Effective date: 20 October 2025. Last updated: 2026-03-19
Data Controller: MB "Luxagente", legal entity code 307409593, Z. Gerulaicio g. 4-34, LT-45391 Kaunas, Lithuania, email: luxagente@gmail.com (hereinafter - the Company, we, us, our).
This Privacy Policy explains how MB "Luxagente" processes personal data when you use the LUX Repetitor platform and related services (hereinafter - the Platform). The Policy applies to all users (students, parents, teachers, legal entities and their representatives) as well as Affiliate Program participants.
1. Data categories and sources
1.1. What we collect directly from you:
- Registration data: first name, last name (where applicable), email address, phone number (if provided), account identifier, password hash.
- Subscription/payment information: plan type, payment status, invoice data (without full card numbers).
- Content/usage data: your questions, answers, learning history, chosen topics, progress.
- Communications: emails you send to us, complaints, feedback.
1.2. What we obtain automatically
- Technical data: IP address, device/browser type, session identifiers, login time, error logs.
- Cookies and similar technologies (see Section 8).
1.3. From third parties (where applicable)
- Payment providers / processors (e.g., Paysera, Stripe) - payment status, transaction ID, payment date.
- Affiliate Program - commissions, payout status, tax information (if you participate).
2. Purposes and legal bases for processing (GDPR Art. 6)
We process data for the following purposes:
1. Contract conclusion and performance (GDPR Art. 6(1)(b)): creating and administering your account; providing access to the Platform, managing subscriptions; providing digital content (AI tutoring, tasks, analyses).
2. Compliance with legal obligations (GDPR Art. 6(1)(c)): accounting and tax administration; responding to lawful requests from authorities.
3. Our legitimate interests (GDPR Art. 6(1)(f)): ensuring Platform security and performance (error logs, abuse prevention); improving services and features (anonymised/aggregated statistics); retaining evidence for dispute handling (for a reasonable period).
4. Consent (GDPR Art. 6(1)(a)) - where applicable: analytics/marketing cookies; direct marketing (newsletters, offers); in the case of minors - parental/guardian consent (see Section 10).
3. Data sharing (categories of recipients)
Data may be disclosed only to the extent necessary to achieve the purposes: Payment partners: banks, payment processors (e.g., Paysera, Stripe) - for processing payments; IT and hosting: server/cloud, email, security and DDoS/CDN service providers (within the EU/EEA or with appropriate safeguards - see Section 6); Analytics and service improvement: only with consent for the relevant cookies; Public authorities: where required by law (e.g., tax authority, data protection authority, courts); Other processors: only under data processing agreements and in compliance with the GDPR.
We do not sell your personal data to third parties.
4. Retention periods
We apply the principle "no longer than necessary":
- Account/registration data - for the entire lifetime of the account.
- Payment/accounting data - 10 years under Lithuanian law.
- Usage/learning history - until the account is deleted (or earlier upon your request) and thereafter only in anonymised form.
- Technical logs - typically 90-365 days (for security and diagnostics).
- Direct marketing - until consent is withdrawn.
5. Your rights (GDPR Arts. 15-22) and how to exercise them
You have the right to: obtain confirmation of processing and access your data; request rectification of inaccurate data; request erasure ("right to be forgotten") where applicable; request restriction of processing; object to processing where based on legitimate interests; withdraw consent at any time (where processing is based on consent, e.g., marketing/cookies).
Submitting requests: email luxagente@gmail.com.
Response time: within 30 calendar days (may be extended by up to 60 days due to complexity - we will inform you).
Complaints: you may contact the State Data Protection Inspectorate or bring a claim before a court.
6. Transfers outside the EU/EEA
If data are transferred outside the EU/EEA (e.g., via global CDNs or email services), we ensure appropriate safeguards, including European Commission Standard Contractual Clauses (SCCs) and/or adequacy decisions. We will inform you if the list of recipients changes.
7. Security
We apply organisational and technical measures in line with good industry practice: role-based access control (RBAC), secure password hashing with a unique random salt, encryption in transit (TLS) and, where applicable, at rest, logging and monitoring, backups, and employee confidentiality undertakings. However, no online system can guarantee 100% security.
