Privacy Policy

1. Data Controller

The data controller is HOLA25 SRL, registered office: Str. Dealului nr. 8, Fărcășești, Gorj County, 217235, Romania. Contact: contact@hola25.com

2. Data-protection contact

For all data-protection inquiries, the contact point is: contact@hola25.com

3. Data We Process

• Account data: email, authentication identifiers (e.g., Google), account settings.

• Restricted deleted-account ledger: normalised email, original account identifier, display name, deletion date and count, and block status, used for deletion history and moderation controls.

• Email-marketing preference: the current account setting and communication language. An unticked or omitted choice is not treated as consent.

• Profile data: display name, username, bio, nationality, sex, profile image, languages/skills and self-assessed levels, date of birth (public/private), phone number (private).

• Usage data: call minutes (host/guest), minutes per skill (where applicable), interactions (requests, private message requests, reports).

• Payment data: product, teacher or creator and the applicable schedule or access, price, currency, discounts, authorization/capture/refund/dispute status, and applicable Stripe identifiers.

• Tax and billing data: legal name, address and country where needed for a fiscal document.

• Contract evidence: product-agreement confirmation, confirmations made separately at payment, selected declarations, language, channel, early-performance requests, withdrawals, cancellations, refunds and confirmations sent.

• Online withdrawal-function data: name, contract identifier, the email address selected for the acknowledgment, exact statement, receipt number, date and time, acknowledgment status and, where available, scope-separated HMAC pseudonyms for the IP, Firebase app ID and account. For abuse control, we temporarily retain separate HMAC pseudonyms of the acknowledgment address and contract identifier. These values are pseudonymised, not anonymous, data.

• Live-lesson recording data: audio, video, content shared in the room, participant identities, technical meeting/recording identifiers, proof of separate acceptance, the playback entitlement's link to the participants authorised for the segment, access events, provider-reported actual state, start/processing incidents, and deletion state. Only audio, video, and screen streams enabled by the participant are captured; the camera may remain off where the room permits. Segment creation, synchronisation, and processing may be delayed, contain gaps, or fail, and timestamps in the file do not necessarily match attendance evidence to the second. We do not guarantee a recording's availability, continuity, or completeness. A technical failure may mean that no usable file is produced even though provider state and separate attendance and incident evidence are retained. Report any issue to contact@hola25.com as soon as possible after the lesson. We do not currently intentionally extend retention of the video file beyond the 90-day maximum and do not apply a legal-hold mechanism to it. If technical deletion is not confirmed, the file remains blocked and inaccessible while deletion is retried and escalated. Hola25 may later introduce a separate restricted hold for litigation, an investigation, a legal duty, or the defence of rights, only after technical activation and an update to the applicable notice and terms and, where legally required, acceptance. Such a hold would not extend ordinary teacher or participant access; access would be limited on a need-to-know basis to authorised staff, advisers, involved providers, or competent authorities.

• Optional external-promotion data: selected public profile or listing content, creative image, Hola25 link, campaign identifiers and status, plus general audience criteria and budget. Those criteria are not an exact list or segment and may be adjusted by the external platform. Publishing the profile does not by itself authorise this use; the teacher must make a separate affirmative choice.

• Insula Iubirii and Living data: eligibility and date of birth, enrolment, predictions and choices, points, rank, accuracy, and results; email address, phone number, and technical identifiers used for abuse prevention; identifiers and content of the diploma or sharing image; and, in Living, display name, photo, messages, images, technical presence, limits, restrictions, reports, and the preference to receive notifications.

• Private messaging data: text messages, files uploaded directly to the lesson conversation, message request status, thread metadata, and block/unblock records needed to prevent unwanted contact.

• Technical data: IP (where applicable), device/browser info, security logs, error logs.

• Webinar data: webinar registrations, live presence, webinar chat messages, replay recordings, and playback/security metadata.

• Moderation data: reports, reasons, outcomes of enforcement actions.

4. Purposes, Legal Bases, and Data Categories

5. Public Data

A public profile has a display name and username; if you do not provide them, the platform may create neutral values. The public profile record is accessible without authentication; a field written to that record may be read even when the main page does not display it. Bio, image, nationality, gender, date of birth, languages, and skills may form part of the public profile. Do not add those data to the public profile if you want them to remain private; the phone number remains in the private profile.

A public teacher profile may include the occupation title, bio, county and locations, work and education, selected languages and skills, ratings, statistics, published articles, and active listing details including description, price, duration, location, and demonstration-lesson availability. Name, image, title, bio, county, and languages may also appear in structured search-engine data; a noindex marker does not make the page private. Demonstration videos and thumbnails are processed through the video provider identified in the recipient register.

5a. Call Photo Preferences

During video calls, the platform can capture a single photo at the 25th second as a memory of your connection. You have full control over this feature through the following preferences:

• Enable call photos: Controls whether photos are captured during your calls. Enabled by default.

• Allow others to have my photo: Controls whether other users can save combined photos that include you. Disabled by default to protect your privacy.

• Prefer self-only in call history: Controls whether to display only your own photo (instead of combined photos with others) in your call history. Enabled by default.

These preferences are stored in your private profile data and can be changed at any time in your profile settings. Call photos are stored securely. An account-deletion request includes a request to remove them from storage, but account completion does not confirm deletion of every object; if a photo remains available, email contact@hola25.com.

5b. Optional external promotion

External promotion is an optional feature separate from ordinary profile or listing publication. The teacher does not buy or pay for this service. Hola25 may decide whether and when to create a campaign, select its content, general audience criteria, channel, and budget, and finance the promotion directly or through partners. A teacher's affirmative choice permits only evaluation and use for this purpose; it does not start a campaign by itself, guarantee promotion or results, or authorise other marketing purposes.

