Privacy and Cookie Policy

This policy explains how Kaveshnikov School collects and uses personal data when you visit https://kaveshnikovschool.com, create an account, buy courses and take part in discussions. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the Russian Federal Law No. 152-FZ "On Personal Data", which also applies to us.

Who we are

The controller of your personal data is Individual Entrepreneur Andrey Nikolaevich Kaveshnikov, trading as Kaveshnikov School.

INN 772073779636, OGRNIP 322774600134090
Address: Veshnyakovskaya St. 5 bldg. 3, Moscow 111402, Russia
Email: info@kaveshnikovschool.com

We are based in Russia and have no establishment in the EU or the UK. We have not appointed a data protection officer or a representative in the EU or the UK. For any privacy question or request, write to info@kaveshnikovschool.com.

What data we collect

Data you give us

Account data: login or name, email address, password, and an optional profile photo (avatar). We store your password only as a one-way hash, so nobody, including us, can read it.
Purchase data: the courses you order, price, currency, payment identifier and payment status, and the time you gave your checkout consent to immediate access and acknowledged that you lose your right of withdrawal once access is granted.
Content you post: course reviews and lecture comments.
Messages you send us by email.

Data we create or collect automatically

Account status: whether your email address is confirmed, and the storefront and language you use.
Technical data: our web server logs record your IP address, the date and time of a request, the page requested and your browser type.
Analytics data: only if you accept analytics cookies, Google Analytics collects information about how you use our public pages (see "Cookies and similar technologies").

We do not receive or store your card number or other card details. You enter them directly in the payment form of our payment provider.

Why we use your data and on what legal basis

To create and run your account

We use account data to register you, confirm your email address, sign you in, reset your password and give you access to the courses you bought. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

To sell and deliver courses

We use purchase data to process your order, check with our payment provider whether the payment went through, and open the course for you. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

To confirm your order and keep evidence of your checkout consent

We send you an order confirmation email and store the time of your checkout consent with your order, as evidence of the terms of your contract and of the consent and acknowledgement that end your right of withdrawal. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Where EU or UK consumer law applies to your purchase, this is also needed to comply with it (Art. 6(1)(c) GDPR). Where only other laws apply, such as Russian law, which is not EU or UK law, we rely on our legitimate interest in complying with the laws that bind us and in being able to prove the terms of your contract (Art. 6(1)(f) GDPR).

To publish your reviews and comments

When you post a review or a comment, we show it to other users together with your name and avatar. This is part of the service you choose to use. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). We also moderate content to keep the community safe, based on our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

To send service emails

We send emails needed for your account and purchases: address confirmation, password reset and order confirmation. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). We do not send marketing emails.

To answer your messages

We use your email and the content of your message to reply. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), or performance of our contract if your message concerns your account or purchase.

To keep accounting and tax records

We keep records of purchases and payments because Russian accounting and tax laws require it. Those laws are not EU or UK law, so under the GDPR we rely on our legitimate interest in complying with the laws that bind us (Art. 6(1)(f) GDPR).

To keep the site secure

We use server logs and account data to detect and prevent attacks, fraud and misuse, and to fix errors. Legal basis: our legitimate interest in keeping the site and your account secure (Art. 6(1)(f) GDPR).

To protect our rights

Where needed, we use relevant data to establish, exercise or defend legal claims, for example in a payment dispute. Legal basis: our legitimate interest in protecting our rights (Art. 6(1)(f) GDPR).

To understand how the site is used

Only if you accept analytics cookies, we use Google Analytics to count visits and see which public pages are popular, so we can improve the site. Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on cookies). You can withdraw consent at any time.

Where we rely on legitimate interests, we have checked that our interests are not overridden by yours. You may object to this processing at any time (see "Your rights").

We do not sell your data, do not use it for advertising, do not build profiles of you and do not make decisions about you by automated means that have legal or similarly significant effects. We do not use your data for any purpose other than those listed here.

Do you have to give us your data

You need to give us a login, email address and password to create an account, and an account and payment to buy a course. Without them we cannot provide the service. A profile photo is optional. Analytics cookies are optional, and refusing them does not limit your use of the site. No law requires you to give us any data.

Who receives your data

We share data only with service providers that help us run the site, and only as far as they need it.

