Privacy Policy

1.Controller

The controller of personal data is:

Company name:

TFLP s. r. o.

Registered office:

M. Benku 1761/36, 920 01 Hlohovec

Company ID (IČO):

52 589 048

Registration:

Commercial Register of the District Court Trnava, Section: Sro, Insert No. 45184/T

E-mail:

info@tmlgacademy.eu

Phone:

+421 940 626 668

Website:

www.tmlgacademy.eu

hereinafter the “controller”.

The controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, known as the GDPR, Slovak Act No. 18/2018 Coll. on the Protection of Personal Data and other generally binding legal regulations.

2.Whose personal data we process

The controller may process the personal data of, in particular, the following persons:

• visitors to the website,
• persons interested in educational programmes, courses and training,
• participants in educational programmes, courses, training and examinations,
• graduates of educational programmes,
• persons ordering and paying for educational services,
• contact persons of business partners and legal entities,
• persons who contact the controller by form, e-mail or telephone,
• persons lodging a claim, complaint, suggestion or exercising their rights,
• recipients of information and marketing messages, where they have consented to receiving them or sending them is permitted by law,
• visitors to events organised by the controller.

3.What personal data we process

Depending on the specific purpose, we may process in particular:

Identification data

• first name and surname,
• date of birth, where required for registration or record-keeping of the participant,
• academic title,
• signature,
• number of, or data from, an identity document, where required by a special regulation or the competent authority.

Contact data

• residential or correspondence address,
• e-mail address,
• telephone number.

Data related to education

• the selected course or educational programme,
• date and place of the training,
• attendance and participation,
• results of tests, assessments and examinations,
• certificates, confirmations and qualifications obtained,
• data on the course of the training,
• communication with the participant,
• data and documents needed to meet the conditions of a specific course or examination.

Payment and accounting data

• billing details,
• order details,
• payment details,
• bank account number,
• data stated on accounting and tax documents.

Communication data

• the content of e-mail, telephone or written communication,
• the content of a message sent through a contact or registration form,
• information stated in a claim, complaint or other submission.

Technical data

• IP address,
• date and time of the visit,
• pages visited,
• type of device, operating system and web browser,
• cookie identifiers,
• technical and security logs of the server.

The controller processes only personal data that are adequate, relevant and necessary to achieve the specific purpose.

4.Purposes and legal bases of processing

4.1 Handling questions and contact requests

We process personal data for the purposes of:

• answering questions,
• providing information about courses and services,
• preparing a price quotation,
• communicating with the interested person,
• agreeing on further steps.

Legal basis:

• taking steps prior to entering into a contract at the request of the data subject,
• the legitimate interest of the controller in proper communication and handling of requests.

Providing the data is voluntary. Without basic contact details, however, we may not be able to answer the question or request.

4.2 Registration for a course or educational programme

We process personal data for the purposes of:

• receiving and recording the application,
• verifying that the conditions for participation are met,
• enrolling the participant in the course,
• preparing contractual and organisational documentation,
• providing information about the date, place and course of the training.

Legal basis:

• taking steps prior to entering into a contract,
• performance of a contract,
• compliance with the legal obligations of the controller.

Providing the data required for registration is a contractual or statutory requirement. Without them, it may not be possible to enrol the participant in the course.

4.3 Organisation and delivery of training

We process personal data for the purposes of:

• providing theoretical and practical instruction,
• recording attendance,
• communicating with participants,
• providing study materials,
• recording results of tests and assessments,
• organising examinations,
• issuing confirmations, certificates of completion or certificates,
• keeping the mandatory documentation of the educational programme,
• demonstrating that the conditions of the training have been met.

Legal basis:

• performance of a contract,
• compliance with legal obligations,
• the legitimate interest of the controller in properly delivering and documenting the course of the training.

If additional documents must be submitted to complete a specific training or examination, the participant will be informed of the scope of and reason for their processing.

