Legal
Acutis Institute OÜ ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Estonian data protection law.
Please read this policy carefully. By using our website or enrolling in our courses, you acknowledge that you have read and understood this policy.
Data Controller
Acutis Institute OÜ
Registry code: 17230268
Lõõtsa tn 5, Lasnamäe linnaosa, Tallinn, Harju maakond, 11415, Estonia, European Union
Email: legal@eaoai.eu
We collect the following categories of personal data:
We process your personal data on the following legal bases under GDPR Article 6:
| Purpose | Legal Basis |
|---|---|
| Processing your enrollment and providing course access | Contract performance (Art. 6(1)(b)) |
| Processing payment via Stripe | Contract performance (Art. 6(1)(b)) |
| Issuing your certificate of completion | Contract performance (Art. 6(1)(b)) |
| Responding to support and contact form inquiries | Legitimate interests (Art. 6(1)(f)) |
| Maintaining records for tax and accounting purposes | Legal obligation (Art. 6(1)(c)) |
| Sending course-related announcements and updates | Legitimate interests (Art. 6(1)(f)) |
| Sending marketing emails (if you opt in) | Consent (Art. 6(1)(a)) |
| Improving our platform and services | Legitimate interests (Art. 6(1)(f)) |
| Fraud prevention and platform security | Legitimate interests (Art. 6(1)(f)) |
We will never sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
We share your personal data only with the following categories of third parties, and only to the extent necessary:
| Third Party | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing | USA (Standard Contractual Clauses apply) |
| Cloudflare, Inc. | Website hosting, CDN, and student database (KV) | USA/EU (SCCs apply) |
| Google LLC | Video hosting (YouTube, unlisted) | USA (SCCs apply) |
| Email service provider | Transactional emails | EU (where possible) |
All third-party processors with whom we share data are contractually bound to process your data only as instructed, to maintain adequate security, and to comply with GDPR. Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.
We may also disclose your data if required to do so by law or in response to a valid legal request from public authorities.
As a data subject under GDPR, you have the following rights:
Request a copy of the personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your data where no legal basis for retention exists
Request that we restrict processing of your data in certain circumstances
Receive your data in a structured, machine-readable format
Object to processing based on legitimate interests or for direct marketing
Withdraw marketing consent at any time without affecting prior processing
Complain to the Estonian Data Protection Inspectorate or your local supervisory authority
To exercise any of these rights, please email us at legal@eaoai.eu. We will respond within 30 days. We may ask you to verify your identity before fulfilling your request.
You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee, or with the supervisory authority in your country of residence within the EU.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. These include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with GDPR requirements (within 72 hours of becoming aware).
Our website uses cookies and similar technologies. We use:
You can manage or disable non-essential cookies through your browser settings. Disabling cookies may affect your ability to access the course platform.
Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without verifiable parental consent, we will delete that data promptly. If you believe we have inadvertently collected such data, please contact us at legal@eaoai.eu.
Acutis Institute OÜ is based in Estonia, within the European Economic Area. Where your data is processed by third-party service providers outside the EEA (including Stripe and Cloudflare, which operate in the United States), we ensure that appropriate safeguards are in place under GDPR Chapter V, specifically Standard Contractual Clauses (SCCs) issued by the European Commission.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. For material changes, we will notify enrolled students by email. Your continued use of our services after any change constitutes acceptance of the updated policy.
For any questions, concerns, or to exercise your rights, contact our privacy team:
Acutis Institute OÜ , Privacy
Lõõtsa tn 5, Lasnamäe linnaosa, Tallinn, Harju maakond, 11415, Estonia
Email: legal@eaoai.eu
Estonian Data Protection Inspectorate: www.aki.ee
EU ODR Platform: ec.europa.eu/consumers/odr