Hangugeo
Back to home

# PRIVACY POLICY — HANGUGEO

English version — translation for information purposes The French version (Politique-Confidentialite-Hangugeo-FR) is the binding version. In case of discrepancy, the French version prevails. Last updated: [DD/MM/YYYY]

1. Introduction

This Privacy Policy describes how [FIRST NAME LAST NAME], individual entrepreneur under the French micro-entrepreneur regime (hereinafter “we” or the “Publisher”), collects, uses and protects the personal data of users (hereinafter “you” or the “User”) of the Hangugeo application and the hangugeo.com website (together the “Application”).

We are committed to complying with applicable law, in particular: - Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”); - French Law No. 78-17 of 6 January 1978, as amended (“Data Protection Act”).

Specific provisions apply to residents of California, Brazil and Thailand: see the Annex – Jurisdiction-Specific Provisions at the end of this document.

2. Data Controller

The controller of your personal data is:

  • Identity: [FIRST NAME LAST NAME], individual entrepreneur (micro-entrepreneur)
  • Address: 9 rue Édouard Tremblay, 94400 Vitry-sur-Seine, France
  • SIRET: [TO BE COMPLETED upon URSSAF registration]
  • Email: contact@hangugeo.fr (subject line: “privacy” for GDPR-related requests)

ℹ️ At this stage, designating a Data Protection Officer (DPO) is not mandatory for Hangugeo under Article 37 GDPR, as the core activity does not involve regular and systematic large-scale monitoring or large-scale processing of special categories of data. This assessment will be reviewed as the business grows.

3. Personal Data Collected

3.1 Data provided directly by the User

Upon account creation: - Email address; - Password (stored as a hash, never in plain text); - First name or username; - Mother tongue and self-reported Korean level; - Preferred interface language (French or English); - Age range.

For users under 15: - Email address of the holder of parental authority, to obtain consent via double opt-in.

Via the contact form: - Name or first name; - Email address; - Message content.

3.2 Data collected automatically

  • Progress data: lessons completed, scores, learning statistics, session duration, learning sequence;
  • Technical data: device type, operating system, system language, browser type and version;
  • IP address and connection data (date, time, duration);
  • Cookies and trackers (see Article 11).

3.3 Subscription-related data

  • Subscription status (Free / Premium / Premium+);
  • Plan type (monthly / annual / lifetime);
  • Transaction history (date, amount, period).

⚠️ We do not collect or store any payment card data. Payments are processed directly by Stripe Payments Europe Ltd (see Article 7).

4. Purposes and Legal Bases

Purpose

Legal basis (Art. 6 GDPR)

Creation and management of the user account

Contract performance (art. 6.1.b)

Provision of the learning service and progress tracking

Contract performance (art. 6.1.b)

Premium / Premium+ subscription management and billing

Contract performance (art. 6.1.b)

Responses to contact form messages

Legitimate interest (art. 6.1.f) — replying to you

Service-related communications (notifications, Terms changes)

Contract performance (art. 6.1.b)

Marketing communications and newsletters

Consent (art. 6.1.a), freely revocable

Improvement of the Application and anonymized usage statistics

Legitimate interest (art. 6.1.f)

Compliance with legal and accounting obligations

Legal obligation (art. 6.1.c)

Fraud prevention and Application security

Legitimate interest (art. 6.1.f)

5. Minor Users

Special care is given to minors:

  • Users aged 15 and over: may consent autonomously (art. 8 GDPR, art. 45 French Data Protection Act);
  • Users aged under 15 (and at least 13): processing is lawful only if consent is given or authorized by the holder(s) of parental authority. We request the email address of the parent, who receives a validation request before account activation;
  • Users under 13: registration is refused.

The holder of parental authority may at any time exercise the minor’s rights (Article 10) and request the deletion of the child’s account by writing to contact@hangugeo.fr.

6. Recipients of Data

Your data is accessible, within the scope of their respective missions, to: - Staff of the Publisher (technical, support, marketing); - Technical sub-processors acting on documented instructions of the Publisher (see Article 7); - Administrative or judicial authorities when required by law.

We do not sell or rent your personal data to third parties.

