Korean Slang
SchoolFree trial
Back to Korean Slang School

Privacy Notice

Effective date: 1 September 2026

This Privacy Notice explains how Hyunju Cha processes personal data when you visit the Korean Slang School website, send a lesson enquiry, or submit the group-course registration form. It is intended to provide the information required by Articles 12 and 13 of Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR).

This notice covers the collection and handling of personal data through these website-related channels. It does not cover the subsequent processing of student records for lesson delivery, payment, invoicing, accounting, Google Classroom, Zoom, WhatsApp, or other teaching activities after a student relationship has been established. Where such processing applies, it must be addressed separately.

1. Data controller

The controller responsible for the processing described in this notice is:

Hyunju Cha
IČO: 09635874
Tusarova 1263/7
170 00 Praha 7 – Holešovice
Czech Republic
Email: hyunju@krslang.school

Hyunju Cha has not appointed a data protection officer. Questions about this notice and requests concerning personal data should be sent directly to the email or postal address above.

2. Personal data covered by this notice

Depending on how you interact with the website, the following categories of personal data may be processed:

  • Website technical data: IP address, date and time of a request, requested page or resource, HTTP response information, browser or user-agent information, referring page, and other information normally recorded in server access or security logs.
  • Lesson enquiry data: name, email address, Korean-language level, preferred lesson format, and any goals, availability, or other information included in the optional message.
  • Group-course registration data: full name, email address, phone number, confirmation that you understand the course and payment conditions, and confirmation that you have read and agree to the course cancellation and refund policy.
  • Correspondence data: the content and metadata of subsequent emails relating to an enquiry or registration.

This data is obtained directly from you, except for technical data that is generated automatically when your device communicates with the website.

No special categories of personal data are intentionally requested. Please do not include health information or other sensitive personal data in a free-text message unless it is genuinely necessary for your enquiry.

3. Purposes and legal bases

3.1 Website operation and security

Technical data may be processed to deliver the website, diagnose faults, maintain availability, prevent misuse, and investigate security incidents.

The legal basis is the controller's legitimate interest in operating a reliable and secure website under Article 6(1)(f) GDPR. This processing is limited to information reasonably necessary for those purposes.

3.2 Lesson and free-trial enquiries

The enquiry form sends the information you enter to a server-side endpoint hosted with the website. The endpoint uses an authenticated SMTP connection provided through Seznam Email Profi to deliver the enquiry to the controller's mailbox. After that delivery is accepted, the endpoint sends an automated confirmation to the email address provided with the enquiry. The form does not open or depend on an email application on your device.

The website backend processes the submission only for those email deliveries. It does not store the form contents in a separate database or intentionally include them in application or access logs. Once delivered, the enquiry is stored in the controller's Seznam Email Profi mailbox. The automated confirmation acknowledges receipt without repeating the free-text message or other enquiry details.

The submitted information is used to:

  • answer your enquiry;
  • confirm that the enquiry was received;
  • discuss your goals and preferred lesson format; and
  • arrange a free trial or take other steps requested by you before a lesson contract is concluded.

Where the enquiry concerns possible lessons, the legal basis is taking steps at your request before entering into a contract under Article 6(1)(b) GDPR. For general questions that do not relate directly to a possible contract, the legal basis is the controller's legitimate interest in responding to business correspondence under Article 6(1)(f) GDPR.

3.3 Group-course registrations

The registration form sends the information you enter to a server-side endpoint hosted with the website. The endpoint uses the same authenticated Seznam Email Profi SMTP connection as the enquiry form to deliver the registration to the controller's mailbox. After that delivery is accepted, the endpoint sends an automated acknowledgement to the email address provided with the registration. The acknowledgement confirms only that the registration was received; it is not a payment receipt and does not confirm a place on the course.

The website backend processes the submission only for those email deliveries. It does not store the form contents in a separate database or intentionally include them in application or access logs. Once delivered, the registration and its required acknowledgements are stored in the controller's Seznam Email Profi mailbox.

The submitted information is used to:

  • assess availability and administer the registration;
  • contact you about confirmation, payment information, and next steps; and
  • take steps requested by you before a course contract is concluded.

The legal basis for this processing is Article 6(1)(b) GDPR.

A record of the course and payment conditions acknowledged with the registration may also be retained to document what was communicated and accepted and, if necessary, to establish, exercise, or defend legal claims. The legal basis for that processing is the controller's legitimate interest in maintaining reliable registration records and protecting the parties' legal positions under Article 6(1)(f) GDPR.

The registration page links to this Privacy Notice before submission. The processing necessary to handle the registration does not rely on consent under Article 6(1)(a) GDPR.

4. Whether you must provide the data

Visiting the website necessarily results in the transmission of basic technical data required by internet protocols. Without that transmission, the requested page cannot be delivered.

You are not legally or contractually required to send a lesson enquiry. If you choose to enquire, a name, contact address, and enough information to understand and answer the request are needed. Without them, the controller may be unable to respond or arrange a trial.

