Pay Once. Learn Forever.

PRIVACY POLICY of the WEBSITE https://xperience.school/

    Applicable from 01.10.2025 This Privacy Policy of the website https://xperience.school/ (the "Policy/Policies") applies to the processing of personal data of data subjects located in Bulgaria or outside the country who are in a relationship for the use of the website with EXPIRENCE SCHOOL EOOD, a company established and existing under the laws of the Republic of Bulgaria, registered in the Commercial Register and the Register of Non-Profit Legal Entities with UIC 208383403, with its registered office and address of management at 21 Krichim St., fl. 4, Lozenetz District, 1407 Sofia ("EXPERIENCE SCHOOL" or the "Company" or "We/Us"), which maintains and operates the XPERIENCE SCHOOL internet platform, accessible on this website (https://xperience.school). In its capacity as a data controller, the Company processes the personal data provided by users who visit the website https://xperience.school/ (the "Website") in full compliance with the applicable regulatory provisions related to the protection and processing of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). We recommend that you read this Policy carefully to learn more about how we process your personal data and what your rights are.

1. WHAT PERSONAL DATA WE PROCESS

EXPERIENCE SCHOOL collects your personal data directly from you, so you decide voluntarily and freely whether to provide it to us. When you create an account on the XPERIENCE SCHOOL online platform, you provide us with at least the following information as identification data: email address, first and last name. If you wish, in connection with your use of the Website, you may provide information about projects you have worked on and their status, which you wish to share. You may provide us with any other information that you deem relevant to the use of the Website and whose presentation on it would be beneficial to you. When choosing a paid subscription plan, you also provide us with any additional information necessary to make and administer payments, including credit card details. We do not collect or otherwise process sensitive data included in the special categories of personal data under the General Data Protection Regulation. We do not collect or process personal data of persons under the age of 18. If you have information that such personal data has reached us, please contact us at the contacts listed on the Website. Please note that when we ask you to fill in your personal data to create a user account or to give you access to a specific feature or service on the XPERIENCE SCHOOL online platform, we will mark certain fields as mandatory because this is the data we need to complete the registration, provide the service, or give you access to the relevant feature. If you decide not to provide us with this data, you may not be able to complete your user registration or take advantage of the relevant services or features of the XPERIENCE SCHOOL online platform. To the extent that you provide us with your personal data, you guarantee that it is true and accurate, and you are responsible for providing incorrect, inaccurate, or incomplete information. As a rule, you only provide us with your own personal data. When, for any reason, you provide us with the personal data of third parties, by providing it, you guarantee that you have informed them of the purposes and methods by which we will process their personal data, and that you have obtained the consent of these third parties to provide us with the relevant data for the relevant purposes.

2. HOW WE COLLECT PERSONAL DATA

• freely provided by you in your user profiles;
• through your browsing of the Website (e.g., cookies, navigation data, etc.).

2.1. Data provided by you

• When you decide to create an account on the Website

If you choose to create an account on the Website in order to use its full functionality, we will process your personal data such as your name and email address and the information specified above. We will also process any other information you provide in your profiles as part of the Website's functionality, such as, but not limited to, education, professional skills, completed projects, etc. By registering, you confirm that you have read and voluntarily accept in full the provisions contained in these General Terms and Conditions for Use of the Website. After you have successfully registered your profile, you will receive an email from us at the email address you provided to welcome you to the platform. You can change your personal password for your account whenever you want from the settings panel in your account. You can access your account by entering your email address and the password you chose. EXPERIENCE SCHOOL processes the specified personal data by virtue of and for the purposes of performing a contract, as acceptance of the General Terms and Conditions of Use of the Website constitutes the conclusion of such a contract between the Company and you as the respective parties. The general rule is that we will store this data for the duration of your account. You may request that We close your XPERIENCE SCHOOL account at any time, and We will comply with your request, provided that We are not required to retain certain information that may be required under applicable law (e.g., by government authorities or institutions), for internal administrative purposes, to protect our legitimate interests or those of third parties in the event of disputes or legal proceedings. We may permanently delete any of your data that we are not legally required to retain for a certain period under applicable law. If we have a legal obligation to retain certain data or if such data is requested from us by the competent authorities in the course of administrative, judicial or other proceedings, we will only be able to delete such data once our obligation has ceased to exist.

