Privacy Policy

Your privacy and your children's privacy matter to us. This policy explains which personal data we collect through thessia.academy, why we process it, who receives it, and your rights under the General Data Protection Regulation (GDPR) and Croatia's GDPR Implementation Act (Official Gazette 42/2018).

1. Data controller

The controller of personal data collected through this website is:

Thessia Academy is run by Nos Astra, obrt za računalno programiranje i savjetovanje, vl. Tamara Martinović. Please send questions about your personal data to the email address above.

2. Personal data we collect

Through the registration form for the three-day online program, we collect:

About the parent or legal guardian

• Parent's or legal guardian's name
• Email address

About the child

• Name and age of each registered child (ages 13 to 18)

Additional registration details

• Selected program week and the parent/guardian confirmation and Privacy Policy acknowledgment

For the newsletter, we separately collect an email address and record your consent to receive news about Thessia workshops and tools. Subscribing is voluntary and is not required to register for the program.

3. Purposes and legal bases

We process your personal data only to:

• Handle registrations for the three-day online program: check availability, contact parents or guardians, send confirmations and coordinate dates.
• Communicate about the program: send the Google Meet link, preparation instructions and workshop updates.
• Send the newsletter: only if you subscribe through the separate newsletter form. You may withdraw consent at any time.

The legal bases under Article 6(1) of the GDPR are:

• Steps taken at your request before entering a contract and performance of a contract (Article 6(1)(b)): processing needed to review a registration, confirm a place and deliver the program.
• Consent (Article 6(1)(a)): separately for the newsletter. Withdrawal does not affect the lawfulness of processing before withdrawal.

Registering a child: A parent or legal guardian completes the registration. The form confirmation records that the registration is submitted by a parent or guardian; it is not consent for unrelated purposes. If a particular processing activity relies on a child's consent for an information society service, a person with parental responsibility gives or authorizes consent for a child under 16 in Croatia, in line with Article 8 of the GDPR.

4. Special care for children's data

Thessia Academy takes particular care when processing children's data:

• A parent or legal guardian completes and confirms the child's registration.
• Participation uses Google Meet. We describe any required accounts and tools in the preparation instructions sent to the parent.
• Recording workshops is not part of the service.
• We use a child's data only to organize and deliver the workshop, never for marketing.
• A parent may withdraw a child from a workshop at any time and request deletion of the child's personal data.

5. Who has access to your data

Your data is handled only by the controller (Tamara Martinović).

Data processor

When you submit a form, data passes through Web3Forms (web3forms.com) and is then forwarded to the controller by email. The email provider may also process the message for delivery and storage.

We do not sell your data or share it with marketing partners or other third parties that are not needed to provide the service.

6. Transfers outside the European Economic Area

Web3Forms states that processing takes place on infrastructure in the United States. Form submission may therefore transfer personal data outside the EEA. Before using the form, check the current contract terms, transfer safeguards and retention settings for the Web3Forms account in use. If a transfer cannot take place with appropriate safeguards and a legal basis, the form must not be used to submit personal data.

7. How long we keep data

• Program registrations: We keep data as long as needed to process the registration, deliver the program and resolve related questions. We then delete or anonymize it unless longer retention is required by law or for legal claims.
• Newsletter: We keep your email address until you withdraw consent or we stop sending the newsletter. After unsubscription, we remove it from the recipient list except for any minimal record needed to honor the opt-out.
• Required tax and accounting records: We retain these for the periods set by applicable law.

8. Your rights

Under Articles 15 to 22 of the GDPR, you have the following rights:

• Access: Learn which data we process about you and your child.
• Rectification: Correct inaccurate or incomplete data.
• Erasure (the right to be forgotten): Ask us to delete your data.
• Restriction of processing: Temporarily limit processing.
• Data portability: Receive your data in a structured, commonly used format.
• Objection: Object to processing.
• Withdrawal of consent: Withdraw at any time without giving a reason. Withdrawal does not affect the lawfulness of earlier processing.

To exercise these rights, email tamara@thessia.academy. We respond within 30 days of receiving your request.

9. Complaints to the supervisory authority

If you believe your personal data is being processed contrary to the rules, you may complain to the competent authority in Croatia:

10. Automated decision-making and profiling

Thessia Academy does not use automated decision-making or profiling within the meaning of Article 22 of the GDPR. The controller handles each registration and communication with parents manually.

11. Data security

We take reasonable technical and organizational measures to protect your data:

• The website is served only over an encrypted HTTPS connection.
• Only the controller has access to received data.
• The email inbox that receives registrations is protected by two-factor authentication (2FA).
• Registrations are forwarded to us by email and handled manually. We do not keep a separate registration database. Retention of copies by the form and email providers also depends on their services and settings.

12. Changes to this policy

We may update this policy. Changes will appear here with an updated date at the top. We will also email registered users about material changes affecting the processing of their data.

13. Contact

For questions, comments or requests about your personal data, email tamara@thessia.academy.