8. Cookies and similar technologies
8.1. What are cookies?
Cookies are small text files stored on your device (computer, phone, tablet) by a website. They allow the website to recognise you, remember your settings (e.g., language, login state) and improve your user experience. We may also use similar technologies such as local storage, tracking pixels, or tags.
8.2. What cookies do we use?
The Platform uses the following categories of cookies: Necessary (technical/functional) - ensure the operation of the website and Platform; Analytics/statistics - help us understand how visitors use the Platform; Marketing/personalisation - display relevant content, offers or ads (only with explicit consent).
8.3–8.8. Third-party cookies (e.g. Google Analytics 4, Stripe, Paysera, Meta Pixel, YouTube, Vimeo), transfers outside EU/EEA, consent management, cookie duration, managing cookies in your browser, and consent records - full details are on the Platform. We log the moment of cookie consent (date, selected categories, IP, browser type) to demonstrate valid consent as required by GDPR Art. 7.
9. Automated decision-making and profiling
The Platform may apply profiling to personalise learning: the AI may suggest topics, tasks or recommendations based on your past activity on the Platform. Such profiling does not produce legal or similarly significant effects within the meaning of the GDPR.
10. Minors
10.1. Contracts for paid services may be concluded only with adults (18+), or with minors from 14 years of age if they have parental or legal guardian consent, or if they lawfully manage their own funds under the Civil Code of the Republic of Lithuania.
10.2. Minors under 14 may use the Platform only via their parents' or guardians' account and under their responsibility.
10.3. If it is established that personal data have been collected from a minor without the required consent, MB "Luxagente" will promptly take steps to delete such data or obtain the appropriate parental/guardian consent, ensuring lawful processing under GDPR Art. 8.
11. Affiliate Program
11.1. For ordinary users (students, parents, teachers) we do not collect bank details or personal identification numbers.
11.2. For Affiliate Program participants (when commissions are payable) we process: first name, last name; personal identification number or company code; IBAN; data on accrued/paid commissions. Purposes and bases: calculating and paying commissions - contract (GDPR Art. 6(1)(b)) and legal obligations (GDPR Art. 6(1)(c)); reporting to the State Tax Inspectorate - legal obligation (GDPR Art. 6(1)(c)). Recipients: payment partners (banks, processors), the State Tax Inspectorate, and (where applicable) accounting service providers. Retention: only as necessary for tax accounting and contractual obligations (generally up to 10 years for accounting).
12. Marketing and notices
We send direct marketing emails only with your consent. You can opt out at any time by clicking the unsubscribe link in the email or by writing to us.
13. Data retention and export after the end of the relationship
When contractual relations end or your account is deleted: we will delete personal data within a reasonable time, except for data we must retain under law (e.g., accounting documents).
14. Changes to this Policy
We may update this Policy by publishing a new version on the Platform (and, where changes are material, we will also notify you separately). Your continued use after an update means you accept the changes, except where the GDPR or other laws provide otherwise.
15. Contacts and complaints
Data Controller: MB "Luxagente", Z. Gerulaicio g. 4-34, LT-45391 Kaunas, Lithuania
Email: luxagente@gmail.com
Complaints: State Data Protection Inspectorate (VDAI) - A. Juozapaviciaus g. 6, 09310 Vilnius, Lithuania, vdai.lrv.lt. You also have the right to bring a claim before a court under Lithuanian law.
Summary (informative only): We process only what is necessary to provide the service, ensure security, meet accounting obligations, and - where you consent - analytics/marketing. We do not sell your data. Your key rights: access, rectification, erasure, restriction, portability, objection, and consent withdrawal. Affiliate data are processed solely for commissions and taxes. Non-essential cookies require your consent.
16. Data Deletion
If you would like to request deletion of your personal data, you can contact us at:
luxagente@gmail.com
We will process your request and delete your data within a reasonable timeframe.
You may also request deletion directly through the Platform (if available).
17. Meta (Facebook and Instagram) integration
Our platform integrates with Meta (Facebook and Instagram) APIs to enable messaging functionality and communication with users via Instagram Direct and Facebook Messenger.
We do not store sensitive personal data beyond what is necessary to provide the service.