When you manage your profile and use the Website

• When you manage your profile and use the Website

Once you have created your profile on XPERIENCE SCHOOL, you can configure it by changing your password and/or filling in and saving certain personal data in the relevant section of your profile. Each time you manage your profile, the data specified in the previous point will be processed and the same

• rules specified therein will apply.
• If you subscribe to receive newsletters from us, which may also contain commercial communications

This processing is optional. When you create a profile on the Website, we will offer you the opportunity to subscribe to our newsletter, through which you can receive information about current news related to the use and functionality of the Website, promotions, and commercial communications from us. In this case, we will process your email address to manage the sending of newsletters to you. Subscription to the newsletter is based on the consent you give by checking the appropriate box for the specified purpose or, where applicable, given in writing. This consent may be withdrawn at any time by following the instructions provided by us in each message sent. Your data will be stored in the records of EXPIRENCE SCHOOL until you withdraw your consent. However, we reserve the right to maintain a special opt-out list to ensure that we do not send you commercial communications in the future.

• When you contact Us through any means of contact

You can contact Us using the details provided on the Website (by email address, telephone, post, or any other form or means provided). In this regard, we will process your contact details and any other information you choose to provide to us voluntarily on the basis of your explicit, informed, prior, and unambiguous consent. We process this personal data based on our legitimate interest in responding to your inquiries and requests. We will store this data until the issue raised has been finally resolved or until you request its deletion (to the extent that the right to deletion applies).

• 2.2. Data collected when you browse the Website

When you use the XPERIENCE SCHOOL Website, it automatically collects certain information and stores it in log files. The information may include Internet Protocol (IP) addresses, the general area or location from which your computer or device accesses the Internet, browser type, operating system, and other usage information about your browsing on the Website, including the history of the pages you have visited on it. We use this information to develop and improve the Website in a way that best meets the expectations and needs of our users. We may also use your Internet Protocol address to determine if there is a problem with our server and to administer the Website, as well as to analyze browsing trends and changes in visitor traffic, and to collect a wide range of demographic information that helps us understand the preferences of Website visitors. This data may be stored for a maximum period of 1 year, after which it will be deleted (if it has been saved). Our Website uses cookies and other similar technologies to enable you to take advantage of the optimal functioning of the Website. Their use is only carried out with your prior consent. You can read more detailed information in this regard in our Cookie Policy.

3. TO WHOM WE MAY DISCLOSE PERSONAL DATA

We may disclose your personal data to third parties in the following situations:

• companies that provide products and services to XPERIENCE SCHOOL, such as:
  • analytical, promotional, and/or advertising web services;
  • information technology providers, including information system support, email archiving, backup, data recovery, and cybersecurity, as well as payment service providers when choosing a paid account or paid services.
• other companies and organizations, such as any competent public institution, accountants, auditors, lawyers, and other external consultants, in cases where it is necessary for them to become familiar with this data in order to provide their services to Us, as well as in cases where disclosure is required by law.

4. Privacy & Data Protection

• We may disclose your personal data to third parties in the following cases:

• if you request or agree to it;
• to persons who are legitimately entitled to do so or who act on your behalf on a valid legal basis;
• if the disclosure affects our legitimate interests in order to manage, develop, and expand our business;
• when we are required to disclose your personal data in order to comply with our legal obligation or when such disclosure is required by an official state or supranational authority.

The third parties to whom we may disclose your personal data in accordance with the above situations are restricted (by law or by contractual relationship) in how they may use such information, namely only for the purposes we have expressly specified. Prior to disclosure, we always ensure that the third parties with whom we share personal data have duly undertaken to comply with data protection rules. However, for the avoidance of doubt, this rule may not apply where the disclosure is not based on our voluntary decision, but is dictated, for example, by compliance with our legal obligation or an official request from a public or supranational authority.