4.4 Organisation of examinations and cooperation with competent authorities

Where the training includes an examination administered by a competent authority, examination board, certification body or other authorised person, personal data may be processed and provided for the purposes of:

• registering the participant for the examination,
• verifying their identity and that the conditions are met,
• conducting the examination,
• recording the results,
• issuing the relevant document or authorisation.

Legal basis:

• performance of a contract,
• compliance with a legal obligation,
• carrying out acts at the request of the data subject.

4.5 Invoicing, accounting and payments

We process personal data for the purposes of:

• issuing an invoice or other accounting document,
• recording payments,
• keeping accounts,
• fulfilling tax and accounting obligations,
• inspection and audit.

Legal basis:

• performance of a contract,
• compliance with the legal obligations of the controller.

4.6 Claims, complaints and exercise of rights

We process personal data for the purposes of:

• receiving and handling a claim,
• investigating a complaint or suggestion,
• handling an objection to an assessment,
• the exercise of the data subject’s rights,
• keeping the relevant records.

Legal basis:

• compliance with a legal obligation,
• performance of a contract,
• the legitimate interest of the controller in properly handling submissions and protecting its rights.

4.7 Protection of legal claims

We may process personal data for the purposes of:

• preventing and resolving disputes,
• recovering receivables,
• demonstrating compliance with obligations,
• establishing, exercising or defending legal claims,
• communicating with legal representatives, courts or public authorities.

Legal basis:

• the legitimate interest of the controller in protecting its rights and property,
• compliance with legal obligations.

4.8 Security and operation of the website

We may process technical data for the purposes of:

• ensuring the functionality of the website,
• protecting the website and information systems,
• preventing fraud, misuse and cyber attacks,
• detecting and fixing technical errors,
• keeping security logs.

Legal basis:

• the legitimate interest of the controller in the secure and reliable operation of the website,
• for cookies that are not strictly necessary, the visitor’s consent.

More detailed information is provided in the document “Cookie Policy”.

4.9 Marketing communication

If the data subject gives us consent, we may send them:

• information about new courses,
• dates of training sessions and examinations,
• TMLG Academy news,
• invitations to events,
• other commercial and marketing information.

Legal basis:

• the consent of the data subject,
• in cases permitted by law, the legitimate interest in informing existing clients about similar services.

Consent may be withdrawn at any time via the link in the message or by sending a request to info@tmlgacademy.eu.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

4.10 Photographs and audiovisual recordings

Photographs or audiovisual recordings may be made during courses, events or activities of TMLG Academy.

Individual portraits, testimonials and recordings intended for promotional purposes are, as a rule, made and published on the basis of the data subject’s consent.

Reasonable documentary footage of public or mass events may be made on the basis of the controller’s legitimate interest in informing about its activities. The data subject may object to such processing.

When making and publishing footage of minors, increased caution is exercised and, depending on the circumstances, the consent of the legal guardian is required.

5.Retention period of personal data

We retain personal data only for the period necessary to fulfil the purpose for which they were obtained.

As a rule, we retain:

• data from general questions and contact forms for no more than two years from the last communication,
• data from an application that did not result in a contractual relationship for no more than two years from its handling,
• participants’ data for the duration of the educational or contractual relationship and thereafter for the period laid down by law,
• data on the course of training, examinations, certificates of completion and certificates for the period laid down by special regulations, accreditation or certification conditions and the records retention plan,
• accounting and tax documents, as a rule, for ten years following the year to which they relate,
• data related to claims and complaints during the handling of the submission and thereafter for the period necessary to protect legal claims,
• data processed for marketing purposes until consent is withdrawn or the purpose of processing ceases,
• technical and security logs, as a rule, for no more than 12 months, unless a security incident or a legal obligation requires their longer retention,
• cookies for the period stated in the cookie settings,
• personal data needed to protect legal claims until the relevant limitation periods expire or the proceedings are finally concluded.

After the relevant period has expired, personal data will be erased, anonymised or securely destroyed, unless further retention is required by law.

