Privacy Policy

Last updated: September 28, 2026

This Privacy Policy describes how Individual Entrepreneur Viktor Fesenko (hereinafter — the "Provider", "we") collects, uses, stores, and protects personal data when you use the Ritorika website (hereinafter — the "Website") and receive individual online speech development sessions.

We do not sell users' personal data. Personal data is processed only to the extent necessary for the operation of the Website, registration and account servicing, organizing and conducting sessions, processing payments, communicating with Customers, ensuring security, fulfilling legal obligations, and other purposes described in this Policy.

1. Basic Principles

When processing personal data, we adhere to the following principles:

• Lawfulness and transparency. Personal data is processed for specific and lawful purposes described in this Policy.
• Purpose limitation. Data is used only for purposes compatible with providing the Services and operating the Website.
• Data minimization. We collect only the data that is reasonably necessary for the relevant purpose.
• Storage limitation. Data is stored for the period necessary for the relevant purposes or as required by law.
• Security. We apply reasonable technical and organizational measures to protect personal data from unauthorized access, loss, misuse, or disclosure.

2. What Personal Data We Collect

Depending on how you use the Website and the Services, we may process the following data:

Account Data

During registration and use of an account, we may collect:

• email address;
• name;
• other data the Customer voluntarily adds to their account.

The email address is used, in particular, for authentication, sending service notifications, and communication regarding the Services.

Customer Data

To order and provide the Services, we may process:

• first and last name;
• email address;
• contact details;
• information about ordered or purchased Services;
• information about payments and refunds;
• information about speech skills, learning goals, and needs, necessary for preparing and conducting sessions;

Data of the Recipient of the Services

If the Services are ordered for another person, we may process information necessary for preparing and conducting sessions, including:

• name;
• age or date of birth, if necessary;
• information about speech skills, learning goals, and needs, necessary for preparing and conducting sessions;
• information related to conducting sessions and learning progress.

We do not seek to collect more information than is necessary to provide the Services. Since the Services are educational rather than medical in nature, we do not purposefully request or process health information or other special categories of personal data. If the Customer voluntarily discloses such information in the course of communication about sessions, it is used only to the extent necessary to take into account the needs of the Recipient of the Services.

Session Information

We may process information about:

• scheduled and completed sessions;
• session rescheduling or cancellations;
• use of session packages;
• learning materials and other information necessary to organize the learning process.

Payment Information

Payments are made through WayForPay or another payment service available on the Website.

We do not store full payment card details on our own servers. The payment service independently processes payment data in accordance with its own rules, privacy policy, and legal requirements.

We may receive and store information about the fact of payment, the payment amount, currency, transaction date, payment status, and information necessary for accounting for the Services and refunds.

Video Communication Service Information

The Zoom service is used to conduct sessions. The Customer independently specifies the participant's name when connecting to a session; this name becomes visible to the Provider during the session. Processing of this data within the service itself is carried out in accordance with Zoom's privacy policy.

Technical and Security Information

While using the Website, technical information necessary for its proper operation and security may be automatically processed, including:

• IP address;
• browser and device information;
• date and time of requests;
• technical information related to requests to the Website.

The IP address and other technical information may be used, in particular, to detect and prevent spam, automated or malicious requests, unauthorized access, and other misuse of the Website.

This information is not used to build advertising profiles or for statistical tracking of user behavior.

3. How We Use Personal Data

Personal data may be used to:

• create and service an account;
• authenticate the user;
• organize and conduct introductory and paid sessions;
• prepare sessions according to the individual needs of the Recipient of the Services;
• keep records of packages and completed sessions;
• process payments and refunds;
• communicate with the Customer regarding the Services;
• send service notifications;
• review inquiries and requests;
• ensure the security of the Website and the Services;
• prevent fraud, misuse, and unauthorized access;
• comply with legal requirements;
• protect the rights and legitimate interests of the Provider and the Customer.

4. Legal Bases for Processing

Personal data is processed on grounds provided for by the law of Ukraine, in particular when its processing:

• is necessary for the conclusion or performance of a contract;
• is carried out on the basis of the consent of the data subject in cases where such consent is required;
• is necessary for the Provider to comply with legal obligations;
• is necessary to protect the legitimate interests of the Provider or other persons, provided such interests do not override the rights and freedoms of the data subject.

5. Personal Data of Minors

The Services may be provided to minors.

If the Customer provides the Provider with the personal data of a minor, the Customer confirms that they have the relevant legal grounds and authority to provide such data and to order the Services for such a person.

The Provider processes the personal data of a minor only to the extent necessary to provide the Services, organize sessions, communicate, and fulfill other legal obligations.

6. Disclosure of Personal Data to Third Parties

We do not sell personal data.

We may transfer or provide access to personal data to third parties only to the extent necessary for the operation of the Website, provision of the Services, processing of payments, sending notifications, ensuring security, or complying with legal requirements.

Email and Communications

A third-party email service, including Resend, may be used to send emails and service notifications.

Such a service may process the email address and technical data necessary for message delivery.

Payment Services

WayForPay or another payment service available on the Website is used to accept payments and process refunds.

The payment service processes payment data in accordance with its own privacy policy and applicable legal requirements.

Hosting and Infrastructure

The Website and related data are hosted on Fly.io infrastructure or another hosting platform available on the Website.

Such providers may process data only to the extent necessary for the operation of the relevant infrastructure.

Video Communication

Sessions are conducted using Zoom or another video communication service available to the Customer. The participant's name when connecting is specified by the Customer themselves; the Provider does not set or change this name. Sessions are not recorded or transcribed by the Provider unless otherwise agreed with the Customer and the Recipient of the Services in accordance with the Terms of Service.