The fields marked as required in the group-course registration form must be completed to submit a registration. Without this information, the controller cannot assess or confirm your registration. Submitting the form does not itself guarantee a place or conclude a course contract.

5. Recipients and service providers

Access to personal data is limited to the controller and authorised recipients who need it for the purposes described above. The following service providers may process personal data:

  • Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany, provides the server infrastructure used to host the website and its form endpoints. The relevant server is located in Finland and processes enquiry and registration contents transiently while relaying them to the email service.
  • Jan Hadáček, located in the Czech Republic, acts as the authorised technical administrator and may access website deployment data, server logs, and server backups where necessary for maintenance or security. Form contents are not intentionally recorded in those logs or backups. He does not have routine access to the controller's mailbox and acts under written data-processing and confidentiality arrangements.
  • Seznam.cz, a.s. provides the Email Profi SMTP service used to deliver enquiries and registrations and the mailbox that receives and stores them at hyunju@krslang.school. Only Hyunju Cha has routine access to that mailbox.

Personal data may also be disclosed to courts, public authorities, legal or other professional advisers, or another recipient where disclosure is required by law or is reasonably necessary to establish, exercise, or defend legal claims.

The controller does not sell personal data.

6. International transfers

The website server is located within the European Economic Area. Seznam and the technical administrator are located in the Czech Republic.

Where the controller makes any other transfer to a country outside the European Economic Area, an appropriate transfer mechanism required by Chapter V GDPR will be used, and information about the relevant safeguards will be made available on request.

7. Retention and deletion

Personal data is retained only for as long as reasonably necessary for the relevant purpose:

  • Website access and security logs are retained for no longer than 30 days.
  • Rotating server backups that may contain log data are retained for no longer than 30 days, after which they are deleted or overwritten through the normal backup cycle.
  • The website backend does not retain a separate database copy of an enquiry or registration after the submission request has completed. Form contents are not intentionally written to server logs or backups.
  • An enquiry that does not result in lessons is deleted from the mailbox no later than 12 months after the last relevant contact.
  • A registration that is withdrawn, unsuccessful, or not confirmed is deleted from the mailbox with its related correspondence no later than six months after the relevant course starts.

If an enquiry or registration results in a student relationship, information that remains necessary for administering that relationship becomes part of the relevant student or customer records. Subsequent processing for lesson delivery, payment, invoicing, accounting, or legal claims is outside the scope of this website-related notice and must be covered by the applicable student or customer information.

Information may be retained for longer than the periods above where this is necessary to comply with a legal obligation or to establish, exercise, or defend a specific legal claim. Service providers may retain limited residual copies temporarily in accordance with their documented backup and deletion cycles.

8. Cookies, external services, and links

The Korean Slang School website does not use advertising or analytics trackers and does not intentionally set non-essential cookies.

When you follow a link from this website to another external service, that third party may collect technical data, use cookies or similar technologies, and process information under its own terms and privacy practices.

9. Automated decision-making

The controller does not use personal data covered by this notice for automated individual decision-making or profiling within the meaning of Article 22 GDPR. Registration and enquiry decisions are made by a person.

10. Your rights

Subject to the conditions and exceptions in the GDPR, you may have the right to:

  • obtain confirmation of whether your personal data is processed and request access to it under Article 15 GDPR;
  • correct inaccurate or incomplete personal data under Article 16 GDPR;
  • request erasure of personal data under Article 17 GDPR;
  • request restriction of processing under Article 18 GDPR;
  • receive personal data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where Article 20 GDPR applies;
  • object, on grounds relating to your particular situation, to processing based on legitimate interests under Article 21 GDPR; and
  • withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal. The processing activities currently described in this notice do not rely on consent.

To exercise a right, contact hyunju@krslang.school or write to the controller's postal address. The controller may request information reasonably necessary to confirm your identity and protect personal data from unauthorised disclosure.

Requests are generally answered without undue delay and within one month, subject to the extensions and other conditions permitted by Article 12 GDPR. Exercising these rights is normally free of charge. A right may be limited where an applicable legal condition or exemption permits or requires the controller to retain or continue processing the data.

11. Right to complain

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the Czech supervisory authority:

Office for Personal Data Protection
Úřad pro ochranu osobních údajů
Pplk. Sochora 27
170 00 Praha 7
Czech Republic
Email: posta@uoou.gov.cz
Website: uoou.gov.cz/en

You may also complain to another competent supervisory authority, particularly in the EU or EEA country where you habitually reside, work, or believe an infringement occurred.

12. Security

The controller uses appropriate technical and organisational measures proportionate to the nature and scope of the processing. These include restricting access to authorised persons, using credential-protected provider accounts, limiting administrative access, applying provider security controls, and operating defined retention and backup cycles.

No method of transmission or storage is completely secure. Security measures are reviewed and adjusted where reasonably necessary in light of changes to the processing, available technology, and identified risks.

13. Changes to this notice

This notice may be updated when the processing activities, service providers, or legal requirements change. The current version will be published on the Korean Slang School website with its effective date. Where a change materially affects existing processing, affected individuals will be informed by an appropriate additional method where required by law.