Privacy Policy - Yeda
 
Last updated: October 26, 2025 · Version: V2.1 · Website: getyeda.com
 
Yeda by Golan (“Yeda”, “we”, “us”) provides online tutoring services for teens, including: English Lessons, Math Lessons, Guided Homework Sessions (“Focus Sessions”), Mentor Consultations, and the Yeda Learner Profile (see Section 5.1). We act as the data controller for personal data processed via our website, booking pages and service delivery. This Policy aligns with the EU General Data Protection Regulation (GDPR) and Belgian data protection law.

1) Who we are (Controller)

• Controller: Yeda by Golan, Tiensesteenweg 247, 3360 Bierbeek, Belgium.

• Privacy contact / data subject requests: info@getyeda.com.

 
2) Scope & audience

• This Policy applies to: (a) Customers (parents/guardians or adult students), (b) Students (teens who attend lessons/sessions), and (c) website visitors and prospective clients.

 
3) Personal data we collect

• Identity & contact data (name, email, phone, city/country, parent/guardian relationship).

• Booking & session data (service type - English, Math, Focus Session, Mentor Consultation - teacher, date/time, attendance; brief notes limited to educational context).

• Communications (emails, messages related to scheduling/support).

• Payment-related data (payer name, amount, currency, transaction references; for card/wallet payments we receive tokens/last 4 digits from processors - we do not store full card details).

• Technical data (IP address, device/browser information, approximate location).

• Cookies/Ad identifiers (subject to consent; see Cookies).

• Consents & preferences (e.g., marketing consent, cookie choices).

 
4) Where data comes from

• Directly from you (booking forms, emails, calls, brief onboarding questionnaire for Learner Profile).

• Automatically via our website/booking tools (technical data, cookies).

• Payment processors/banks (transaction confirmations).

• Video platforms used to attend lessons/sessions (e.g., display name, connection data).

5) Why we use data (purposes) & legal bases

•  We process personal data for the purposes below under GDPR Art. 6. Where consent is required, you can withdraw it at any time (this does not     affect prior lawful processing).

• Service delivery & administration (bookings, lessons/sessions, entitlements). Legal basis: contract (Art. 6(1)(b)).

• Customer support & communications. Legal basis: contract/legitimate interests (Art. 6(1)(b)/(f)).

• Invoicing, accounting & compliance. Legal basis: legal obligation (Art. 6(1)(c)).

• Service improvement, quality & security (including limited analytics, debugging). Legal basis: legitimate interests (Art. 6(1)(f)).

• Marketing communications (news/offers to Customers). Legal basis: consent (Art. 6(1)(a)); where ePrivacy rules allow “soft opt-in” to existing Customers for similar services, we rely on legitimate interests with an easy opt-out.

• Testimonials & media (quotes, photos, recordings). Legal basis: consent (Art. 6(1)(a)).

• Cookies & remarketing tags (Google Ads, Meta/Facebook/Instagram) used on the website. Legal basis: consent via the Cookie Banner/Preferences.

   5.1) Yeda Learner Profile

• What it is: a concise written profile that summarizes a Student’s learning context to personalize future sessions. The profile may include: current goals, skill highlights and areas for development, preferred learning styles/pace, recommended focus areas and suggested next steps.

• Data sources: (i) a short onboarding questionnaire completed by the Customer/Student, and (ii) limited tutor observations from early sessions (e.g., engagement, pacing, topics well-understood vs. challenging). We do not require sensitive data and we do not use automated decision-making to create the profile.

• Use & sharing: the Learner Profile is used internally by Yeda tutors to tailor instruction and is shared with the Customer (parent/guardian or adult Student). It is not published or shared with advertisers.

• Legal basis: contract (to provide and tailor the educational service) and Yeda’s legitimate interests in improving teaching effectiveness (Art. 6(1)(b)/(f)).

• Retention: typically up to 24 months after last activity, or earlier upon request. You can request a copy, corrections, or deletion (subject to legal retention for business records).

6) Students and minors (13-17)

• Our programs are designed for teens. A parent/guardian acts as the Customer for minors; we do not knowingly enter into contracts directly with minors. Optional uses (e.g., testimonials, recordings) require parental consent. Our marketing communications are addressed to parents/guardians.

7) Do we record lessons/sessions?

• No, not by default. Any recording requires prior explicit consent with a clear notice of purpose, access and retention. If consent is refused, recording will not occur for that participant.

8) Payments & processors
   We may accept the following payment methods:

• Bank transfer (wire/SEPA) - we process payer details appearing on statements; banks act as independent controllers.

• Card payments via Stripe (if offered) - Stripe tokenizes card details; we do not store full card numbers.

• PayPal (if offered) - we receive transaction confirmations from PayPal; PayPal is an independent controller for its wallet service.

• Other methods may be added; we will update this Policy and our checkout notices accordingly.

9) Tools we use & who we share data with 
   We share data only as necessary for the purposes above, with appropriate contract and safeguards:

• IT & cloud: Microsoft 365/SharePoint/OneDrive; Microsoft Teams; Zoom (lesson delivery & collaboration).

• Communications: email and messaging tools used for scheduling/support.

• Payments: Stripe and/or PayPal (if enabled), and our banking providers.

• Advertising tags (website): Google Ads and Meta (Facebook/Instagram) Pixel for remarketing/ad measurement - loaded only if you consent.

• Accounting & professional advisors (where necessary).

   These parties act as processors or independent controllers depending on context.

10) International transfers

• If personal data is transferred outside the EEA/UK (e.g., by Microsoft, Zoom, Meta, Google, Stripe, PayPal), we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) and assess transfer risks where required. Details are available on request and via the Cookie Banner for web tags.

11) How long we keep data (retention)

• Business/financial records: 10 years (accounting/tax law).

• Booking/session logs & entitlements: 24 months after last activity.

• Support communications: 24 months after resolution/last contact.

• Marketing lists: until consent is withdrawn or 24 months of inactivity.

• Recordings (if any, with consent): up to 90 days unless a shorter period is specified at the time of consent.

 

12) Security

• We apply technical and organizational measures appropriate to risk, including access controls, encryption in transit, role-based permissions, least-privilege, staff confidentiality and periodic reviews. No method of transmission or storage is 100% secure; we continuously improve safeguards.

13) Your privacy rights (GDPR) & how to exercise them

• You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. You may also lodge a complaint with the Belgian Data Protection Authority (GBA/APD).

• How to exercise: email info@getyeda.com from the address used with us; we may verify your identity. We aim to respond within one month (extendable by two months for complex requests). Some rights may be limited by legal obligations (e.g., accounting retention).

14) Cookies & similar technologies (one-document approach)

• Our website uses necessary cookies and, with your consent, advertising/remarketing tags (currently Google Ads conversion/remarketing and Meta Pixel). We only place non-essential cookies/tags after you have provided valid consent in our cookie banner. You can manage or withdraw consent at any time via the Your Privacy Choices link in the footer.

15) Public pages & social media

• We operate public pages on Instagram, Facebook and LinkedIn. Your interactions with those pages are also subject to each platform’s own Terms and Privacy Policy.

 

16) Changes to this Policy

• We may update this Policy to reflect legal, technical or business changes. We will indicate the updated date above and, where appropriate, notify you on the website or by email.

 

17) Contact & supervisory authority

• Controller contact: info@getyeda.com

• Address: Tiensesteenweg 247, 3360 Bierbeek, Belgium.

• Belgian Data Protection Authority (GBA/APD): You can lodge a complaint with the supervisory authority if you believe your rights have been infringed.

© 2025 Yeda by Golan - Privacy Policy