Legal
Privacy Policy
Last updated: 11 November 2026
This policy explains what personal data we collect when you use NailPro Academy, why we collect it, who we share it with and what rights you have. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the data protection law of the Republic of Cyprus.
1. Who is responsible for your data
The data controller is:
MILANANAILS (trading as NailPro Academy)Company registration number: [HE 000000] (Registrar of Companies, Republic of Cyprus)
Registered office: MYSTRA 41, ALEXANDROS GAVRIEL COURT, LARNACA 6042, CYPRUS
VAT number: [CY00000000X]
Email: [email protected]
For any question about your personal data, or to use your rights, write to [email protected].
2. The data we collect
| Data | When | Details |
|---|---|---|
| Account details | When you register | Your name, email address and password. The password is stored only as a one-way hash, so we cannot read it. |
| Sign-in with Google | If you choose "Continue with Google" | Google sends us your name, your email address, whether Google has verified it, and an identifier for your Google account. We never receive your Google password. |
| Purchases | When you buy a course | What you bought, the amount, the date, the payment reference and the status of the payment (including refunds). We also record that you accepted our terms at checkout. Your card details go directly to Stripe and never reach our servers. |
| Learning activity | While you study | Which lessons you have watched, how far, which you have completed, and any certificates issued to you. |
| Files you upload | If a course asks for them | A signed course agreement, and photos or videos of your practical work, with any notes you add. |
| Messages | When you contact us | Your email address and whatever you write to us. |
| Technical data | Whenever you use the site | IP address, date and time, the page or function requested, and basic browser information, kept in server logs. Sign-in cookies (see our Cookie Policy). |
We do not ask for, and ask you not to send us, special categories of data such as health information. We do not buy personal data from third parties.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, giving you access to the courses you bought, tracking your progress, issuing certificates, assessing uploaded work, sending service emails (email verification, password reset, order confirmation) | Performance of our contract with you (Art. 6(1)(b)) |
| Taking payments and handling refunds | Performance of our contract with you (Art. 6(1)(b)) |
| Keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Keeping the service secure: preventing fraud, password guessing and abuse, limiting automated requests, keeping server logs | Our legitimate interest in a secure service (Art. 6(1)(f)) |
| Protecting our courses against unauthorised copying: showing your account email as a watermark on videos you watch, and keeping records of access | Our legitimate interest in protecting our copyright (Art. 6(1)(f)) |
| Answering your questions and handling complaints or legal claims | Our legitimate interest in supporting customers and defending our rights (Art. 6(1)(f)) |
| Publishing your work or a testimonial, if we ever ask and you agree | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
We need your account and payment data to provide the courses. Without it we cannot create your account or sell you a course. We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell your data.
We do not send marketing emails unless you have separately agreed to receive them, and every such email would include an unsubscribe link.
4. Who we share it with
We share personal data only with the service providers we need to run NailPro Academy, and only as far as each one needs it:
| Recipient | What for | What they receive |
|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | Processing payments, saved cards, fraud prevention | Your name, email, payment details and the purchase. Stripe is an independent controller for payment processing; see stripe.com/privacy. |
| Our video hosting provider (Vimeo or Cloudflare Stream) | Streaming lesson videos to your browser | Technical data that any video player receives: your IP address and device and browser information. We do not send them your name or email. |
| Google Ireland Limited | Only if you sign in with Google | Google learns that you signed in to our site. |
| Our CAPTCHA provider, where the "I am not a robot" check is shown | Telling people from automated attacks on the sign-in forms | Your IP address and browser signals. |
| Our hosting, database and email delivery providers | Running the website and sending service emails | They store or transmit the data described in this policy on our behalf, under a data processing agreement. |
| Professional advisers and public authorities | Accounting, legal advice, and where the law requires disclosure | Only what is necessary in the specific case. |
Anyone who has the number of one of your certificates can verify it on this website and will see your name, the course and the date of issue. Certificate numbers are long random codes that you choose whom to give to.
5. Transfers outside the European Economic Area
Some of our providers are based in, or use infrastructure in, countries outside the EEA, in particular the United States. Where that happens the transfer is protected by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified companies) or by the European Commission's standard contractual clauses. You can ask us for more information about these safeguards.
6. How long we keep it
- Account, learning activity and certificates: for as long as your account is open. If you ask us to close your account, we delete or anonymise this data within 30 days, except for what we must keep as described below.
- Purchase and accounting records: for 6 years after the end of the tax year concerned, as tax law requires.
- Signed course agreements: for the life of the agreement and 6 years afterwards, the period in which legal claims can be brought.
- Uploaded practical work: for as long as your account is open, or until you replace it or ask us to delete it.
- Server logs: for a short period, after which they are overwritten automatically.
- Emails you send us: for up to 2 years after the conversation ends, unless a longer period is needed for a legal claim.
7. How we protect it
We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS) throughout, hashed passwords, sign-in cookies that scripts cannot read, protection against password guessing, access to personal data limited to the people who need it, private storage for uploaded documents, and regular backups. No system can be guaranteed completely secure. If a breach occurs that is likely to put your rights at risk, we will inform you and the supervisory authority as the law requires.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected (you can change your name yourself in your profile);
- have your data erased, where we have no legal reason to keep it;
- restrict our processing of your data in certain cases;
- receive the data you gave us in a portable format;
- object to processing that is based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent.
To use any of these rights, write to [email protected]. We may need to check your identity first. We reply within one month.
You also have the right to complain to a supervisory authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy). You may instead complain to the authority of the EU country where you live or work.
9. Children
NailPro Academy is intended for adults. We do not knowingly collect data from children under 14. If you believe a child has given us personal data, contact us and we will delete it.
10. Cookies
We use only the cookies needed to sign you in and to take payments. Details are in our Cookie Policy.
11. Changes to this policy
We will update this policy when our processing changes, and we will change the date at the top. If a change is significant we will tell you by email or by a notice on the website.
Controller: MILANANAILS.