7. Sub-Processors and Service Providers

Under Article 28 GDPR, each sub-processor is bound by a Data Processing Agreement (DPA):

Provider

Purpose

Data location

Safeguards

Amazon Web Services EMEA SARL

Application and data hosting

AWS Paris region (France)

AWS DPA + Standard Contractual Clauses (SCCs)

Stripe Payments Europe Ltd

Subscription payment processing

Ireland (HQ), with potential transfers to the United States

Stripe DPA + SCCs, EU-US Data Privacy Framework certification

[Email provider — to complete]

Transactional and marketing emails

[Country — prefer EU]

DPA + SCCs if non-EU transfer

[Analytics — not yet chosen]

Anonymized usage statistics

[To complete]

[To complete]

[Support tool / contact form]

User support, contact form

[To complete]

[To complete]

💡 Recommendation: prefer EU-based providers (Brevo, Crisp, Scaleway, Plausible, Matomo Cloud) to minimize non-EU transfers and simplify compliance.

8. International Data Transfers

Most data is hosted in France (AWS Paris region). However, some sub-processors may transfer data outside the European Economic Area (EEA), particularly to the United States:

  • Stripe: US company certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023); transfers secured by additional Standard Contractual Clauses.
  • Other non-EU providers: transfers framed by Standard Contractual Clauses adopted by the European Commission on 4 June 2021, supplemented by additional technical and organizational measures (Transfer Impact Assessment) where appropriate.

You may request a copy of applicable safeguards by writing to contact@hangugeo.fr (subject: “privacy – transfers”).

9. Retention Periods

Data type

Retention

User account data

For the duration of use, then deleted within 24 months of last login or deletion request

Progress and learning data

Same as account data

Subscription data and invoices

10 years from the end of the fiscal year (French Commercial Code art. L.123-22)

Connection logs and technical logs

12 months (CNIL recommendation, in line with the French LCEN law)

Contact form requests

3 years from last contact

Marketing prospecting data (newsletter)

3 years from last active contact, or until consent withdrawal

Cookies stored on the device

13 months maximum

After these periods, data is irreversibly deleted or anonymized.

10. Your Rights

Under Articles 15 to 22 GDPR, you have the following rights:

  • Right of access (art. 15);
  • Right to rectification (art. 16);
  • Right to erasure / right to be forgotten (art. 17);
  • Right to restriction of processing (art. 18);
  • Right to object (art. 21);
  • Right to data portability (art. 20);
  • Right to withdraw consent at any time when processing is based on consent (art. 7.3);
  • Right to set instructions regarding your data after death (art. 85 French Data Protection Act).

How to exercise your rights

Send your request to contact@hangugeo.fr (subject: “privacy”) or by postal mail to the Publisher’s address.

We may request proof of identity in case of reasonable doubt. We undertake to respond within one month of receipt of your request (extendable by two months in case of particular complexity).

Complaint to a supervisory authority

If, after contacting us, you believe your rights are not respected, you may lodge a complaint with the French Data Protection Authority (CNIL): - 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 - www.cnil.fr

EU residents may also complain to the authority of their country of residence.

11. Cookies and Trackers

11.1 Strictly necessary cookies (no consent required)

  • Authentication and session cookies;
  • Security cookies (anti-CSRF, anti-fraud);
  • Language preference cookies.

These are indispensable for the operation of the Application and exempt from consent (art. 82 French Data Protection Act, CNIL guidelines).

11.2 Audience measurement cookies

Depending on the tool chosen, these may be: - Exempt from consent if they meet CNIL criteria (privacy-friendly analytics, IP anonymization, no cross-referencing, limited retention) — e.g. Matomo configured for exemption, Plausible, Fathom; - Subject to consent otherwise (standard Google Analytics 4, Firebase Analytics, Mixpanel).

11.3 Marketing and advertising cookies

Any advertising or retargeting cookie requires your prior, free, specific, informed and unambiguous consent, collected via our cookie banner. You may withdraw consent at any time via the cookie management module accessible at the bottom of each page.

11.4 Cookie duration

Cookies have a maximum lifetime of 13 months. Data collected via these cookies is kept for a maximum of 25 months.

12. Data Security

We implement appropriate technical and organizational measures (art. 32 GDPR): - Password hashing (one-way hash, bcrypt or argon2); - Encryption in transit (HTTPS / TLS 1.2 minimum); - Database encryption at rest (AWS RDS encryption); - Access control and least privilege; - Regular automated backups; - Logging of sensitive data access; - Regular security testing and updates.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you individually as soon as possible under Article 34 GDPR, and notify the CNIL within 72 hours (Art. 33 GDPR).

13. Modifications to this Policy

This Policy may be modified at any time to reflect legal, regulatory or technical developments. Any substantial modification will be notified to you by email or in-app at least 30 days before it takes effect.

