Effective date: 2026-07-20
1. About this Privacy Policy
This Privacy Policy explains how RedSoftPlus OÜ collects, uses, stores, shares, and protects personal data when individuals access or use lingnity.com (the “Platform”).
The Platform provides online language-learning products, including individual Lessons, Courses, Packs, Extras, and supporting educational Content.
This Privacy Policy applies when a person:
• visits the Platform;
• creates or uses an Account;
• makes a Purchase;
• accesses a Learning Product or other Content;
• contacts the Company;
• submits a withdrawal notice, refund request, complaint, or support request; or
• otherwise uses the Platform.
Capitalised terms used but not defined in this Privacy Policy have the meanings given to them in the Terms of Use.
The Platform is operated by and the relevant personal data controller is:
Company: RedSoftPlus OÜ
Registry code: 16188810
Registered office: Harju maakond, Tallinn, Kesklinna linnaosa, Vesivärava tn 50-301, 10152, Estonia
Website: lingnity.com
Email: hello@lingnity.com
The Company processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”), the Estonian Personal Data Protection Act, and other applicable data-protection laws.
2. Personal data we collect
The Company collects and processes personal data that is reasonably necessary for the purposes described in this Privacy Policy.
2.1 Account and contact data
When a User creates or manages an Account, the Company may collect:
username;
email address;
password in protected or hashed form;
Account registration date;
Account status;
last login information; and
information provided when updating the Account.
The Company does not have access to the User’s original password where passwords are stored in hashed form.
2.2 Purchase and transaction data
When a User makes a Purchase or otherwise interacts with the checkout process, the Company may collect or process:
• the Learning Product purchased;
• order or transaction reference;
• purchase date and time;
• purchase amount;
• currency;
• payment status;
• promotional code information;
• withdrawal, refund, or cancellation information;
• records relating to any consent or acknowledgement required for the immediate supply of digital content;
• the time at which access to a Learning Product was granted, where recorded; and
• limited payer or transaction information received from the payment provider.
The Company does not normally collect or store complete payment-card numbers, card security codes, or online-banking credentials.
2.3 Learning and access data
To provide and manage access to Learning Products, the Company may process limited information concerning:
• Lessons, Courses, Packs, or Extras purchased;
• Content available to the User;
• course or Lesson progress;
• completion information and achievements;
• access dates or activity relating to purchased Content where necessary for Platform operation; and
• access granted, restricted, restored, or corrected by an authorised administrator.
This information may be used to display purchased Content, maintain progress, manage access, restore access following technical issues, and maintain an accurate record of Learning Products associated with an Account.
2.4 Communications
When a User contacts the Company, the Company may collect:
• name or username;
• email address;
• Account details;
• order details;
• the contents of the communication;
• attachments provided by the User; and
• records of the Company’s response.
Users should not send unnecessary confidential information or special category data when contacting the Company.
2.5 Technical and security data
The Platform may automatically process limited technical information required for operation and security, including:
• IP address;
• browser type;
• device type;
• login date and time;
• session information;
• failed login attempts;
• security events; and
• technical error records.
This information is not used for behavioural advertising or marketing analytics.
3. How personal data is collected
The Company may collect personal data:
• directly from the User during registration;
• when the User creates, updates, or manages an Account;
• when the User places an order or completes checkout;
• when the User accesses Learning Products;
• when the User contacts the Company;
• when the User submits a withdrawal notice, refund request, complaint, or other claim;
• automatically through essential Platform, authentication, technical, and security functions;
• through cookies or similar technologies as described in the Cookie Policy; and
• from the payment provider where necessary to confirm or reject a transaction, provide access, investigate a payment issue, or process a reimbursement.
Where personal data is obtained from a payment provider, the Company normally receives only the categories of transaction information reasonably necessary for the relevant purpose.