The current implementation covers teacher listings only. A future extension to Trial Lessons or Paid Lessons will not automatically rely on the existing choice: before that processing, we will provide the applicable notice and request distinct affirmative choices scoped by product and, where relevant, by offer and subject. The absence of such a choice does not affect ordinary publication or delivery of the product outside the external promotion feature.

Withdrawing the choice, disabling the teacher profile, or deleting the account locally blocks creation and resumption and creates a stop request for affected campaigns. Confirmation by the external platform may be asynchronous; until it is received, local state is not proof that the provider has stopped the campaign. Contact contact@hola25.com to ask for the current recorded status of a specific stop; that status does not replace confirmation from the external platform.

The current provider, applicable role, and transfer limits are identified in the recipient register below. We do not treat public profile visibility as authority for external promotion. Audience criteria are general campaign directions, do not describe an exact list or segment of people, and may be adjusted by the external provider.

5c. Insula Iubirii and Living

For participation in Insula Iubirii, we may verify eligibility and age using the date of birth, record enrolment, predictions, and choices, and calculate points, rank, accuracy, and results. Email address, phone number, and technical identifiers may be used for security, participation limits, and abuse prevention.

A diploma or sharing image may be public and accessible through a URL containing the user's technical identifier (UID). It may display the public name, couple predictions, total and activity points, rank, accuracy, the early-choice result, and other game results, and may be temporarily cached by browsers, delivery networks, or services through which it is shared. Later withdrawal or changes in Hola25 do not guarantee immediate removal of copies already saved or redistributed by third parties.

Living is a space for authenticated users. Display name and photo may be visible to other participants together with posted messages and images. We also process technical presence data, usage limits, restrictions or bans, reports, and notification interest or choice for operation, safety, and moderation. Do not post sensitive data or information about another person without an appropriate basis.

These categories do not all have the same retention period. We retain them as needed for the requested function, contest results, security, abuse prevention, moderation, defence of rights, and applicable legal duties. Retention necessity is assessed by category; depending on purpose, law, and technical feasibility, the outcome may be erasure, restriction, anonymisation, or continued retention of a record. Account deletion does not necessarily mean immediate removal of every record, a final result, or a public copy already shared. You may exercise the rights described in Section 10 by contacting contact@hola25.com; the request is assessed for each category and applicable legal exceptions.

6. Recipients and Service Providers

We share data with the following providers only as necessary. Their GDPR role may be processor, independent controller, or recipient depending on the service and data involved:

We may disclose strictly necessary data to ANAF/SPV, ANSPDCP, ANPC, courts, law-enforcement bodies or other authorities where a legal obligation or valid request applies. Teachers and creators receive only what is needed to perform the product and never the buyer's full card details.

Some recipients may process data outside the EEA or allow access from a third country. Before an applicable transfer, we assess the recipient, destination, role, and legal instrument. Depending on the case, this may be an adequacy decision, Standard Contractual Clauses with the appropriate module and supplementary measures, or another mechanism permitted by GDPR Articles 44-49. You may request information about the mechanism applicable to your data using the contact address.

7. Advertising (Google AdMob)

Mobile advertising is disabled in the current release. The iPhone app does not include the Google Mobile Ads or UMP SDKs, does not include the ATT permission, and does not request the advertising identifier and therefore makes no ad request through those components.

8. Data Retention

9. Your Rights

Under GDPR, you have the following rights:

• Access (Art. 15): Obtain a copy of your personal data being processed;

• Rectification (Art. 16): Correct inaccurate or incomplete data;

• Erasure (Art. 17): Request deletion of your data ("right to be forgotten");

• Restriction (Art. 18): Limit processing in certain conditions;

• Portability (Art. 20): Receive your data in structured format (JSON);

• Objection (Art. 21): Object to processing based on legitimate interests;

• Automated decisions (Art. 22): Not be subject to decisions based solely on automated processing.

To exercise your rights, email contact@hola25.com. We respond without undue delay and no later than one month. For a complex or numerous request, the period may be extended by up to two further months; we explain the extension and its reasons within the first month. If we do not act, we communicate the reasons, complaint right, and available judicial remedy within one month. We may request only additional information necessary and proportionate to verify identity.

10. Automated Decision-Making and Profiling

Eligibility rules, security or fraud signals, moderation tools, search, ordering, and recommendations may involve automated processing and, where applicable, profiling. The waitlist displays available users, while the choice of whom to contact remains manual. We do not use an automated result as a final decision with legal or similarly significant effects without the applicable safeguards and rights; you may request an explanation and human intervention for a decision controlled by Hola25.

11. Security

We implement technical and organisational measures appropriate to the assessed risk, including:

• Encryption in transit (HTTPS/TLS);

• authentication and role-based access controls;

• access rules for databases and storage;

• restricted access to payment services and transaction data;

• logging, monitoring, and, where applicable, continuity and recovery measures.

No transmission or storage method is 100% secure. Users should protect their credentials and immediately report any suspicious activity.

12. Data Breach Notification

In case of a data breach posing risk to the rights and freedoms of data subjects, we will notify ANSPDCP within 72 hours (Art. 33 GDPR) and, if necessary, inform affected users without undue delay (Art. 34 GDPR).

13. Complaints

You may lodge a complaint with ANSPDCP or the supervisory authority in the Member State of your habitual residence, place of work, or the alleged infringement, without losing your right to a judicial remedy:

14. Policy Updates

This policy may be updated periodically. Material changes are communicated through an appropriate channel before they take effect where required by law or contract. The last update date is displayed at the top of this page.

15. Contact

For any questions about data protection: