Privacy Policy

1.1. MB International School for Gestalt Therapy "SELF" (the "Data Controller" or "we"), legal entity code 306984420, registered address Užupio g. 20-1, LT-01203, Vilnius, Republic of Lithuania, pays particular attention to personal data protection and undertakes to respect the privacy of data subjects and to process personal data in accordance with applicable law.

1.2. This Privacy Policy (the "Policy") explains how we collect and process the information you provide when using (purchasing) educational services (the "Services"), including those available on our website (the "Website").

1.3. When processing your personal data as a user of our Website or as our client (the "Data Subject" or "you"), we comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation or GDPR), applicable Lithuanian data protection law (the "Data Protection Law"), and the instructions of the data protection supervisory authority.

1.4. The definitions used in this Policy correspond to those used in the GDPR, the Data Protection Law and other legislation governing personal data processing and privacy.

2.1. We receive personal data directly from you and from our Instagram account (see 2.3).

2.2. The main categories of personal data we process include:

• 2.2.1. first name;
• 2.2.2. last name;
• 2.2.3. email address;
• 2.2.4. phone number;
• 2.2.5. postal address;
• 2.2.6. messenger contact (Telegram, WhatsApp, Viber);
• 2.2.7. payment data: billing details (processed through third-party providers, e.g. Stripe);
• 2.2.8. other information you provide, including in the application form on the Website: education, city and country of residence, the text of your question.

2.3. When you interact with our Instagram account, we receive the following data through the official Instagram API (Meta Platforms Ireland Limited):

• 2.3.1. your Instagram username and account ID;
• 2.3.2. the text, date and time of your comments on our posts and replies to them;
• 2.3.3. Direct messages you send us and our replies;
• 2.3.4. statistics of our posts and account (reach, views, aggregated audience demographics).

3.1. We collect and further process your personal data only lawfully, fairly and transparently:

• 3.1.1. to conclude and/or perform a contract with you;
• 3.1.2. with your consent;
• 3.1.3. where we are required to process personal data by applicable legislation; and
• 3.1.4. where processing is necessary for our legitimate interest (only where it is not overridden by the interests or fundamental rights and freedoms of the Data Subject).

3.2. Your personal data are processed for the following purposes:

• 3.2.1. Conclusion, performance and termination of the contract for the Services (Art. 6(1)(b) GDPR). Retention period – 10 years;
• 3.2.2. Marketing communications (to your email, via a messenger assistant bot) with your consent (Art. 6(1)(a) GDPR). Retention period – 5 years;
• 3.2.3. Processing of a study application submitted via the Website form and communication with you about it, including a confirmation email (Art. 6(1)(a) GDPR). Retention period – until the end of enrolment for the programme plus 12 months;
• 3.2.4. Cookies. We use cookies to learn how you use our Website. Cookies make the Website easier and more convenient to use and help us make advertising on various channels more relevant. The information usually does not contain data that would identify you as an individual.
• 3.2.5. Replying to Instagram comments and messages, moderating comments, and analysing feedback about our programmes and post statistics to improve the Services (Article 6(1)(f) GDPR, legitimate interest). Retention period: 12 months from receipt; data on Instagram itself is kept under Meta's rules.

3.3. We process your personal data only where necessary for the purposes for which they are processed. Access is granted only to staff who need it to fulfil their professional duties towards you as a client. Your personal data are not stored or processed longer than necessary for the purposes above.

3.4. For the establishment, exercise or defence of legal claims we may retain your personal data longer than stated in clause 3.2. After the period in clause 3.2 expires, the personal data are destroyed.

4.1. We may disclose your personal data in response to requests from courts, law enforcement or public authorities to the extent necessary to comply with applicable law, and to other recipients with your consent or at your request.

