Privacy policy
Last updated 30 August 2026
Summary I keep your name, your contact details, a record of what we have studied and a record of what you have paid. I use this information to teach you and to keep correct accounts. I do not sell it and I do not send you advertising. This website does not track you. Tax records must be kept for six years. Everything else is deleted when you ask.
1. Who is responsible for your data
The data controller is Lanaltx, 79 Ellados Avenue, Office 201, Pafos 8020, Cyprus. VAT number CY05503795H. Please contact me, or write to , about anything on this page.
2. What I collect
| What | Why | Lawful basis |
|---|---|---|
| Name, email, phone | To arrange and deliver lessons and to reply to you | Performance of a contract |
| Level, goals, job, interests, native language | To plan lessons that suit you | Performance of a contract |
| Lesson records, vocabulary, homework, progress | To teach you and let you review what we covered | Performance of a contract |
| Invoices and payment records | To take payment and meet Cypriot tax and VAT law | Legal obligation |
| Emails and messages | To keep a record of what we agreed | Legitimate interests |
| Attendance records (company clients) | To report attendance to the employer paying for the programme | Performance of a contract |
3. What I do not collect
I do not ask for, and do not want, medical records, financial details beyond what an invoice needs, government identity documents, or anything sensitive that has nothing to do with learning English. Please do not send them.
This website has no analytics, no advertising trackers and no third-party cookies. See the cookie notice.
4. Company clients
Where an employer pays for training, I share attendance and progress with the person responsible for the programme. I do not share the content of private conversations, personal opinions, or anything a participant tells me in confidence. Participants are told at the outset what is reported.
5. Who else processes your data
I use a small number of service providers to run the business. They process data on my instructions only, under a written agreement. They are:
- Email and file storage — to write to you and to keep documents and backups safely.
- Hosting and databases — to run the software that holds lesson records and student pages.
- Video call software — to deliver online lessons.
- Invoicing and accounting software, and my accountant — to invoice you and to prepare tax returns.
- An AI provider — to help prepare lesson material. See section 6 below.
I do not sell your data, and I do not use it for advertising. If you would like the names of the specific companies I currently use, please contact me and I will tell you.
Where a provider is outside the European Economic Area, transfers are covered by the provider's standard contractual clauses or an adequacy decision.
Students who found me through a teaching platform are managed on that platform, which operates as its own controller under its own privacy policy.
6. AI processing
Lesson materials are prepared with AI assistance through Lesson Studio. Lesson topics, level, goals and teaching context may be sent to an AI provider to generate materials. I do not send identity documents, contact details or sensitive personal information for this purpose. See the Lesson Studio privacy policy.
7. How long I keep it
- Invoices, payments and tax records — six years after the end of the tax year, as Cypriot law requires.
- Lesson records and student pages — while you are studying with me, and for up to twelve months afterwards in case you come back. Then deleted.
- Emails — up to three years.
- If you ask me to delete something sooner, I will, unless I'm legally required to keep it.
8. Your rights
Under the GDPR you have the right to access your data, to have it corrected, to have it deleted, to restrict or object to how it is used, and to receive it in a portable format. Please contact me and I will reply within one month. There is no charge.
If you are not happy with how I have handled it, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority in your own country.
9. Security
Accounts are protected with strong unique passwords and two-factor authentication where available. Files are stored in encrypted storage. Devices are encrypted. That said, no system is perfect. Please do not send me anything you would not want stored.
10. When I may have to share something
Apart from the providers above, I may share personal data:
- where the law, a court or a competent authority requires it;
- where it is necessary to establish, exercise or defend a legal claim;
- with my accountant, and if necessary with a lawyer or insurer;
- if the business is ever sold or transferred, with the buyer, under the same protections that apply now.
11. Sending data outside Europe
Some of the software I use is provided by companies based outside the European Economic Area. Where that happens, the transfer is covered either by an adequacy decision of the European Commission or by standard contractual clauses approved by it.
12. Automated decisions
I do not make any decision about you by automated means alone. Software helps me to prepare lesson material, but a person — me — decides what you study, what your level is and what you are charged.
13. Changes
If this policy changes in an important way I will tell current students by email. The date at the top always shows the current version.