Privacy policy

Version 2026-10-22-draft3

This policy explains which personal data of students, parents and staff the B&S SAT academy learning platform processes, why, where it is kept and how you can control it. It follows Law of the Republic of Uzbekistan No. ZRU-547 "On personal data" of 2 July 2019. The Russian and Uzbek versions are the main ones; this translation is for convenience.

1. Who processes the data

The operator and owner of the personal data database is B&S SAT academy.

Full legal name: [to be filled in]

Address: [to be filled in]

Taxpayer number (INN): [to be filled in]

Phone: [to be filled in]

E-mail: [to be filled in]

Person responsible for processing personal data: [to be filled in]

2. What data we process

Account: first and last name, phone number (also the sign-in name), role. The password is kept only as an irreversible hash.
Studies: school grade, SAT date and target score, classes, answers to questions (right or wrong, time taken), practice test results, homework, words and word lists, saved questions, reports of mistakes in questions, college list.
Messages: class chats, chats with teachers and support, photos and documents sent there.
For students under 18: the name and phone of the parent or guardian who gave consent.
Consents: what was agreed to, when, in which form and who recorded it; for consent on the website, the IP address and browser.
Technical data: IP address and browser of signed-in devices, last sign-in time, a log of changes to the account, notifications.
“Forgot password?” requests: the name, phone number and note typed into the form, and the IP address. A closed request is deleted 30 days after it was closed, one nobody answered after 90 days.

The profile photo stays only in your browser: it is never sent to the server and is removed from the browser when you sign out. We do not collect biometric, genetic or special personal data (health, beliefs and the like).

3. Why

studying: the question bank, tests, vocabulary and progress reports;
running classes: classes, schedule, homework, contact with teachers and support;
enrolment and access to the platform;
keeping accounts secure and investigating incidents;
anonymous statistics of the center.

We do not sell data, do not use it for advertising and do not make decisions about a person by automated means alone.

5. Students under 18

For minors, written consent to processing is given by their parents or guardians (art. 21 of the Law). A student under 18 who signs up on the website enters the name and phone of a parent or guardian, who confirms the consent. At enrolment the center asks the parent to sign a paper consent form.

6. Where data is kept and transfer abroad

Data is kept on DigitalOcean, LLC servers in the Netherlands (Amsterdam). Encrypted backup copies are kept in another data center of the same provider: Germany (Frankfurt).

Under art. 27¹ of the Law (as amended by ZRU-1125 of 26.03.2026), only biometric and genetic data and data of telecom subscribers must be kept in Uzbekistan; the platform processes none of these. Other data may be kept abroad in countries that ensure equal protection of personal data. The Netherlands and Germany are on the list of such countries approved by Cabinet of Ministers resolution No. 415 of 29.07.2026, so transfer there is allowed (art. 15 of the Law).

The provider keeps the data on our instructions and may not use it for its own purposes. We give data to no one else, except where the law requires it. The Desmos calculator in tests loads from desmos.com (USA) and receives only technical browser data and the IP address, no account data. When a new password is checked against known data breaches, only the first 5 characters of its hash leave the server.

7. Who sees the data

Teachers see the results and messages of students in their classes. Admins see data within their role; the head of the center sees everything. Class members see each other's names in the class chat. Staff access is logged.

8. How long we keep it

while the account is used for studying;
an account nobody has used for 24 months is anonymised;
someone who signed up alone and whose enrolment the center never confirmed: after 6 months;
on request or when consent is withdrawn: within 10 days.

Anonymisation (art. 16 of the Law): the name and phone are replaced with placeholders, photos and files are deleted, message texts are erased, and the account can no longer sign in. Only anonymous study numbers remain for the center's statistics. Backups are kept up to 14 days on the server and up to 30 days in off-site storage, then deleted.

9. Your rights

to know what data about you we hold and get a copy of it;
to correct wrong data, yourself in the profile or on request (within three days, art. 11 of the Law);
to withdraw consent;
to ask us to suspend processing or to delete (anonymise) the data;
to turn to the authorised state body or a court (art. 30 of the Law).

To use a right, write to support on the platform or to the operator's e-mail, or come to the center. We may ask you to confirm that the request comes from you or from your parent. We answer within 10 days; a refusal, where the law allows one, is sent in writing with the reason (art. 22 of the Law).

10. Protection

The connection is encrypted (HTTPS), passwords are kept only as hashes, admins sign in in two steps unless the head of the center turns that requirement off, teachers can turn two-step sign-in on for themselves, access is limited by role and staff actions are logged. The backup copies kept outside the server are encrypted; the copies on the server itself are open only to its administrator.

11. If data leaks

We will tell the authorised state body within 24 hours of finding out and give details of the causes and measures within 72 hours (paragraph 4 of resolution No. 415), and we will tell the affected students and parents what happened and what to do.

12. Changes to this policy

A new version is published on this page with a new version number. If the purposes of processing change, we will ask for consent again.