Privacy Policy
Last updated · 12 February 2026
This Privacy Policy explains how Shuren International Education OÜ (“Shuren”, “the School”, “we”, “our” or “us”), the legal entity that operates shureninternationalschool.com, collects, uses, stores and shares personal information about visitors, customers and students. It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the Estonian Personal Data Protection Act.
1. Who we are (Data Controller)
The data controller responsible for your personal information is:
- Shuren International Education OÜ
- Sepapaja tn 6, Tallinn 15551, Estonia
- Registration no. 16842073
- Email: privacy@shureninternationalschool.com
- Telephone: +372 6 999 712
2. The personal information we collect
We only collect information that we genuinely need to provide our services. Depending on how you interact with us, this includes:
2.1 Information you give us
- Account & enrolment data: parent or guardian name, email, telephone number, billing and shipping address.
- Student data: student’s first name, age, school year, language level, and any learning notes the family chooses to share.
- Order data: the items purchased, order total, currency, invoicing details and (for businesses) a VAT number.
- Communications: the contents of emails, contact-form messages and notes taken during phone calls with the office.
2.2 Information collected automatically
- Technical data: IP address, browser type, operating system, language preference, the pages you visit on our site and the date and time of each visit.
- Local storage: we use your browser’s local storage to keep your shopping cart between visits. We do not use third-party advertising cookies.
- Session recordings (course platform only): live online sessions are recorded and made available to the cohort for 30 days. Students and tutors are visible in the recording.
3. Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Operating your account and processing orders | Performance of a contract |
| Sending course materials and shipping physical items | Performance of a contract |
| Sending the termly newsletter | Consent (opt-in at checkout) |
| Issuing invoices and meeting tax obligations | Legal obligation |
| Responding to support enquiries | Legitimate interest in providing a responsive service |
| Improving the website | Legitimate interest (aggregated, anonymised analytics) |
| Safeguarding live online sessions | Legitimate interest in student welfare; explicit consent at enrolment |
4. How long we keep your data
- Account and order data: kept for seven years after your last order to meet Estonian accounting law.
- Session recordings: deleted automatically thirty days after the recording date.
- Support emails: kept for three years.
- Newsletter subscribers: kept until you unsubscribe.
5. Who we share your data with
We do not sell personal information. We share it only with the service providers needed to run the school:
- A payment processor (PCI-DSS certified) that handles card transactions on our behalf.
- A shipping carrier of your destination region, to deliver physical orders.
- Our accounting firm, registered in Tallinn, for bookkeeping and tax filing.
- A hosting provider with servers located in the European Union.
- An EU-based email service provider for the termly newsletter.
All processors operate under written data-processing agreements and are bound by confidentiality.
6. International transfers
Personal data is processed within the European Economic Area wherever possible. Where a processor (for example, a payment provider) operates servers outside the EEA, transfers are protected by Standard Contractual Clauses adopted by the European Commission.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Ask us to correct inaccurate data.
- Ask us to delete data we no longer have a legal reason to keep.
- Object to processing based on our legitimate interests.
- Receive your data in a portable format and transmit it to another controller.
- Withdraw consent at any time where we rely on consent.
- Complain to your national data-protection authority, or to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
To exercise any of these rights, email privacy@shureninternationalschool.com. We reply within thirty days.
8. Children’s data
Our service is intended for use by parents and guardians on behalf of students aged 8 to 16. Accounts are always created by an adult. Where a student is the subject of personal data, the legal basis is consent given by the parent or guardian during enrolment.
9. Security
We protect personal information with technical and organisational measures including TLS encryption in transit, encrypted backups, role-based access control inside the school, and a written security incident-response procedure. In the event of a personal data breach that is likely to result in risk to your rights, we notify both the Estonian Data Protection Inspectorate and affected individuals within 72 hours.
10. Changes to this Policy
Material changes will be announced by email to existing customers at least 14 days before they take effect. The current version is always published on this page with the date of the last update at the top.
11. Contact
Privacy questions, requests and complaints: privacy@shureninternationalschool.com. Postal address as listed in section 1.