Privacy Policy
For Mandarin Learner, a trading name of Icelabz Solutions Ltd, registered in England and Wales. Last updated . Effective . Version 2.3.0.
1. Who we are
The data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is:
Icelabz Solutions Ltd (trading as Mandarin Learner)Registered in England and Wales
Company number: 09606511
Registered office: 53 The Meadow Way, Harrow, HA3 7BP, England
Privacy email: privacy@mandarinaudio.com
Website: mandarinaudio.com
Icelabz Solutions Ltd is the controller for any personal data processed in connection with the Mandarin Learner website (mandarinaudio.com), the Mandarin Learner mobile application, and related waitlist, booking, lesson-progress and customer-support activities.
2. Scope of this policy
This policy explains what personal data we collect when you visit mandarinaudio.com, join the launch waitlist, book a lesson, create a teacher account, or contact our support team. It also describes how that data is used, how long it is held, who it is shared with, what your rights are, and how to exercise them.
This policy is published in English (United Kingdom). Mandarin Learner is operated by a single legal entity incorporated and based in England and Wales, and this policy applies to every visitor regardless of country of residence. The canonical version of this policy always lives at mandarinaudio.com/privacy/.
3. Data we collect
We collect only the data we need to operate the service. The categories below correspond to the lawful bases and retention periods set out in the next sections.
3.1 Data you give us
- Waitlist email address — a single field, captured before the product is generally available.
- Booking details — the name, email address, chosen lesson slot and timezone you supply when you book a lesson.
- Teacher account details — for teachers: display name, biography, spoken languages, availability, and payout-account details held by our payment processor.
- Customer-support correspondence — messages you send to our support address, plus any attachments you choose to include.
- Survey or feedback responses — voluntary responses to in-product surveys and feedback forms.
3.2 Data we collect automatically
- Booking and progress data — which lessons you have booked, attended, rescheduled or cancelled, and aggregate per-lesson activity.
- Device and connection data — IP address, user agent string, referrer, approximate country derived from IP, and timestamps of access (used for fraud detection, abuse prevention and basic service telemetry).
- Cookies — strictly-necessary session cookies only. The marketing site sets no analytics or advertising cookies; see section 13 below.
3.3 Data we receive from third parties
- Payment data from Stripe — we use Stripe as our payment processor. Mandarin Learner does not store full payment-card numbers; we hold only the
stripe_customer_idreference and a redacted subset such as card brand and last four digits, returned to us by Stripe under our written data-processor agreement. - Sign-in providers — if you sign in through a third-party single-sign-on provider we receive your verified email address and a basic profile identifier. We do not receive your social-account contacts or any other social-graph data.
4. How we use your data
- To arrange and confirm your lesson bookings, and to send the joining details for each lesson.
- To process payments via Stripe and to issue receipts.
- To operate teacher accounts, availability and payouts.
- To respond to support requests.
- To notify you of product updates, launch news and feature changes — for the marketing list (waitlist plus opt-in), only with your explicit consent, which you can withdraw at any time.
- To detect and prevent fraud, abuse, and security incidents.
- To comply with UK tax, accounting and corporate record-keeping obligations.
- To improve the product on an aggregate basis (counts, not profiles) where this is in our legitimate interest and does not override your rights.
We do not sell your personal data to anyone, and we do not perform automated decision-making or profiling that produces legal or similarly significant effects on you. Section 10 sets this out in more detail.
5. Lawful bases (UK GDPR Article 6)
For each processing purpose we rely on a specific lawful basis under Article 6 of the UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Arranging and confirming lesson bookings | Contract — Article 6(1)(b) — necessary to perform the contract you have with us when you book. |
| Operating teacher accounts and payouts | Contract — Article 6(1)(b). |
| Processing payments via Stripe | Contract — Article 6(1)(b). |
| Marketing emails (waitlist plus opted-in users) | Consent — Article 6(1)(a). Easy to withdraw, easy to give — via the unsubscribe link in every email. |
| Fraud, abuse and security-incident response | Legitimate interests — Article 6(1)(f). Balanced against your expectations; not used for marketing. |
| HMRC tax records, Companies House filings, statutory accounting | Legal obligation — Article 6(1)(c). |
6. Retention periods
We keep your data only for as long as we need it for the purpose for which it was collected:
- Booking records — 3 years from the lesson date, to support refunds, disputes and teacher payouts.
- Teacher account data — while the account is active and for up to 30 days after it is closed.
- Billing and tax records — 6 years from the date of the transaction, to satisfy HMRC requirements under the Income Tax Act 2007 and the Value Added Tax Act 1994.
- Customer-support correspondence — 24 months from the last exchange.
- Server security logs — 30 days, after which they are deleted automatically.
- Marketing list — deleted within 30 days of your withdrawal of consent, or within 30 days of two full years of inactivity, whichever comes first.
After the relevant period ends, the data is either deleted or anonymised for statistical purposes.
8. International transfers
Our application servers and booking database are hosted by Alibaba Cloud in its Hong Kong region. Hong Kong is a third country for the purposes of the UK GDPR and is not covered by a UK adequacy regulation, so the transfer requires an Article 46 transfer mechanism. That mechanism is the International Data Transfer Addendum to the EU Standard Contractual Clauses (UK Addendum), incorporated into our written data-processing agreement with Alibaba Cloud.
Where any other recipient processes your data outside the UK:
- Stripe — payments are contracted with Stripe Payments Europe Ltd (Ireland), which is covered by the UK's adequacy regulations, so no further transfer mechanism is required for the primary processing. Where Stripe transfers data onward to Stripe, Inc. in the United States, it relies on the UK Extension to the EU–US Data Privacy Framework and, where that does not apply, the EU Standard Contractual Clauses together with the UK Addendum.
- Email and video-conferencing providers — the EU Standard Contractual Clauses together with the UK Addendum.
We have carried out a transfer risk assessment for the Hong Kong transfer and concluded that the standard of protection is not materially lower than in the UK. Transfers to Ireland are covered by UK adequacy, and the onward US leg runs on the UK Extension to the EU–US Data Privacy Framework, so neither requires a separate assessment. To obtain a copy of the relevant safeguard document, email privacy@mandarinaudio.com.
9. Your rights
Under the UK GDPR you have the following rights. None of these rights is absolute — in some cases we may need to keep certain data to comply with a legal obligation (for example, HMRC) or to defend a legal claim.
- Right of access — you can ask us for a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct data that is wrong or to complete data that is incomplete.
- Right to erasure — you can ask us to delete data, subject to our legal retention obligations.
- Right to restriction of processing — you can ask us to pause processing while a question is resolved.
- Right to data portability — for data you provided to us and that we process by automated means on the basis of consent or contract, you can ask us for a portable copy.
- Right to object — you can object to processing based on our legitimate interests, and we will stop unless we can show compelling legitimate grounds that override your interests.
- Right to withdraw consent — where we rely on your consent (marketing email), you can withdraw it at any time by using the unsubscribe link in any email or by emailing privacy@mandarinaudio.com. Withdrawal does not affect the lawfulness of processing before withdrawal.
- Right to complain to the ICO — see section 16 below.
To exercise any of these rights, email privacy@mandarinaudio.com. We aim to respond within one calendar month. We will not charge you for responding to a valid request.
10. Statutory requirements and automated decisions
You are not under a statutory obligation to provide any of the personal data we ask for. Booking a lesson requires a name, email address and learning notes so that the teacher can prepare and contact you; if you do not provide them, we cannot confirm the booking. Waitlist sign-up is entirely optional.
We do not carry out automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.
11. Children
Mandarin Learner is designed for adult language learners. The minimum age to book a lesson is 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe that your child has provided personal data to Mandarin Learner, please email privacy@mandarinaudio.com and we will delete the associated data within 7 days.
12. Security
We protect your personal data with industry-standard technical and organisational measures:
- Encryption in transit — all web traffic is served over HTTPS using TLS 1.2 or higher.
- Encryption at rest — production database columns containing personal identifiers are encrypted at rest; backups are encrypted.
- Access control — staff access to personal data is on a need-to-know basis, with role-based permissions and audit logging.
- Two-factor authentication — required for all administrative access to our systems.
- Vulnerability testing — regular dependency-vulnerability scanning and periodic third-party penetration testing.
- Incident response — we will notify the ICO within 72 hours of becoming aware of any personal-data breach that meets the threshold under UK GDPR Article 33, and will inform affected users where required by Article 34.
No security measure is perfect, but we continually invest in reducing risk and responding quickly to incidents.
14. Changes to this policy
We may update this policy from time to time. The current effective date and version are shown at the top of this page. Material changes — meaning changes that affect how we collect, use, share or retain your personal data — will be announced to active users at least 14 days before they take effect, by email to the address on file.
Previous versions of this policy are preserved in the project source repository.
15. Contact us
For any privacy query or to exercise your rights:
Icelabz Solutions Ltd — Privacy Team53 The Meadow Way, Harrow, HA3 7BP, England
Email: privacy@mandarinaudio.com
We aim to acknowledge all privacy enquiries within 3 working days and to respond substantively within one calendar month.
16. Complaints to the ICO
If you believe that we have not handled your personal data fairly and lawfully, or you are not happy with our response to a request, you have the right to complain to the Information Commissioner's Office (ICO):
Information Commissioner's OfficeWycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint/
17. Account and selected-data deletion
You can request deletion of your Mandarin Learner data — including your waitlist entry, booking history and profile — by emailing privacy@mandarinaudio.com from the address associated with your bookings. We confirm identity by replying to that address, so no other person can delete your data.
We apply a 7-day cooling-off period before the deletion job runs, so a mistaken request can be cancelled. We retain only the data that Icelabz Solutions Ltd must keep for legal, tax, security or billing-audit purposes, for the applicable retention period described in section 6 of this policy.
Some records, such as completed lesson bookings tied to a tax invoice, are subject to the statutory retention periods above and cannot be deleted early.
18. Other Mandarin Learner applications
18.1 HSK Quiz
Icelabz Solutions Ltd also develops HSK Quiz, a mobile application for Chinese vocabulary practice. HSK Quiz is not yet generally available; you can register your interest on the waitlist.
HSK Quiz is designed to be fully offline: your answers, results, settings and study plan stay on your device and are removed when you uninstall the app. The app does not ask for your name, email address, contact details or any text you type, and results are never uploaded to us.
18.2 Crash reporting
HSK Quiz uses Sentry (Functional Software, Inc.) to receive anonymous crash reports and performance traces. The categories of data shared with Sentry are: device model, operating system version, app version, and anonymised stack traces. User tracking is disabled in our Sentry configuration, and Sentry receives neither your answers nor your study plan. Retention in our Sentry project: 30 days for error events, 90 days for aggregated issues.
18.3 Contact
For HSK Quiz support, contact support@mandarinaudio.com. For privacy requests relating to any Mandarin Learner application, contact privacy@mandarinaudio.com.