Privacy Policy for Bright Roots Learning Studio

Effective Date: 1/8/2026

​​

1. Introduction

Welcome to Bright Roots Learning Studio.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we process, why we use it and how we protect it when you visit brightroots.sk, communicate with us, or submit an application or job application through our online forms.

 

2. Data Controller

The data controller responsible for the processing of your personal data is:

Bright Roots s. r. o.
Company ID (IČO): 57593281
Tomášikova 12573/50E
831 04 Bratislava – Nové Mesto
Slovak Republic

Email: info@brightroots.sk

​

3. What Personal Data We Process

The personal data we process depends on how you interact with us and which service you use.

​

Programme Applications

When submitting an application, we may process:

Child's information:

• first and last name,

• date of birth,

• address,

• language or languages spoken at home.

Parent or legal guardian's information:

• first and last name,

• email address,

• telephone number.

Application information:

• selected programme,

• preferred start date,

• how you heard about Bright Roots,

• reason for choosing Bright Roots Learning Studio,

• any additional information you voluntarily provide through our forms or communication.

We do not request or routinely process health information, information about allergies, or other special categories of personal data as part of the programme application.

Applications may be processed using Airtable.

​

Job Applications

When applying for a position with us, we may process:

• first and last name,

• email address,

• telephone number,

• CV/resume,

• education and qualifications,

• professional experience,

• any other information you voluntarily provide as part of your application.

This information may be submitted through forms on our website or sent to info@brightroots.sk.

​

Contact Forms and Communication

If you contact us through a contact form, email or another communication channel, we may process:

• your name,

• email address,

• telephone number, if provided,

• the content of your message,

• any other information you voluntarily provide.

 

4. Purposes and Legal Basis for Processing

We process personal data primarily for the following purposes:

• processing programme applications and communicating with applicants,

• receiving and assessing job applications,

• responding to questions and enquiries submitted through our contact forms,

• preparing for and performing contractual or pre-contractual arrangements,

• ensuring the security and proper functioning of our website,

• complying with legal obligations where required by law,

• protecting our legitimate interests, including protecting our rights and preventing misuse of our services.

The legal basis for processing may include:

• Article 6(1)(b) GDPR – processing necessary for taking steps at the request of the data subject prior to entering into a contract or for the performance of a contract;

• Article 6(1)(c) GDPR – compliance with a legal obligation;

• Article 6(1)(f) GDPR – our legitimate interests;

• Article 6(1)(a) GDPR – consent, where consent is the applicable legal basis for specific processing activities.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

 

5. How Long We Keep Personal Data

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required by applicable law.

• Programme applications are retained for as long as necessary to process the application and communicate with the applicant and, where applicable, for the duration of the relevant contractual relationship. After this period, data may be retained for as long as necessary to comply with legal obligations or protect our legal claims.

• Contact form messages are retained for as long as necessary to handle the enquiry and any related communication, normally for no longer than 6 months, unless a longer retention period is required for legal reasons.

• Job applications are retained for the duration of the recruitment process and normally for no longer than 12 months afterwards, unless there is a legal reason for longer retention or the applicant has given consent for their application to be retained for a longer period.

After the applicable retention period, personal data will be deleted or anonymised unless further retention is required by law.

​

6. Data Processors and Disclosure of Personal Data

To provide our services and operate our website, we use third-party service providers who may process personal data on our behalf.

These include, in particular:

• Airtable – used to manage and process programme applications;

• Wix – provider of the platform and technical infrastructure for our website and online forms;

• providers of email and IT services necessary for communication and the operation of our services.

We use appropriate contractual and legal mechanisms with these providers to protect personal data in accordance with the GDPR.

Where personal data may be transferred outside the European Economic Area (EEA), we ensure that such transfers are carried out using appropriate safeguards and legal mechanisms required under the GDPR.

We do not sell personal data or provide it to third parties for their own marketing purposes.

We may disclose personal data to competent authorities or other parties where required by law or where necessary to protect our legal rights and legitimate interests.

​

7. Cookies

Our website uses essential technical cookies necessary for its proper functioning, as well as analytics and marketing cookies and similar technologies provided by third parties.

Analytics cookies help us understand website traffic and how visitors use our website so that we can improve its content and functionality. Marketing cookies may be used to display advertising that is more relevant to users and to measure the effectiveness of advertising campaigns.

We use analytics and marketing cookies based on your consent where such consent is required under applicable law. You can withdraw or change your consent at any time through the cookie settings available on our website.

Further information about the cookies we use and how you can manage them is available through our cookie banner and cookie settings.

​

8. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

Access to personal data is limited to individuals who need it to perform their professional or contractual duties and only to the extent necessary.

​

9. Your Rights

Subject to the conditions set out in the GDPR, you have the right to:

• access your personal data;

• request the correction of inaccurate or incomplete personal data;

• request the deletion of your personal data (“right to be forgotten”);

• request restriction of processing;

• object to the processing of your personal data;

• request data portability where the conditions under the GDPR are met;

• withdraw your consent at any time where processing is based on consent;

• lodge a complaint with a supervisory authority.

If you believe that your rights have been violated in connection with the processing of your personal data, you may lodge a complaint with:

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)

Further contact information is available on the authority's official website.

​

10. Contact

If you have any questions about the processing of your personal data or wish to exercise your rights, please contact us:

Bright Roots s. r. o.
Email: info@brightroots.sk

​

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, particularly if there are changes to our services, technologies we use or applicable legal requirements.

The current version of this Privacy Policy will always be published on this website together with its effective date.

Effective Date: 19 August 2026