This Privacy Policy explains the principles under which personal data is collected, processed, protected, stored, and, where necessary, shared in connection with the services provided through the website, mobile applications, and other digital platforms operated by VIRTALEARN KFT., a company duly incorporated and existing under the laws of Hungary (hereinafter referred to as MyECO).

MyECO is committed to complying with the applicable data protection laws, including, in particular, the General Data Protection Regulation (GDPR) of the European Union, in relation to the protection of personal data.

This Privacy Policy applies to all natural persons who visit the website, members, students, corporate clients, assessment participants, business partners, and any other individuals who communicate with MyECO.

Depending on the nature of the services provided, MyECO may process the following categories of personal data:

• Full name

• Company name (where applicable)

• Email address

• Telephone number

• Billing and payment information

• Information relating to the services purchased

• User account information

• IP address

• Device, operating system, and browser information

• Cookie data

• Website usage records

• Records relating to live online lessons, assessments, and educational activities

• Support requests, email correspondence, and customer service records

• Any other information voluntarily provided to MyECO by the user

MyECO is committed to processing only the personal data that is necessary for the provision of its services and adopts the principle of avoiding the collection of unnecessary personal data.

The personal data collected may be processed for the following purposes:

• Creating and managing user accounts

• Providing the services purchased

• Scheduling and conducting live online lessons

• Providing access to digital content

• Processing payments

• Carrying out billing and accounting processes

• Verifying users' identities and ensuring account security

• Providing technical support and customer services

• Improving the quality of the services

• Enhancing the user experience

• Ensuring system security

• Preventing fraud, misuse, and unauthorized access

• Complying with legal obligations

• Responding to lawful requests from competent authorities

• Sending informational notices, announcements, and marketing communications where the user has provided explicit consent

MyECO does not process personal data for purposes other than those specified above and does not sell personal data to third parties.

MyECO processes personal data in accordance with the applicable data protection laws and, in particular, the provisions of the General Data Protection Regulation (GDPR), on the basis of the following legal grounds:

• Preparing and performing a contract concluded or to be concluded between the parties

• Complying with the legal obligations to which MyECO is subject

• Obtaining the user's explicit consent

• Protecting MyECO's legitimate interests

• Carrying out pre-contractual measures at the user's request

• Any other legal grounds permitted under the applicable laws

All personal data is processed only to the extent necessary and proportionate to the relevant purpose of processing.

In processing personal data, MyECO acts in accordance with the following fundamental principles:

• Lawfulness, fairness, and transparency

• Processing for specified, explicit, and legitimate purposes

• Data minimization

• Accuracy and keeping personal data up to date

• Storage limitation

• Confidentiality and security

• Accountability

MyECO implements reasonable technical, administrative, and organizational measures to ensure the security of personal data and ensures that access to personal data is limited to authorized persons who require such access in the performance of their duties.

MyECO protects personal data in accordance with the principle of confidentiality and does not sell, rent, or share personal data with third parties for commercial purposes, except where permitted by the applicable laws.

Personal data may be shared, to the extent necessary for the provision of the services, with the following persons and organizations:

• Payment service providers and financial service providers

• Banks and electronic payment systems

• Accounting and financial advisory service providers

• Cloud computing, hosting, and data storage service providers

• Video conferencing, online education, and communication platforms

• Software, cybersecurity, technical support, and information technology service providers

• Analytics and performance measurement service providers

• Legal advisors, auditors, and independent professional service providers

• Competent public authorities and other lawful authorities

Such sharing shall be carried out only to the extent necessary for the provision of the services, the fulfillment of legal obligations, or the protection of MyECO's legitimate interests.

In providing its services, MyECO may utilize technology, payment, communication, security, and cloud service providers operating within or outside the European Economic Area (EEA).

Where it is necessary to transfer personal data outside the European Economic Area, MyECO shall comply with the applicable data protection laws and endeavor to ensure that appropriate technical, administrative, and legal safeguards are implemented.