Timeweb Cloud (Russia): hosting of our servers, database and file storage, including avatars. It acts as our processor.
Timeweb (Russia), through smtp.timeweb.ru: delivery of our service emails. It acts as our processor.
CloudPayments (Russia): card payment processing. CloudPayments receives your card details directly in its payment form and processes them as an independent controller under its own privacy policy and payment rules. It tells us the payment status. Banks and card networks involved in the payment also receive payment data.
Google LLC (USA): Google Analytics, only if you accept analytics cookies. It acts as our processor.
Other users: your name, avatar, reviews and comments are visible to other users of the site.
Public authorities, courts or our professional advisers, where required by law or needed to protect our rights.

International transfers

We are located in Russia, and your data is stored on servers in Russia (St. Petersburg). If you are in the EU, the European Economic Area or the UK, this means your data is processed outside your country.

The European Commission and the UK government have not recognised Russia as providing an adequate level of data protection. Russian law, including Federal Law No. 152-FZ, gives some protection, but it is not equivalent to the GDPR, and Russian authorities may have powers to access data that would not be allowed in the EU or the UK. We process your data in Russia because this is necessary to provide the service you ask for from a provider based in Russia (Art. 49(1)(b) GDPR). We limit the data to what the service needs, protect it with the security measures described below, and bind our processors to confidentiality.

If you accept analytics cookies, Google Analytics data is transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework and its UK extension, and its data processing terms include standard contractual clauses. You can ask us for more information about these safeguards at info@kaveshnikovschool.com.

How long we keep your data

Account data: as long as your account exists. When you delete your account or ask us to, we delete it within 30 days, except data we must keep for the reasons below.
Reviews and comments: until you delete them or your account.
Purchase and payment records, including the time of your checkout consent: 5 years after the end of the calendar year of the purchase, as Russian accounting and tax laws require.
Email confirmation and password reset links: they stop working after 1 hour and 30 minutes respectively.
Messages you send us: 3 years after our last exchange, the general limitation period for claims under Russian law.
Server logs: up to 90 days, unless we need a log longer to investigate a specific security incident.
Google Analytics data: 2 months, after which Google deletes it.
Cookies and browser storage: as stated in the next section.

When a period ends, we delete or anonymise the data.

Cookies and similar technologies

Cookies are small files that a website stores in your browser. We also use your browser's local storage, which works in a similar way. We use only the items listed below.

Strictly necessary (no consent needed)

kaveshnikov_token: a cookie that keeps you signed in after you log in. It contains a signed session token. It lasts 4 hours and is deleted when you sign out. The site's account features cannot work without it.
kschool:cookie-consent: a local storage entry that remembers whether you accepted or declined analytics cookies, so we do not ask on every page. It is kept for 12 months, after which we ask you again; you can change your choice earlier in "Cookie settings" or by clearing your browser storage.

Analytics (only with your consent)

_ga: a Google Analytics cookie that distinguishes visitors. It lasts 2 years.
_ga_ followed by our analytics property ID (for example _ga_ABC123): a Google Analytics cookie. It keeps the state of your visit. It lasts 2 years.

These cookies are set only after you click Accept in the cookie banner, and only on public pages of the site, not in your account or course pages. We have turned off Google's advertising features: Google may not use this data for advertising or ad personalisation. Google Analytics 4 does not store IP addresses.

Changing your choice

You can change your choice at any time with the "Cookie settings" link in the footer of every page. If you withdraw consent, we stop analytics and delete the analytics cookies from your browser. You can also block or delete cookies in your browser settings, but blocking kaveshnikov_token will prevent you from signing in.

Your rights

Under the GDPR and the UK GDPR you have the right to:

access your data and get a copy of it;
correct inaccurate or incomplete data;
have your data erased;
restrict how we use your data;
object to processing based on our legitimate interests;
receive the data you gave us in a common machine-readable format and have it sent to another provider (data portability);
withdraw your consent at any time, without affecting processing before the withdrawal;
lodge a complaint with a supervisory authority.

You can edit your profile and delete your reviews and comments in your account. For anything else, email info@kaveshnikovschool.com, preferably from the address linked to your account so we can verify your identity. Exercising your rights is free. We answer within one month; for complex requests we may extend this by two more months and will tell you why.

Because we have no establishment in the EU, you can complain to the data protection authority in the EU country where you live, work or where you believe the infringement took place. In the UK, the authority is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.

Children

Our courses are intended for adults. You must be at least 18 years old to create an account or buy a course. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Security

We use encrypted connections (HTTPS), store passwords only as hashes, limit access to personal data to those who need it, and use access-controlled storage for uploaded files. No system is completely secure, but if a breach puts your data at risk, we will inform you and the authorities as the law requires.

Changes to this policy

We may update this policy when our services or the law change. We will publish the new version on this page. If a change significantly affects how we use your data, we will tell you by email or on the site before it takes effect.