4.2. We use third-party services to provide our Services and Website (e.g. IT support companies, payment system operators). These providers are data processors; transfers to them are governed by data processing agreements or terms. In particular, we use:

• Google (Google Sheets) — storing applications submitted via the Website;
• Telegram — internal notification of school staff about a new application;
• an email service (sender domain notify.psyself.pro) — sending the confirmation email;
• the Website hosting provider — technical operation of the Website;
• Meta Platforms Ireland Limited (Meta Pixel) — measuring views of the Website home page, only on the grounds set out in section 8. Application data are not shared with Meta.
• Meta Platforms Ireland Limited (Instagram API) — receiving comments, messages and statistics of our Instagram account and publishing our replies;

4.3. Data processors may process personal data only on our instructions and only to the extent necessary to perform their obligations. We use only processors providing sufficient guarantees that appropriate technical and organisational measures are implemented in line with the GDPR.

4.4. Personal data may be transferred to third countries in compliance with, among other things, Chapter V GDPR and applicable law.

4.5. When preparing replies and analysing feedback, the text of Instagram comments and messages may be processed using the Claude AI assistant of Anthropic, PBC (USA), under Anthropic's terms and privacy policy (https://www.anthropic.com/legal/privacy). We share only the data needed for this purpose.

5.1. The Data Subject has the following rights:

• 5.1.1. the right to be informed about the processing of their personal data;
• 5.1.2. the right of access to their data and its processing;
• 5.1.3. the right to rectification of inaccurate or incomplete personal data;
• 5.1.4. the right to erasure or suspension of processing (except storage). To have data received from Instagram deleted, write to support@psyself.school; you can also delete your own comments and messages on Instagram yourself.
• 5.1.5. the right to restriction of processing where one of the legal grounds applies;
• 5.1.6. the right to data portability – an electronic copy of the data may be provided to another company on request;
• 5.1.7. the right to object to processing for advertising purposes or based on our legitimate interests, on grounds relating to your particular situation;
• 5.1.8. the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal);
• 5.1.9. the right to lodge a complaint with the data protection supervisory authority.

5.2. Upon presenting an identity document or using a qualified electronic signature, you may submit a request in person, by post, by courier or by email. We will respond without undue delay and in any case within 1 (one) month of receipt, in accordance with Chapter III GDPR.

5.3. You may send your request to the email address given in section 7.

5.4. If you are not satisfied with our response, you may lodge a complaint with the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, Vilnius, https://vdai.lrv.lt/, or bring an action before a court.

We store and process personal data in the European Union. Some providers listed in clause 4.2 (in particular Google, Telegram, Meta and Anthropic) may process data outside the European Economic Area; such transfers are made with the safeguards of Chapter V GDPR (adequacy decisions, standard contractual clauses).

Feel free to contact us with any question, request or complaint about the processing of your personal data at support@psyself.school.

8.1. To make browsing the Website more convenient and efficient, we use cookies and similar browser storage. They remember your settings and choices and, where there are grounds, measure advertising effectiveness.

8.2. You can choose whether to accept cookies. Optional cookies are enabled only according to your choice in the cookie window shown on your first visit; you can change or withdraw your choice at any time via the "Cookie settings" button. You can also disable all or individual cookies in your browser settings; this may slow browsing, limit functionality or block access to the Website.

8.3. We use session and persistent cookies. Session cookies exist only during a visit and are deleted when the browser is closed. Persistent cookies remain for a set period unless you delete them. Cookies do not harm your device or files.

8.4. More information on managing cookies:

• 8.4.1. Microsoft Edge: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
• 8.4.2. Google Chrome: https://support.google.com/chrome/answer/95647
• 8.4.3. Mozilla Firefox: https://support.mozilla.org/kb/enable-and-disable-cookies-website-preferences
• 8.4.4. Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac

8.5. Cookies used:

8.6. Meta receives the page address, view event, IP address, browser information and cookie identifiers. Automatic form data collection and contact matching are disabled. Withdrawing consent stops new transmissions but does not delete data already sent; for deletion contact Meta (https://www.facebook.com/privacy/policy/) or support@psyself.school.

We may amend this Policy at our discretion. If the Policy is changed, the latest version will be published on our website. We recommend checking whether the Policy has been changed.

Policy approval date and version: v02; 24 October 2026.