4. How we use personal data
The Company may use personal data to:
• create, authenticate, maintain, and secure Accounts;
• take steps requested by a User before entering into a contract;
• process Purchases and confirm payment status;
• provide and maintain access to purchased Learning Products;
• issue purchase and transaction confirmations;
• record information required in connection with the immediate supply of digital content;
• maintain purchase and access history;
• record course and Lesson progress and completion;
• manage promotional codes;
• restore or correct access following technical issues;
• provide customer support;
• process withdrawal notices, refund requests, complaints, and other claims;
• comply with accounting, tax, consumer-protection, and other legal obligations;
• protect Users, Accounts, Content, and the Platform;
• detect, investigate, and prevent fraud, misuse, infringement, or unauthorised access;
• investigate technical and security incidents;
• enforce the Terms of Use;
• establish, exercise, or defend legal claims; and
• maintain the reliability and security of the Platform.
The Company does not sell personal data.
The Company does not use personal data for unrelated third-party advertising or profiling for third-party advertising purposes.
Unless expressly disclosed otherwise, the processing activities described in this Privacy Policy do not involve decisions based solely on automated processing that produce legal effects concerning a User or similarly significantly affect a User.
5. Lawful bases for processing
The Company processes personal data only where a lawful basis applies under applicable data-protection law.
5.1 Performance of a contract and pre-contractual steps
The Company relies on Article 6(1)(b) GDPR where processing is necessary to perform a contract with the User or to take steps at the User's request before entering into a contract.
This may include processing necessary to:
• create and operate an Account;
• process a Purchase;
• confirm payment;
• provide access to a Learning Product;
• maintain purchase and access records;
• provide support relating to an Account or Purchase;
• process a withdrawal notice, refund request, or other contractual request; or
• perform the Company's obligations under the Terms of Use.
Without the required Account and transaction data, the Company may be unable to create an Account, complete a Purchase, provide access to purchased Content, or respond to a relevant request.
5.2 Legal obligation
The Company relies on Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation.
This may include obligations relating to:
• taxation;
• accounting and financial records;
• consumer protection;
• legally required transaction or contract records;
• court orders;
• lawful requests from regulators or public authorities; or
• other applicable legal duties.
5.3 Legitimate interests
The Company may rely on Article 6(1)(f) GDPR where processing is necessary for a legitimate interest pursued by the Company or another party and that interest is not overridden by the rights and freedoms of the individual concerned.
Relevant legitimate interests may include:
• protecting the Platform and its Users;
• preventing and investigating fraud or unauthorised access;
• securing Accounts;
• preventing misuse or unlawful distribution of Content;
• investigating technical or security problems;
• maintaining accurate operational records;
• enforcing the Terms of Use;
• managing disputes;
• establishing, exercising, or defending legal claims; or
• maintaining and improving the reliability and security of essential Platform functions.
The Company assesses the effect of such processing and does not rely on legitimate interests where the individual's interests, rights, or freedoms override the relevant legitimate interest.
5.4 Consent
The Company does not rely on GDPR consent for processing that is necessary to create an Account, perform a Purchase, supply a Learning Product, or comply with a legal obligation.
Where an optional processing activity requires consent under applicable data-protection law, the Company will request consent separately and in a clear manner. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Any express consent or acknowledgement given by a Consumer in connection with the immediate supply of digital content and the loss of a statutory right of withdrawal under consumer law is separate from consent used as a lawful basis for processing personal data under the GDPR.
6. Payments
Payments are processed through an independent third-party payment service provider.
The User submits payment-card, banking, or other payment information directly through the payment provider's payment interface. The payment provider processes this information in accordance with its own legal obligations, privacy notice, security procedures, and terms.
The Company may receive limited payment-related information, including:
• payment confirmation or refusal;
• transaction reference;
• amount paid;
• currency;
• payment date;
• refund or reimbursement status; and
• limited payer information where provided by the payment provider.
The Company does not normally receive or store complete payment-card details, card security codes, or online-banking credentials.
The payment provider may perform payment-verification, identity, security, fraud-prevention, or other checks in accordance with its own legal obligations and policies.
The applicable payment provider and relevant payment information will be identified at checkout or through the relevant payment interface or notice.
7. Sharing personal data
The Company does not sell personal data and does not disclose personal data to unrelated third parties for their own advertising or marketing purposes.
