PRIVACY AND PERSONAL DATA PROCESSING POLICY (GDPR COMPLIANT)1. GENERAL PROVISIONS
1.1. This Privacy Policy (hereinafter referred to as the Policy) is developed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR). It defines the procedure for processing and measures to ensure the security of personal data that IE Alfiia Khanieva, registration № 9996N01395842 (the Controller), may collect from users while they interact with the website https://s-panda.eu (hereinafter referred to as the Website).
1.2. The Controller acts as the "Data Controller" for the personal data collected through the Website and is committed to protecting the privacy of all data subjects.
1.3. Controller Information:

• Name: IE Alfiia Khanieva
• Registration №: 9996N01395842
• Legal Address: Rua da Vigia 281, 2775-298 Parede, Lisbon, Portugal
• Intellectual Property: Activities are carried out using a registered trademark, certificate No. 2021772813.

1.4. By using the Website or submitting information through feedback forms (e.g., "Ask a Question," "Book a Consultation"), the User acknowledges the terms of this Policy and provides informed consent to the processing of their data as described herein.
2. PURPOSES AND LEGAL BASES FOR PROCESSING
The Controller processes personal data based on the principles of lawfulness, fairness, and transparency for the following purposes:
2.1. Provision of Educational Services: Selection of institutions, visa support, and program organization.

• Legal Basis: Performance of a contract or steps taken at the request of the data subject prior to entering into a contract (GDPR Art. 6(1)(b)).

2.2. Communication: Managing inquiries and technical support.

• Legal Basis: Legitimate interests of the Controller to provide efficient customer service (GDPR Art. 6(1)(f)).

2.3. Marketing: Sending newsletters and special offers.

• Legal Basis: Explicit consent of the data subject (GDPR Art. 6(1)(a)).

2.4. Website Analytics:

• Data: IP address, cookies, browser type, session duration.
• Legal Basis: Consent for non-essential cookies; Legitimate interest for essential functional data.
• Retention: Analytical data is stored for up to 13 months.

2.5. Consultations & Admissions:

• Data: Name, contact details, messenger handles (Telegram/WhatsApp), educational history.
• Retention: For the duration of the service plus a statutory period of 5 years to comply with financial and legal audit obligations.

3. DATA PROTECTION AND TRANSFERS
3.1. Security Measures: The Controller implements appropriate technical and organizational measures (encryption, access controls) to ensure a level of security appropriate to the risk of unauthorized access or loss.
3.2. International Transfers: Data may be transferred to third-party service providers (e.g., educational institutions or visa centers) located outside the European Economic Area (EEA). In such cases, the Controller ensures that adequate safeguards (such as Standard Contractual Clauses) are in place.
3.3. Third-Party Services: The Website uses encrypted communication via Telegram and WhatsApp. Users are encouraged to review the privacy policies of these providers (Telegram: telegram.org/privacy; WhatsApp: whatsapp.com/legal/privacy-policy). The Controller does not control how these platforms process data independently.
4. CATEGORIES OF DATA
The Controller collects:

• Identification Data: Name, contact information, email.
• Professional/Educational Data: Education level, academic interests.
• Technical Data: Cookies and usage data.
• Special Categories: The Controller does not process sensitive data (health, religion, etc.) unless strictly necessary for specific services (e.g., insurance) and only with explicit written consent.

5. COOKIE POLICY
5.1. The Website uses cookies to enhance user experience. Users can manage or withdraw consent for cookies at any time through their browser settings or the on-site cookie banner.
5.2. Analytical tools used on the site process data in a pseudonymized manner to protect user identity.
6. YOUR RIGHTS (DATA SUBJECT RIGHTS)
Under the GDPR, you have the following rights:

• Right of Access: To request a copy of your personal data.
• Right to Rectification: To correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): To request deletion of data when it is no longer necessary.
• Right to Restriction: To limit how your data is processed.
• Right to Data Portability: To receive your data in a structured, machine-readable format.
• Right to Object: To object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: At any time, without affecting the lawfulness of processing based on consent before its withdrawal.

7. DATA RETENTION AND DELETION
7.1. Personal data is stored only as long as necessary for the purposes stated in Section 2.
7.2. Upon withdrawal of consent or achievement of the purpose, data is deleted within 30 days, unless statutory retention periods apply (e.g., tax or corporate law).
8. PROTECTION OF MINORS
8.1. The Controller does not knowingly collect data from individuals under 16 years of age (or the age defined by local EU member state law) without verifiable parental consent. If such data is collected without consent, it will be deleted immediately.
9. AMENDMENTS
9.1. The Controller reserves the right to update this Policy. The current version is always available on the Website.
10. CONTACT AND SUPERVISORY AUTHORITY
10.1. For any inquiries regarding your data, contact: my@sp-education.ru.
10.2. You have the right to lodge a complaint with a Data Protection Authority (DPA) in your country of residence if you believe your rights have been infringed.
OPERATOR DETAILS
IE Alfiia Khanieva
Registration №: 9996N01395842
Email: my@sp-education.ru
Tel: +7 (843) 240-25-25