii Sviatoslavovych
• IPN (Tax Identification Number): 2979909896
• Registered address: Kapitana Kuznetsova 114/15, Odesa, 65069, Ukraine

Operating as i'm free Music School

Studio: pr. Sobornosti 17-2, Comfort Town, Kyiv, 02160, Ukraine

Contact for data protection matters:

• Email: [email protected]
• Phone: +38 (050) 62-42-951

We are the data controller for personal data collected through our website (imfree.school) and in connection with our music lesson services. This means we decide how and why your personal data is processed.

2. What This Policy Covers

This Privacy Policy explains:

• What personal data we collect
• Why we collect it and on what legal basis
• How long we keep it
• Who we share it with
• Your rights regarding your data
• How we protect your data

This policy applies to all visitors to our website, students, parents/guardians of minor students, and anyone who contacts us.

3. Personal Data We Collect

3.1 Data You Provide to Us

Contact form submissions:

This data is stored in our contact_submissions database table.

During the course of lessons, we may also collect:

• Student's age (to verify minimum age requirements)
• Parent/guardian contact details (for students under 18)
• Lesson attendance records
• Payment transaction references (we do not store card details)

3.2 Data Collected Automatically

When you visit our website, certain data is collected automatically through cookies and tracking technologies:

GTM Container ID: GTM-M3HTBN6W   Meta Pixel ID: 1428866021221542

dataLayer events we track: form_submit

3.3 Data We Do NOT Collect

• Payment card numbers, CVV, or card expiration dates
• Health or biometric data
• Data from social media profiles
• Location data beyond what analytics tools approximate

4. Why We Process Your Data and Our Legal Basis

Under GDPR Article 6, we must have a lawful basis for each type of processing:

4.1 Performance of a Contract (Article 6(1)(b))

4.2 Consent (Article 6(1)(a))

You can withdraw consent at any time -- see Section 9 for details.

4.3 Legitimate Interest (Article 6(1)(f))

We have conducted a balancing test and determined that these interests do not override your rights and freedoms. You can object to processing based on legitimate interest at any time.

5. Children's Data -- Special Protection

We teach students as young as 5 years old (piano, vocal) and 7 years old (guitar, drums). We take the protection of children's data seriously.

5.1 Students Under 16

In accordance with GDPR Article 8, for students under 16 years of age:

• We require verifiable parental consent before collecting or processing the child's personal data
• The parent/guardian must complete the contact form and consent on behalf of the child
• We collect the minimum data necessary for lesson delivery (name, age, instrument, parent contact)

5.2 Students Aged 16-17

Students aged 16 and 17 may provide their own consent for data processing. However, a parent or guardian must still agree to our Terms & Conditions for service delivery.

5.3 How We Verify Parental Consent

We verify parental consent through:

• Direct communication with the parent/guardian (phone or email)
• The parent/guardian being the person who books and pays for lessons

5.4 Parents' Rights

Parents and guardians have the right to:

• Review the personal data we hold about their child
• Request correction or deletion of their child's data
• Withdraw consent for data processing at any time

6. How Long We Keep Your Data (Retention Periods)

We do not keep your data longer than necessary. Here are our specific retention periods:

After the retention period expires, data is permanently deleted or anonymized.

We conduct annual reviews of stored data to ensure compliance with these retention periods.

7. Who We Share Your Data With (Sub-Processors)

We share personal data only with the following third-party service providers, and only to the extent necessary:

7.1 Payment Processors

We do not share your phone number, email, or other contact details with payment processors. We do not store card details.

7.2 Analytics and Advertising

7.3 Security and Email

7.4 No Selling of Data

We never sell, rent, or trade your personal data to third parties for their marketing purposes.

8. International Data Transfers

Some of our sub-processors (Google, Meta, Cloudflare, Zoho) are located in the United States and other countries outside the European Economic Area (EEA).

For these transfers, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where available
• These providers' compliance with applicable data protection frameworks

We only transfer data to third countries where appropriate safeguards are in place, as required by GDPR Chapter V (Articles 44-49).

9. Your Rights Under GDPR

As a data subject, you have the following rights. You can exercise any of these by contacting us at [email protected].

9.9 Response Time

We will respond to all data subject requests within 30 calendar days. If a request is particularly complex, we may extend this by an additional 60 days, but we will inform you within the initial 30-day period. All requests are handled free of charge, unless manifestly unfounded or excessive.

10. Cookies and Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help the website function, improve your experience, and provide information to the site owner.

10.2 Cookies We Use

Essential (always active):

Analytics (requires consent):

Advertising (requires consent):

10.3 Managing Cookies

• Cookie banner: When you first visit our site, a cookie banner allows you to accept or decline non-essential cookies.
• Browser settings: You can delete cookies or configure your browser to block them. Note that blocking essential cookies may affect website functionality.
• Google opt-out: You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS encryption on all pages of our website
• SHA256 hashing of personal identifiers before transmission to Meta (CAPI)
• Access controls limiting who can access personal data
• Regular reviews of our data processing activities and security measures
• Choosing sub-processors with strong security track records

While we take data security seriously, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

• The updated policy will be posted on our website with a new effective date
• If the changes are significant, we will make reasonable efforts to notify you
• Your continued use of our website and services after changes take effect indicates your acknowledgment of the updated policy

We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your data, please contact us:

• Email: [email protected]
• Phone: +38 (050) 62-42-951
• Address: pr. Sobornosti 17-2, Comfort Town, Kyiv, 02160, Ukraine

We take every inquiry seriously and aim to resolve any concerns promptly.