6.Recipients of personal data

Personal data may be made available to the extent necessary in particular to:

• authorised employees and associates of the controller,
• lecturers, professional guarantors and members of examination boards,
• providers of web hosting, information systems, e-mail and cloud services,
• providers of technical support and website administration,
• providers of registration, educational or communication platforms,
• accountants, auditors, banks and payment service providers,
• legal, tax and professional advisers,
• certification and accreditation bodies,
• competent public administration authorities and other authorised institutions,
• courts, law enforcement authorities and bailiffs, where required by law,
• providers of analytics or marketing tools, only where consent is required for their use and has been given.

The controller has concluded appropriate contracts with persons who process data on its behalf or has otherwise ensured the protection of personal data.

7.Transfer of personal data to third countries

The controller endeavours to use services in which personal data are processed within the European Union or the European Economic Area.

When using certain cloud, analytics, marketing or communication services, however, personal data may be transferred to a country outside the European Economic Area.

Such a transfer will take place only if the conditions of the GDPR are met, in particular:

• on the basis of an adequacy decision of the European Commission,
• on the basis of standard contractual clauses,
• or through another legal mechanism ensuring an adequate level of protection.

8.Automated decision-making and profiling

The controller does not carry out decision-making based solely on automated processing which would produce legal effects concerning the data subject or similarly significantly affect them.

If such processing is introduced in the future, the data subject will be informed of this separately.

9.Rights of the data subject

Under the conditions laid down by the GDPR, the data subject has in particular:

Right of access

You have the right to obtain confirmation as to whether we process your personal data and to obtain access to them, including information about the purposes, recipients and retention period.

Right to rectification

You have the right to request the rectification of inaccurate or the completion of incomplete personal data.

Right to erasure

Under the conditions laid down by the GDPR, you have the right to request the erasure of personal data, in particular where they are no longer necessary for the original purpose or consent has been withdrawn.

The right to erasure does not apply where further processing is necessary to comply with a legal obligation or to protect legal claims.

Right to restriction of processing

You have the right to request that we restrict the processing of your personal data in certain circumstances.

Right to data portability

Where data are processed by automated means on the basis of consent or a contract, you have the right to receive the data in a structured, commonly used and machine-readable format and to transmit them to another controller.

Right to object

You have the right to object to processing based on the legitimate interest of the controller.

If you object to processing for direct marketing purposes, we will no longer process the personal data for that purpose.

Right to withdraw consent

Where processing is based on consent, you may withdraw it at any time.

Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.

Right to file a petition to initiate proceedings

If you believe that we process your personal data in breach of legal regulations, you have the right to contact:

Office for Personal Data Protection of the Slovak Republic
Budova Park One
Námestie 1. mája 18
811 06 Bratislava
Slovak Republic
Website: www.dataprotection.gov.sk

This is without prejudice to your right to bring the matter before the competent court.

10.How you can exercise your rights

You can exercise your rights:

• by e-mail to info@tmlgacademy.eu,
• by post to TFLP s. r. o., M. Benku 1761/36, 920 01 Hlohovec,
• in person by prior arrangement.

In your request, please provide sufficient information to verify your identity and clearly state which right you are exercising.

We will respond to the request without undue delay, as a rule within one month of its receipt at the latest. In the case of a complex or extensive request, the period may be extended in accordance with the GDPR, of which we will inform you.

Exercising your rights is free of charge. However, if a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may proceed in the manner permitted by the GDPR.

11.Security of personal data

The controller takes appropriate technical and organisational measures to protect personal data against:

• unauthorised access,
• loss,
• misuse,
• alteration,
• damage,
• disclosure,
• unauthorised transfer or destruction.

Access to personal data is granted only to persons who need it to perform their work, contractual or legal duties and who are bound by an obligation of confidentiality.

12.External links and third-party services

The website may contain links to external websites, social networks, map, educational or registration platforms.

After an external link is opened, personal data may be processed by the respective operator of that service in accordance with its own privacy terms.

The controller is not responsible for the processing of personal data carried out by independent operators of external services.

13.Changes to this information

The controller may reasonably update this information, in particular in the event of changes in legal regulations, methods of processing, technologies used or services provided.

The current version will always be published on the website.

Valid and effective from: 1 January 2026