Legal Requirements

We may disclose personal data if necessary to comply with legal requirements, a court decision, a lawful request from a government authority, or to protect the rights and legitimate interests of the Provider.

7. Third-Party Services

Third-party services may be used to operate the Website and provide the Services, including:

• WayForPay — for payment processing (or another payment service available on the Website);
• Resend — for sending emails (or another email service);
• Fly.io — for hosting and operating the Website infrastructure (or another hosting platform);
• Zoom — for conducting online sessions (or another video communication service).

Third-party providers may process personal data in accordance with their own terms of use, privacy policies, and data protection procedures.

The list of third-party services may change depending on the technical configuration of the Website.

8. Cookies

The Website uses necessary cookies, including a session cookie required for user authorization and maintaining their account.

In particular, cookies may be used to:

• maintain the user's session;
• support authorization and account functionality;
• ensure the security of the Website;
• ensure the proper operation of certain Website features.

The Website does not use cookies for advertising tracking or statistical analysis of user behavior.

9. Data Retention Periods

We retain personal data for the period necessary for:

• providing the Services;
• servicing the account;
• fulfilling contractual and legal obligations;
• accounting and tax record-keeping;
• handling disputes and inquiries;
• ensuring security;
• complying with legal requirements.

Once personal data is no longer needed for the relevant purposes, it is deleted or anonymized, unless its further storage is required or permitted by law.

10. Account Deletion

The Customer may contact the Provider with a request to delete their account and personal data.

To do so, a request must be sent to the email address specified in the "Contact Information" section.

Upon receipt of the request, personal data is deleted to the extent that its further storage is not required or permitted by law.

Certain data may be retained for the period necessary to fulfill legal obligations, maintain accounting and tax records, prevent fraud, ensure security, or resolve disputes.

Data deletion may be irreversible.

11. Security of Personal Data

We apply reasonable technical and organizational measures to protect personal data, including:

• use of a secure HTTPS connection;
• restricting access to systems;
• controlling access to data;
• measures to prevent unauthorized access;
• technical measures to ensure account security.

At the same time, no method of transmitting or storing information can guarantee absolute security.

12. Rights of Data Subjects

Depending on the circumstances and the requirements of Ukrainian law, a data subject may have the right to:

• know the location of their personal data and the purpose of its processing;
• obtain information about the conditions of access to personal data;
• request correction of inaccurate personal data;
• request deletion of personal data in cases provided for by law;
• object to the processing of personal data in cases provided for by law;
• withdraw consent to the processing of personal data, if the processing is based on consent;
• submit requests regarding the processing of their personal data;
• exercise other rights provided for by the law of Ukraine.

To exercise your rights, you may contact the Provider using the contact details specified below.

13. Processing of Personal Data Under the GDPR

In cases where the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) applies to the processing of personal data, the Provider processes personal data in accordance with the requirements of the GDPR to the extent it applies.

The legal basis for processing personal data may be, depending on the specific situation:

• the necessity of processing for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract;
• compliance with a legal obligation to which the Provider is subject;
• the consent of the data subject, if the processing is based on consent;
• the necessity of processing for the purposes of the legitimate interests pursued by the Provider or a third party, provided such interests do not override the rights and freedoms of the data subject.

In cases provided for by the GDPR, the data subject may have the right to:

• obtain confirmation as to whether their personal data is being processed, and to access it;
• request the correction of inaccurate or incomplete personal data;
• request the erasure of personal data in cases provided for by the GDPR;
• request restriction of the processing of personal data in cases provided for by the GDPR;
• object to the processing of personal data in cases provided for by the GDPR;
• receive their personal data in a structured, commonly used, and machine-readable format and, in cases provided for by the GDPR, request its transfer to another controller;
• withdraw consent to the processing of personal data at any time, if the processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal;
• lodge a complaint with a competent data protection authority in a European Union member state, including in the place of their residence, work, or the place of the alleged infringement of the GDPR.

The exercise of the above rights may be limited in cases and to the extent provided for by the GDPR or other applicable law.

To exercise their rights or obtain information regarding the processing of personal data, the data subject may contact the Provider using the contact details specified in the "Contact Information" section.

If, in order to provide the Services, personal data is transferred to or made accessible to service providers located outside the European Economic Area, such transfer is carried out in accordance with the requirements of the GDPR and using the mechanisms provided for by the GDPR to ensure an adequate level of protection of personal data, where such mechanisms are necessary.

If the personal data of a minor is processed on the basis of consent in cases where the GDPR requires the consent of a legal representative, such consent is obtained from the person who has the relevant parental rights or other legal authority.

14. International Data Transfers

In connection with the use of third-party services, personal data may be processed or stored outside Ukraine.

Where necessary in accordance with the law, the Provider takes the measures provided for by law to ensure adequate protection of personal data during its transfer or processing outside Ukraine.

15. Changes to This Privacy Policy

We may periodically update this Privacy Policy.

Changes are communicated by updating the "Last updated" date at the beginning of the document and, if necessary, in another available manner.

The new version of the Policy takes effect from the moment it is posted on the Website, unless otherwise specified in the version itself.

16. Contact Information

If you have any questions about this Privacy Policy, the processing of personal data, or wish to exercise your rights regarding personal data, you may contact the Provider:

Provider: Individual Entrepreneur Viktor Fesenko
Taxpayer ID: 3146313438
Country: Ukraine
Email: support@ritorika.net
Website: ritorika.net

This Privacy Policy is an integral part of the Public Offer and Terms of Service of Ritorika.