14. Contact

  • Email: contact@hangugeo.fr (subject: “privacy”)
  • Postal: 9 rue Édouard Tremblay, 94400 Vitry-sur-Seine, France

ANNEX — JURISDICTION-SPECIFIC PROVISIONS

This annex sets out additional rights and information applicable to residents of certain jurisdictions, in addition to (and not in place of) the provisions above. In case of conflict, the annex section applicable to your jurisdiction prevails over the general provisions.

A1. Residents of the EEA, UK and Switzerland

The main provisions of this Policy implement the GDPR (EU), UK GDPR and the Swiss FADP (in force since 1 September 2023).

Competent supervisory authorities: - France: CNIL — www.cnil.fr - United Kingdom: ICO — www.ico.org.uk - Switzerland: FDPIC — www.edoeb.admin.ch

UK and Swiss residents enjoy the same rights as EU residents (access, rectification, erasure, objection, portability, etc.).

A2. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act and the California Privacy Rights Act, California residents have the following rights:

Categories of data collected (last 12 months)

CCPA category

Data

Collected?

A. Identifiers

Email, first name, IP address

✅

B. Customer records (Cal. Civ. Code §1798.80)

Email, payment data (via Stripe)

✅

C. Protected characteristics

Age range

✅ (limited)

D. Commercial information

Subscription history

✅

F. Internet or network activity

Connection logs, cookies

✅

K. Inferences

Estimated Korean level, progress

✅

Sensitive personal information (CPRA)

Password (hashed)

✅

Your rights

  • Right to Know the categories and specific pieces of personal information collected about you;
  • Right to Delete your personal information;
  • Right to Correct inaccurate information;
  • Right to Opt-Out of Sale/Sharing: we do not sell or share your personal information within the meaning of CCPA/CPRA;
  • Right to Limit Use of Sensitive Personal Information;
  • Right to Non-Discrimination: no discrimination for exercising your rights.

How to exercise your rights

Send your request to contact@hangugeo.fr (subject: “CCPA Request”). We will verify your identity before processing and respond within 45 days (extendable by 45 days).

You may designate an authorized agent to exercise your rights; written proof of authorization will be required.

“Do Not Sell or Share” notice

Hangugeo does not sell or share personal information of its users within the meaning of CCPA/CPRA. No “Do Not Sell or Share My Personal Information” link is therefore required on our site, but you may at any time confirm this position by writing to contact@hangugeo.fr.

A3. Brazil Residents (LGPD)

Under the Lei Geral de Proteção de Dados (Law No. 13.709/2018), Brazilian residents have the following rights (art. 18 LGPD):

  • Confirmation of processing;
  • Access to data;
  • Correction of incomplete, inaccurate or outdated data;
  • Anonymization, blocking or deletion;
  • Portability;
  • Deletion of data processed with your consent;
  • Information about entities with which your data has been shared;
  • Information about the possibility of denying consent and its consequences;
  • Withdrawal of consent.

Applicable LGPD legal bases: contract performance (art. 7.V), compliance with legal obligations (art. 7.II), legitimate interest (art. 7.IX), consent (art. 7.I).

Encarregado de Dados (LGPD DPO): contact contact@hangugeo.fr (subject: “LGPD”).

Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD) — www.gov.br/anpd

A4. Thailand Residents (PDPA)

Under the Personal Data Protection Act B.E. 2562 (2019), fully in force since 1 June 2022, Thailand residents have the following rights:

  • Right to be informed about processing;
  • Right of access and to obtain a copy;
  • Right to data portability;
  • Right to object;
  • Right to erasure, destruction or anonymization;
  • Right to restrict processing;
  • Right to rectification;
  • Right to lodge a complaint with the competent authority.

Cross-border data transfers: framed by the protection mechanisms set out in Articles 28-29 PDPA. We rely on appropriate safeguards in the absence of an adequacy decision between Thailand and the EU.

To exercise your rights: contact@hangugeo.fr (subject: “PDPA”).

Supervisory authority: Personal Data Protection Committee (PDPC) — www.pdpc.or.th

ภาษาไทย: เราเคารพสิทธิของผู้ใช้ตามพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562 หากท่านมีข้อสงสัย กรุณาติดต่อ contact@hangugeo.fr

A5. Other jurisdictions

Residents of other jurisdictions with data protection laws (South Korea under PIPA, Japan under APPI, Canada under PIPEDA, Australia under the Privacy Act, etc.) benefit from the rights provided by their local law. We will examine and respond to requests made on this basis, to the extent they are applicable to the Publisher. Send any request to contact@hangugeo.fr.