Personal data may be disclosed, where necessary and lawful, to:
• payment service providers, banks, card issuers, payment networks, and other parties involved in processing a transaction or reimbursement;
• hosting, infrastructure, technical, security, communication, and support service providers acting for the Company;
• legal, accounting, tax, and other professional advisers where necessary;
• courts, regulators, law-enforcement bodies, tax authorities, or other public authorities where disclosure is required or permitted by law;
• parties involved in investigating or preventing fraud, security incidents, infringement, or unlawful activity, where legally permitted;
• a purchaser, successor, investor, or acquiring organisation in connection with a lawful corporate transaction, restructuring, merger, financing, sale, or transfer of all or part of the relevant business; or
• another party where the User has authorised the disclosure or another valid legal basis applies.
Where a service provider processes personal data on the Company's behalf as a processor, the Company will require appropriate contractual and data-protection safeguards consistent with applicable law.
8. International data transfers
RedSoftPlus OÜ is established in Estonia, a Member State of the European Union.
Personal data may be processed within the European Economic Area (“EEA”) or, where necessary, transferred to or accessed from a country outside the EEA.
Where personal data is transferred outside the EEA and the GDPR requires a transfer mechanism, the Company will ensure that an appropriate legal basis for the transfer is in place. Depending on the destination and circumstances, this may include:
• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses approved by the European Commission;
• another appropriate safeguard permitted under Article 46 GDPR; or
• a derogation permitted under Article 49 GDPR where the applicable legal conditions are satisfied.
Where required, the Company will assess whether additional safeguards are necessary to maintain an appropriate level of protection for personal data.
Further information about safeguards applicable to a particular transfer may be requested by contacting hello@lingnity.com.
9. Data retention
The Company retains personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.
The following retention principles apply:
9.1 Account data
Account information is normally retained while the Account remains active.
After an Account is closed, some information may be retained for a reasonable period to:
• confirm the closure;
• prevent fraud or repeated misuse;
• resolve disputes;
• protect legal rights; or
• comply with legal obligations.
9.2 Purchase and transaction data
Purchase, payment-confirmation, withdrawal, refund, and accounting records are retained for the periods required by applicable tax, accounting, consumer-protection, and record-keeping laws.
Certain accounting, invoice, transaction, and tax records may be subject to statutory retention periods of seven years under applicable Estonian law.
Records necessary to demonstrate the formation or performance of a Purchase, including records relating to the immediate supply of digital content where relevant, may also be retained for as long as reasonably necessary to comply with legal obligations or to establish, exercise, or defend legal claims.
9.3 Learning and access data
Learning Product purchase, access, and completion data may be retained while the Account remains active and while the User continues to have access to purchased Learning Products.
This information may be deleted or anonymised after Account closure, unless continued retention is required for transaction records, disputes, security, or legal obligations.
9.4 Communications
Support requests and complaints are retained until the matter is resolved and for a reasonable period afterwards in case of follow-up questions, complaints, or legal claims.
9.5 Security data
Security and access records are retained only for as long as reasonably necessary to investigate incidents, prevent misuse, protect the Platform, and maintain system security.
When personal data is no longer required, the Company will delete, anonymise, or securely dispose of it, unless the law requires continued retention.
10. Account closure and deletion
A User may request Account closure by contacting hello@lingnity.com.
Account closure and erasure of personal data are separate matters. Closing an Account does not necessarily require the immediate deletion of all personal data and does not override lawful retention requirements.
The Company may continue to retain personal data where necessary to:
• comply with accounting, tax, consumer-protection, or other legal obligations;
• maintain necessary transaction records;
• prevent or investigate fraud, misuse, or security incidents;
• resolve complaints or disputes;
• establish, exercise, or defend legal claims; or
• respond to lawful requests from competent authorities.
Where retained information is no longer required for active Platform use, its use may be restricted as appropriate.
Closing an Account may result in loss of access to Learning Products associated with the Account, as described in the Terms of Use. Account closure does not by itself cancel a completed Purchase or create an automatic right to a refund.
A User may separately exercise any applicable right to erasure under the GDPR as described in Section 13 below.