Personal data shall be retained only for as long as necessary to fulfill the purposes for which it is processed and in accordance with the retention periods required under the applicable laws.

Once the purpose of processing no longer exists or the applicable legal retention periods have expired, personal data shall be:

• deleted;

• anonymized; or

• securely destroyed in accordance with the applicable laws.

Certain personal data may be retained for the period required under the applicable laws for purposes including tax, accounting, legal obligations, compliance with lawful requests from competent authorities, or the resolution of actual or potential disputes.

MyECO implements reasonable technical, administrative, and organizational security measures to protect personal data against unauthorized access, alteration, loss, misuse, or unlawful disclosure.

Where deemed necessary, MyECO may utilize appropriate security measures, including:

• Access control and authorization mechanisms

• Encryption methods

• Firewalls

• Logging systems

• Regular system updates

• Security monitoring mechanisms

However, it should be understood that no method of data transmission over the Internet or electronic storage can guarantee absolute security. Accordingly, MyECO undertakes to implement reasonable security measures to the fullest extent permitted by the applicable laws but does not guarantee absolute security.

If MyECO identifies a significant personal data breach that may affect the security of personal data, it shall carry out the necessary assessments in accordance with the applicable laws and, where required, notify the competent authorities and the affected data subjects.

Where MyECO provides educational services to children, personal data relating to children shall be processed only with the knowledge of the relevant parent or legal guardian and, where required, with their consent.

MyECO attaches particular importance to the protection of children's personal data and processes such data in accordance with the applicable data protection laws.

Under the applicable data protection laws, users have the right to:

• Request access to their personal data;

• Request the correction of incomplete or inaccurate personal data;

• Request the deletion of their personal data where the applicable legal requirements are satisfied;

• Request the restriction of the processing of their personal data;

• Request the portability of their personal data;

• Object to the processing of their personal data in certain circumstances;

• Withdraw their consent at any time where processing is based on consent; and

• Lodge a complaint with the competent data protection authority.

Users may contact MyECO to exercise any of these rights.

MyECO may utilize automated systems and AI-assisted technologies for the purposes of providing its services, enhancing security, improving the user experience, or optimizing its operational processes.

However, to the extent reasonably possible, MyECO's policy is not to make decisions concerning users based solely on automated processing where such decisions produce legal effects concerning the user or similarly significantly affect the user.

Marketing communications, promotional offers, announcements, or other informational electronic communications may be sent to users where permitted under the applicable laws or where the user has provided the necessary consent.

Users may opt out of receiving marketing communications or unsubscribe at any time. This shall not affect the delivery of service-related communications or other notices that MyECO is legally or operationally required to provide.

MyECO may use cookies to ensure the security of its website, enhance the user experience, improve its services, and enable the proper functioning of technical features.

Detailed information regarding the use of cookies is available in the Cookie Policy.

Users may manage or modify their cookie preferences, where applicable.

The MyECO website or its digital platforms may contain links to third-party websites or services.

Such links are provided solely for informational purposes or to facilitate the provision of services.

MyECO has no control over the content, security practices, or privacy policies of third-party websites. Users should review the privacy policies of such third-party services before using them.

MyECO reserves the right to update this Privacy Policy in response to changes in the applicable laws, technological developments, or updates to its services.

The updated version shall become effective as of the date it is published on the website.

This Privacy Policy shall be applied together with the MyECO Distance Sales Agreement and the other applicable policies and Terms of Use.

In the event of any inconsistency between this Privacy Policy and the Distance Sales Agreement, the provisions of the Distance Sales Agreement shall prevail.

Company Name: VIRTALEARN KFT.

Registered Office: 1111 Budapest, Lágymányosi utca 2. Fsz. 2. ajtó, Hungary

Email: info@virtalearn.com

Website: www.myenglishclassesonline.com

Version: v2.1

Last Updated Date: 5 September 2026, Saturday