Privacy Policy

This policy informs data subjects about the processing of personal data in the EduHear application and on the eduhear.com website under Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the “GDPR”). Effective from 4 November 2026.

1. Controller of the personal data

The controller of the personal data is LWi s.r.o., with its registered office at Mlýnská 326/13, 602 00 Brno, Czech Republic, company number 28304951, registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 59996 (the “controller”).

The contact address for every request in the matter of the protection of personal data is info@eduhear.com . The controller has not appointed a data protection officer, because Article 37 of the GDPR does not place that duty upon it.

2. Scope of this policy

This policy covers the EduHear application for all supported operating systems, the eduhear.com website, and communication with the controller by electronic mail. It does not cover the services of third parties to which the application links, in particular the Google Play distribution platform; those services process personal data under their own policies.

3. Personal data processed

Setting up a user account is voluntary. Without an account the application works in full and passes no personal data to the server. If a data subject sets up an account, the controller processes the following data:

• the electronic address, which is at the same time the unique identifier of the account
• a cryptographic hash of the password; the controller neither keeps the password itself nor has access to it
• the sign-in keys of the devices on which the account is signed in
• the training record, that is the data about the exercises taken, the answers given and the results of the tests
• the consent to receiving news and the date of the last decision about that consent
• the IP address from which an attempt to sign in to the account was made, for 24 hours

The controller processes no other personal data. The application asks for no name, no telephone number and no postal address, does not reach the contacts on the device, and holds no advertising or analytical tools of third parties.

4. Purposes and legal bases of the processing

• Keeping the account and synchronising the training record between devices — performance of a contract under Article 6(1)(b) of the GDPR.
• Keeping a record of sign-in attempts in order to secure the account — the legitimate interest of the controller under Article 6(1)(f) of the GDPR.
• Sending news by electronic mail — consent under Article 6(1)(a) of the GDPR. The consent is voluntary and can be withdrawn at any time; a withdrawal does not affect the lawfulness of the processing before it.
• Evaluating the training record in an aggregated and anonymised form in order to improve the application — the legitimate interest of the controller under Article 6(1)(f) of the GDPR. In that form the data cannot be assigned to a particular person, and the controller does not join it to the electronic address or to any other identifier of an account.

5. Backup and synchronisation

The purpose of an account is a backup of the training record and its carriage between devices. The record is held on the server of the controller, so that a data subject who changes device goes on from the state in which they stopped, and can see their progress on the page of the account. Deleting the account removes the record.

6. Commercial communications

The controller sends a link for setting a new password, and that only upon the request of the data subject, and news about the application to those data subjects who have given their consent to it. Every commercial communication holds a link for withdrawing the consent; the consent can also be withdrawn on the page of the account.

7. Period of retention

The controller keeps the personal data for as long as the account lasts. If a data subject asks for the account to be deleted, the controller removes the account together with the training record and the sign-in keys; how to ask stands on the page Delete your account. The record of sign-in attempts and the links issued for setting a new password the controller removes after 24 hours.

8. Recipients of the personal data and the place of the processing

We hold and process the data in the European Union.

The controller neither sells the personal data nor passes it to third parties for advertising purposes. The only processors are the provider of the server infrastructure and the provider of the electronic mail service, which process the personal data under a contract and solely upon the instructions of the controller. The controller further discloses personal data to a public authority where a legal provision places that duty upon it.

9. Cookies

The eduhear.com website uses two cookies, both strictly necessary for providing the service that the data subject has expressly asked for. Their storage is therefore not subject to consent under Section 89(3) of Act No. 127/2005 Coll., on electronic communications:

• eduhear_session — keeps the sign-in to the account, valid for one year
• eduhear_csrf — secures the forms against misuse from another site, valid for one hour

The site holds no analytical cookies, no advertising cookies and no cookies of third parties. Removing the cookies in the browser does nothing more than sign the person out of the account.

10. Rights of the data subject

In connection with the processing of personal data a data subject has these rights:

• the right of access to the personal data under Article 15 of the GDPR
• the right to rectification under Article 16 of the GDPR
• the right to erasure under Article 17 of the GDPR
• the right to restriction of processing under Article 18 of the GDPR
• the right to data portability under Article 20 of the GDPR
• the right to object to the processing under Article 21 of the GDPR
• the right to withdraw consent under Article 7(3) of the GDPR

The rights are exercised by a request sent to info@eduhear.com . The controller answers a request without undue delay and at the latest within one month of its receipt. A data subject further has the right under Article 77 of the GDPR to lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection.

11. Security of the personal data

The controller has taken technical and organisational measures that answer the nature of the data processed. All communication of the application and of the browser with the server is encrypted, passwords are kept solely in the form of a cryptographic hash, access to the data is limited to the smallest necessary number of persons, and the server runs in a separate environment behind a network gateway.

12. Persons under 15 years of age

An account for a person under 15 years of age is set up and managed by their legal representative, who gives the consent to the processing of personal data on their behalf under Section 7 of Act No. 110/2019 Coll., on the processing of personal data.

13. Changes to this policy

The controller is entitled to change this policy, in particular where the legal rules or the extent of the processing change. The controller publishes the current wording on this page together with the date from which it is effective. A change that materially affects the rights of a data subject the controller announces by electronic mail or in the application.