5. WHAT ARE YOUR RIGHTS IN RELATION TO DATA PROTECTION

As a data subject when using XPERIENCE SCHOOL, you have certain rights established in the applicable regulations, which relate to the way we process your data. We respect your individual rights and will comply with them by responding to your inquiries and complaints in a timely manner.

• Right to withdraw your consent: If you have given your explicit consent to the processing of your data, you may withdraw it at any time.
• Right to correct or supplement: You can exercise your right to correct or supplement your personal data if it is inaccurate or incomplete.
• Right to restrict processing: You may request that we restrict the processing of your personal data. This right applies when:
  • You contest the accuracy of your personal data – for the period necessary to verify the case and determine whether the alleged inaccuracy exists;
  • you consider that the processing is unlawful and you wish to restrict the processing instead of having your personal data erased;
  • we no longer need your personal data, but you require it for the establishment, exercise, or defense of your legal rights; or
  • you object to the processing at a time when we are verifying whether our legitimate interests would prevail.
• Right of access and information: You may request that we provide you with information about what personal data we hold about you, including the categories of personal data under our control, the purposes for which it is used, the period for which it is processed, and to which third parties it is disclosed, if any. When you make a valid request to exercise this right, we will provide you with a copy of your personal data. If you request additional copies of your personal data, we may charge reasonable fees based on our administrative costs in fulfilling your request.
• Right to erasure (the so-called "right to be forgotten"): You have the right to request that we erase your personal data that we hold. We are obliged to comply with your request if we process your personal data, except in cases where we are not obliged to comply with your request for erasure. In such cases, we will endeavor to provide you with adequate information about the reason for not complying with your request.
• Right to object: When we process your personal data on the basis of our legitimate interest, you have the right to object to this processing if you believe that your rights outweigh our legitimate interest.
• Right to judicial or administrative protection if your rights have been violated.

If you believe that your right to personal data protection and privacy has been violated by us, you can file a complaint with the relevant supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged violation. Of course, you also have the right to judicial protection.

You have the right to object at any time to the processing of your personal data for direct marketing purposes, established in connection with our legitimate interests, or on any other grounds. If you have consented to the processing of your personal data for marketing purposes, you can simply withdraw your consent and we will stop processing your data for these purposes.

As a data subject, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

If you have any complaints regarding the processing of your personal data, we advise you to contact us first so that we can try to resolve the situation in a timely manner. If this approach does not produce the results you expect, you can contact the competent national data protection authority, namely:

Important information regarding the exercise of your rights:

• Response time: We will try to resolve the issue in your request within one month, which may be extended by up to two months if special reasons or the complexity of the case so require. In all cases of extension, we will inform you of the length of the extension and the reasons for it.
• Impossible identification: In some cases, we may not be able to locate your personal data based on the identifiers provided in your request. In this situation, where we cannot identify you as a data subject, we will not be able to comply with your request to exercise your legal rights described in this section unless you provide us with additional information to identify you as a data subject. We will duly inform you of the possibility to provide us with such additional information when necessary.
• Method of exercise: If you wish to exercise any of the above rights, please contact us in writing (including electronically) using the contact information provided below in this Policy.

Please send your questions and requests regarding the protection of your personal data using the contact section of our Website or directly by sending an email to the following address: office@xperience.school.

6. CHANGES TO THE POLICY

This Policy may be periodically updated and amended. In such cases, we will publish the changes by announcing the latest version of the Policy on the Website. In compliance with applicable law, all changes will take effect immediately after the amended Policy is published on the Website, but where we have already collected information about you and/or where required by law, we may take additional steps to inform you of any material changes to our Policy, such as asking you whether you agree to those changes. We may inform you of any changes to the Policy and request your consent to the changes by sending a message to your email address. For all other matters not expressly covered in this Policy, the relevant rules of applicable law will apply.

Contact us at support@xperience.school if you have any questions about these terms.