PRIVACY POLICY

Last updated: 24 September 2026

Who we are

The controller of your personal data is SCANDINAVIA MUSIC SCHOOL S.R.L., registered office at Aleea Mihail Sadoveanu nr. 21B, Iași, Iași County, Romania, Trade Register no. J2025050451008, tax identification code (CUI) 52130283 (“the school” or “we”). Lessons take place at Strada Vasile Lupu nr. 78A, Block N6, Newton Residence, Iași.

For any question about your data, write to contact@scandinaviaiasi.ro or call +40 757 987 209.

What data we process, why and on what legal basis

  • Contact and booking form: your name, e-mail address, phone number (optional), discipline and message. We use them to reply and arrange the first meeting. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
  • Students and parents: the contact details of the student or, for minors, of the parent or guardian, the chosen discipline, the lesson schedule and payment records. Legal basis: performance of the contract and our legal accounting and tax obligations (Art. 6(1)(b) and (c) GDPR).
  • Messages by phone, WhatsApp or e-mail: the content of the conversation, so that we can reply. Legal basis: pre-contractual steps and our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR).
  • The CICI virtual assistant: the messages you type in the chat window. CICI is an artificial intelligence program; its answers are generated automatically, are for information only and have no legal effect on you. For a confirmation, such as a booking, please contact the school. Please do not share sensitive data in the chat, such as health information. Legal basis: Art. 6(1)(b) and (f) GDPR.
  • Photos and recordings from school shows, recitals and concerts: we publish them on the website or social media only with the consent of the adult student or, for minors, of the parent or guardian. Consent can be withdrawn at any time. Legal basis: consent (Art. 6(1)(a) GDPR).
  • Technical data: your IP address, browser type and the pages you visit appear in the server logs, for the security and operation of the website. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

The website currently uses no analytics, advertising or tracking tools. If we introduce any, we will enable them only with your consent and update this policy.

Who we share data with

We do not sell or rent your data. Only the providers that help us operate can access it, strictly as needed, under contract and a duty of confidentiality:

  • OVHcloud, for hosting the website and the form (servers in Germany);
  • Hostinger, for e-mail;
  • Invent Evolution, which develops and maintains the website and the CICI virtual assistant; chat answers may be generated with artificial intelligence models from providers it has contracted;
  • the school’s accountant and public authorities, when the law requires it.

Some services have their own privacy rules and act as independent controllers: Google (the map on the contact page, shown only if you choose to display it, and YouTube videos, loaded only when you start playback) and WhatsApp (Meta), if you message us on WhatsApp. These companies may transfer data outside the European Economic Area, for example to the USA, under the EU–US Data Privacy Framework or standard contractual clauses.

How long we keep data

  • Form enquiries that do not lead to enrolment: no longer than 12 months after the last message.
  • Student and parent data: for the duration of the lessons and 3 years after the last lesson, for possible requests or complaints.
  • Accounting records: for the periods required by accounting law.
  • Server logs: 14 days.
  • Conversations with the CICI assistant: in your browser until you close the tab; on the server, no longer than 12 months.
  • Published photos and recordings: until consent is withdrawn.

Your rights

Under Regulation (EU) 2016/679 (GDPR), you have the right:

  • to find out what data we hold about you and receive a copy;
  • to have inaccurate data corrected;
  • to have your data erased;
  • to restrict processing;
  • to receive your data in a structured format and transfer it to another controller (portability);
  • to object to processing based on our legitimate interest;
  • to withdraw your consent at any time, without affecting processing carried out before the withdrawal.

To exercise any of them, write to contact@scandinaviaiasi.ro. We reply within one month of receiving your request.

You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, Bucharest, https://www.dataprotection.ro.

Children

For students under 16, the form, enrolment and consents are completed by a parent or guardian, who also provides the child’s details.

Security

The website uses an encrypted connection (HTTPS). Access to data is limited to the people who need it for their work.

Automated decisions

We do not make decisions based solely on automated processing, including profiling, that have legal effects on you.

Changes

We may update this policy when the way we process data changes. The current version and the date of the last update are always shown on this page.