Privacy Policy

Polyglots Playhouse is the data controller for personal data collected through our services. Registered office: 1 Rue Pétigny, 78000 Versailles, France. Company identification details (SIREN, RCS, share capital) are available on our Legal Notice page. All processing of your data is decided and supervised by us; we do not act as a processor for any third party.

We collect only the data we need to run our programs and serve your family. Depending on whether you are a website visitor, an enrolled family, or a prospective parent, we may collect:

• Identity & contact data: parent name, postal address, email address, phone number.
• Child data: child's first name, age or date of birth, school level, allergies and safeguarding-relevant information that you choose to share at enrolment.
• Enrolment & lesson data: program selected, attendance, progress notes, internal records related to your contract with us.
• Payment data: billing identity and the payment-method reference our payment processor returns to us — we do not store full card numbers.
• Photo / video of your child: ONLY if you have given separate, written, opt-in consent for photos or videos to be taken during sessions.
• Website data: pages visited, IP address, device type, referrer, and similar analytics data (only with your consent via the cookie banner).
• Marketing data: your email address, phone number, and opt-in status — only if you explicitly opted in to receive marketing communications.

For each processing purpose, GDPR Article 6 requires us to state our legal basis. Ours are:

• Performance of contract (Art. 6.1.b): taking your booking, running the lessons, billing you, providing make-up sessions, communicating about scheduling and progress.
• Legal obligation (Art. 6.1.c): keeping accounting records (French Commercial Code) and meeting our safeguarding duty toward children.
• Legitimate interest (Art. 6.1.f): securing our website, preventing fraud, basic service-improvement analysis on aggregate (non-identifying) data. You can object at any time.
• Consent (Art. 6.1.a): sending marketing emails, placing analytics or marketing cookies, taking photos or videos of children. You can withdraw consent at any time without affecting prior processing.

We do not keep data longer than necessary for each purpose. Default retention periods:

• Prospect data (you contacted us but did not enrol): 3 years from your last contact, then deleted.
• Enrolment & lesson records: the duration of the active enrolment, plus 3 years (matching the French limitation period for contract claims).
• Accounting & invoicing records: 10 years from the end of the relevant accounting year (French Commercial Code Art. L123-22).
• Marketing consent: until you unsubscribe, then we delete your email from active mailings within 1 month.
• Website analytics consent record: 13 months, then refreshed via a new banner (CNIL recommendation).
• Photo / video of your child: kept only for the period stated in the separate consent form (typically the current school year unless you grant a longer term).

We share personal data only with the recipients listed below, each under a written processing agreement (GDPR Art. 28) where applicable. We do not sell your data and we do not transfer it outside the European Union / European Economic Area.

• Our internal team: limited to staff who need access to teach or administer your enrolment.
• Our payment processor: handles card transactions on PCI-DSS-compliant infrastructure. We receive transaction status and a token, not the card number.
• Our website hosting provider: hosts the site and stores web logs. Named in our Legal Notice.
• Our error-monitoring provider (Sentry): when something breaks on the site, a minimal report (page URL, browser type, IP address, error stack trace) is sent to Sentry so we can diagnose and fix it. Sentry's parent company is US-based; we use their EU data plane. Transfers outside the EU/EEA are covered by Standard Contractual Clauses (GDPR Art. 46). You can opt out by rejecting non-essential cookies via the cookie banner.
• Our accountant: receives invoicing data for legal-compliance bookkeeping.
• French authorities: only when required by law (e.g. URSSAF audit, safeguarding referral, judicial order).

Children's privacy is central to what we do. We collect children's data only with the parent or legal guardian's consent, and only the data we need to teach, supervise, and contact you about the child. Photos or videos of children are NEVER taken without separate, explicit written consent on a form distinct from this Privacy Policy. You can withdraw photo/video consent at any time by emailing us, and we will remove future use of existing images on request — though we cannot recall images already shared with families (for example, in a class album).

Our website uses cookies that are strictly necessary for the site to function (always on), and — only with your consent — analytics and marketing cookies. You can accept all, reject all, or customise your choice from the cookie banner, and change your mind at any time via the "Manage cookies" link in the footer. Full details are in our separate Cookie Policy.

Under the GDPR, you have the following rights over your personal data. To exercise any of them, contact us using the details in Section 11 below — we will respond within one month.

• Right of access: a copy of the data we hold about you.
• Right of rectification: correction of inaccurate or incomplete data.
• Right of erasure ("right to be forgotten"): deletion where the data is no longer needed or where you withdraw the consent it relied on.
• Right to restrict processing: we hold the data but stop using it, in the circumstances set out in GDPR Art. 18.
• Right to object: in particular, to processing based on legitimate interest and to direct marketing.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to withdraw consent at any time (does not affect processing carried out before withdrawal).
• Right to lodge a complaint with the CNIL: the French data-protection authority, at cnil.fr/fr/plaintes, if you believe your rights have been infringed.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction — including encrypted connections (HTTPS), access controls, and limited internal access on a need-to-know basis. No system is 100% secure; if we ever become aware of a personal-data breach affecting your rights and freedoms, we will notify the CNIL within 72 hours and, where required, you directly.

Your data is processed within the European Union / European Economic Area. We do not transfer personal data to third countries. Should this ever change (for example, if we move to a non-EU hosting provider), we will update this Policy, secure your data through GDPR Article 46 safeguards (Standard Contractual Clauses), and inform you in advance.

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the latest version. For material changes (new processing purpose, new category of data, new recipient), we will inform enrolled families directly by email before the change takes effect.