Privacy policy

KSchool is operated by Sarah Kassoul and Rayane Kassoul (“we”, “us”, “the school”). We are the controllers of personal data processed for the website and for tutoring.

Notices and data requests: WhatsApp +357 94 311 133. Do not send payment-card numbers in chat if we have given you another method.

It covers this website, messages you send us to book (including WhatsApp), the free intro, paid lessons, and notes we keep so we can teach you. It does not cover Meta, Google, Zoom, or our host’s own products — those have their own policies once you leave our site or join a call.

This website does not create student accounts and does not take card payments. Most data reaches us when you write to us.

• Identity and contact: name, phone number, WhatsApp handle, email if you give one, timezone, city or country if you mention it.
• Lesson fit: level, goals, program interest (FLE, FLS, FLI, Support), exam dates, school year and subjects for school support, language you want the intro in.
• Minors: if a parent or guardian books for a student, we treat that adult as the client. We may hold the student’s first name, age or year group, and school-related details the parent sends.
• Booking and money: lesson times, pack type, whether a session was attended, payment references you send us. We do not process card data on this website.
• Teaching: brief notes after class so the next hour is not a reset. We do not sell lesson recordings. We do not record a call unless both sides have agreed in writing beforehand.
• Website: pages you visit, clicks on the site, and how you arrived (for example a search or social referrer) are stored in a first-party session cookie (`ks_sid`) so we can run the school. Our host also keeps ordinary server logs (IP address, browser, time). We store your cookie choice on your device (see Cookies).

We only use personal data for running KSchool — not for selling lists, not for ads.

• To answer WhatsApp, book the intro, match a tutor, and deliver lessons (contract, or steps before a contract).
• To take payment the way we agree with you and keep a simple record of lessons and packs (contract and legal accounting duties).
• To keep the site up, secure, and legally documented, including storing your cookie preference (legitimate interests, and consent where the law requires it for non-essential cookies).
• To understand how the website is used (pages, clicks, and traffic source) so we can improve the school. That first-party session trail is not an advertising product (legitimate interests).
• To defend claims, prevent abuse, and refuse a poor fit (for example a request we already say we do not take) (legitimate interests).
• Where a law requires us to keep something (legal obligation).

If we add a third-party audience or marketing tool, it will not run unless you switch analytics on in the banner. That is consent, and you can withdraw it. The first-party session trail is separate and is not gated by that switch.

We do not sell personal data. We share it only as needed to teach and to run the school:

• The tutor on your lesson (Sarah or Rayane) — so they can prepare and teach.
• Meta Platforms, if you contact us on WhatsApp. Your message is processed under WhatsApp’s terms. We cannot control Meta’s product.
• The video tool we use for the lesson (typically Google Meet or Zoom). The link and anything you say or show on that call is processed by that provider.
• Our website host (currently Vercel), the Postgres database we use for admin session records, and any email or storage we use to keep lesson notes and booking records.
• A bank or payment provider if we invoice you or you transfer money — only what that payment requires.
• Professional advisers or authorities if the law requires it or we must defend the school.

Some of those providers are outside the EEA (for example the United States). Where GDPR applies, we rely on their published safeguards (such as standard contractual clauses) plus the fact that the service cannot run without that tool. If that is not acceptable, do not book a video lesson or a WhatsApp intro.

• WhatsApp threads and booking notes: while we are teaching you, then up to 24 months after the last lesson unless you ask us to delete sooner and no law requires a longer hold.
• Payment and invoice records: as long as tax and accounting rules require (often several years).
• Server logs: a short period set by the host, typically weeks, unless we must keep a security incident.
• First-party website sessions (pages, clicks, source): while they are useful for running the school, typically up to 24 months, unless you ask us to delete sooner.
• Cookie preference: on your device until you clear it or we change the consent version and ask again.

If you are in the EEA, UK, or another place with similar rules, you can ask us to access, correct, or delete your data, restrict or object to certain processing, and receive a copy of data you gave us (portability), where those rights apply. You can withdraw cookie consent without affecting lessons already given.

If you are in Australia, you can ask us about the personal information we hold, and we will handle requests in line with the Australian Privacy Principles as they apply to us.

Write on WhatsApp +357 94 311 133. We may need to confirm who you are. You can complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or, if you are in Australia, the OAIC (oaic.gov.au). We would rather fix it with you first.

KSchool is not a playground and not a substitute for a child’s school. A parent or guardian must send the booking message and is the client. We do not knowingly take WhatsApp bookings from a child acting alone. If you believe we have data about a child without a parent’s request, tell us and we will delete it unless we must keep it.

A cookie is a small file a site stores on your device. We also use your browser’s local storage for the same kind of job: remembering a choice.

• Strictly necessary: we store your cookie choice (local storage key on this domain) so we do not ask every time. The site needs this to respect that choice. It is not an advertising cookie.
• First-party session: we set a `ks_sid` cookie so we can tell visits apart, see which pages were opened, what was clicked, and how someone arrived. This is how the admin trail works. It is not sold, and it is not a third-party analytics product. Localhost and a signed-in administrator do not write to these stats.
• Third-party analytics: off unless you accept. The banner’s analytics switch is for a future audience tool (for example a marketing pixel). It does not turn the first-party session trail off.
• Advertising cookies: we do not set them.

WhatsApp, Google Meet, and Zoom will set their own cookies when you use those products. That is outside this banner. You can change your KSchool choice any time via Cookie settings in the footer. Blocking all storage in your browser may reset that choice.

We use HTTPS on this site and keep lesson notes on a need-to-know basis between the two of us. WhatsApp and video tools are third-party products. Do not send copies of passports or card PAN in chat unless we have asked for a specific document and named a safer channel.

We will update this page when our processing changes. The date at the top will move. Material changes to cookies will prompt the banner again. Last updated 10 September 2026.