11. Children and legal capacity
The eligibility requirements for use of the Platform are set out in the Terms of Use.
A person may use the Platform and enter into a Purchase in their own name only where they have the legal capacity to do so under applicable law.
Where permitted by applicable law, a person who does not have full legal capacity may use the Platform only with the involvement and authorisation of a parent or legal guardian and subject to any consent or approval required by law.
The Company does not knowingly seek to collect personal data from persons using the Platform contrary to these eligibility requirements.
If the Company becomes aware that an Account has been created or personal data has been provided contrary to the applicable eligibility requirements, the Company may take appropriate steps, including restricting or closing the Account and deleting personal data where legally permitted, subject to applicable retention obligations.
12. Special category data
The Company does not require Users to provide special category personal data.
Special category data includes information concerning matters such as health, racial or ethnic origin, religious beliefs, political opinions, trade-union membership, genetic data, biometric identification, sex life, or sexual orientation.
Users should not submit such information through support forms, emails, Account fields, or payment communications unless the Company has specifically requested it for a lawful and necessary purpose.
13. User rights
Subject to the conditions and limitations provided by applicable law, an individual may have the right to:
• obtain information about how their personal data is processed;
• obtain confirmation as to whether the Company processes their personal data and request access to that data;
• request correction of inaccurate personal data and completion of incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive qualifying personal data in a structured, commonly used, and machine-readable format and, where applicable, request its transmission to another controller;
• withdraw consent at any time where processing is based on GDPR consent, without affecting the lawfulness of processing carried out before withdrawal;
• exercise applicable rights relating to automated decision-making; and
• lodge a complaint with a competent supervisory authority.
These rights are not absolute and may be subject to statutory conditions or exemptions. For example, the Company may be required to retain transaction or accounting information notwithstanding an erasure request.
Requests may be submitted to hello@lingnity.com.
The Company may request information reasonably necessary to verify the identity of the person making a request, particularly where necessary to protect personal data against unauthorised disclosure.
The Company will respond to requests concerning rights under Articles 15–22 GDPR without undue delay and, in any event, within one month of receipt of the request. Where permitted by the GDPR, this period may be extended by up to two further months where necessary because of the complexity or number of requests. The Company will notify the requester of any permitted extension within the initial one-month period and explain the reason for it.
Requests are generally handled free of charge, subject to circumstances in which the GDPR permits a reasonable fee or refusal of a manifestly unfounded or excessive request.
14. Data-protection complaints
If a User has a concern about the way the Company processes personal data, the User may contact the Company at hello@lingnity.com.
Contacting the Company first does not limit or delay an individual's right to lodge a complaint with a competent supervisory authority.
15. Changes to this Privacy Policy
The Company may update this Privacy Policy where reasonably necessary to reflect:
• changes to the Platform or Learning Products;
• changes to personal-data processing activities;
• changes involving service providers or payment providers;
• legal or regulatory developments;
• technical or security requirements; or
• corrections, clarifications, or improvements to the information provided.
The current version will be published on the Platform together with its effective date.
Where a change materially affects the way personal data is processed, the Company will provide any additional notice required by applicable law. Such notice may be provided by email, through the Account, or through a prominent notice on the Platform.
Where a new processing activity requires consent under applicable data-protection law, the Company will obtain that consent separately rather than treating continued use of the Platform as consent.
16. Cookies and similar technologies
The Platform may use cookies or similar technologies for purposes such as authentication, Account sessions, security, preferences, and technical operation.
Further information about the cookies and similar technologies used by the Platform, their purposes, duration, and any choices available to Users is provided in the Cookie Policy.
Where applicable law requires consent for a non-essential cookie or similar technology, such consent will be requested separately.
17. Contact details
Questions, requests, or complaints concerning this Privacy Policy or the processing of personal data may be sent to:
Company: RedSoftPlus OÜ
Registry code: 16188810
Registered office: Harju maakond, Tallinn, Kesklinna linnaosa, Vesivärava tn 50-301, 10152, Estonia
Website: lingnity.com
Email: hello@lingnity.com