Privacy Terms

Makeful is a FashionTech STEAM education program founded and operated by Linette Manuel, headquartered in Prague, Czech Republic. We run teacher professional development programs, summer camps, and school enrichment programs across multiple countries.

For the purposes of data protection law, Makeful s.r.o. is the data controller responsible for your personal information. When we say "we," "us," or "Makeful" in this document, we mean the organisation operating these programs and this website.

This Privacy Policy applies to our website at makeful.com, our registration and contact forms, our email communications, and all Makeful educational programs.

We collect only what we genuinely need. Here's a clear breakdown:

Information you give us directly

• Contact & enquiry forms Name, email address, school or organisation name, country, and your message or question.
• Program registration Name, email, school name, role (teacher / coordinator / parent), country, and program interest.
• Student enrollment We collect student first name, age group, and email address. For full-year programs, we also collect a home address for administrative purposes. Student email addresses are used exclusively for enrollment and online class access — we do not send students any marketing, newsletters, or promotional content.
• Newsletter sign-up Email address and (optionally) first name.

Information collected automatically

• Usage data Pages visited, time on page, browser type, and device type — collected in aggregate and anonymised form.
• IP address Stored temporarily for security purposes and to understand broad geographic reach. Not used to identify individuals.
• Referral source How you found us (search engine, social link, direct). Helps us understand where our community is growing.

We use your information to run our programs and communicate clearly with you. Specifically:

• To respond to enquiries and send you the information you've asked for (info packs, program details, pricing).
• To enroll you or your students in Makeful programs and manage those programs effectively.
• To send program updates, schedules, and relevant educational content to enrolled participants.
• To send our newsletter if you've opted in — covering new programs, FashionTech insights, and Makeful updates.
• To improve our website and programs based on aggregate, anonymised usage data.
• To comply with our legal obligations as an education provider operating across multiple countries.

The legal basis for processing under GDPR is: legitimate interests (responding to your enquiry), contractual necessity (delivering enrolled programs), and consent (newsletter and optional marketing communications).

We do not use your data for automated decision-making or profiling. We don't sell it. We don't use it to target you with ads on other platforms.

We do not sell, rent, or trade your personal information. Full stop.

We do share limited data with the following trusted service providers who help us operate. Each is bound by data processing agreements and cannot use your data for their own purposes:

• Tally Our contact and registration forms are built with Tally. Submission data is collected and stored on Tally's servers under their privacy policy. We use Tally solely to receive enquiries and program registrations.
• Esmerise Our online program content and classes are delivered through the Esmerise platform. Student account data — including name and email address — is stored on Esmerise's servers to provide access to course materials and online sessions.
• Google Services We use Google Workspace (including Google Drive and associated services) to store and manage program-related information internally. Data stored in Google's infrastructure is subject to Google's data processing terms and privacy policy.

We may disclose information if required by law, court order, or regulatory authority. We will notify you where legally permitted to do so.

Our website uses a minimal set of cookies. We do not use advertising cookies or cross-site tracking cookies.

Strictly necessary cookies

These keep the website functioning — session management, form security tokens, and basic preferences. These cannot be disabled without breaking core site functionality.

Analytics cookies

We use privacy-first analytics that do not set persistent tracking cookies or build individual profiles. Usage data is aggregated and anonymised. You can opt out via your browser settings at any time.

Embedded content

Our site includes an embedded YouTube video. YouTube may set cookies when you interact with the video player. This is governed by Google's Privacy Policy. You can prevent this by not interacting with embedded video, or by using a browser extension that blocks third-party cookies.

Under GDPR and applicable data protection law, you have the following rights regarding your personal data:

• Right of access You can request a copy of all personal data we hold about you.
• Right to rectification You can ask us to correct any inaccurate or incomplete information.
• Right to erasure You can ask us to delete your personal data where we have no legal obligation to retain it.
• Right to restrict processing You can ask us to pause processing of your data while a query is resolved.
• Right to data portability You can request your data in a structured, machine-readable format.
• Right to object You can object to processing based on legitimate interests, including for direct marketing (unsubscribe at any time — every email has a one-click unsubscribe link).
• Right to withdraw consent Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at [email protected] with the subject line "Data Request." We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection authority. In the Czech Republic, this is the Úřad pro ochranu osobních údajů (ÚOOÚ) at uoou.cz. UK residents may contact the ICO. US residents may have additional rights depending on their state.

Many Makeful participants are young people under 18. We take this seriously.

We do not collect personal data directly from students under 16. Student enrollment is always completed by a parent, guardian, or school administrator — never by the student themselves through our public website or forms.

For enrolled students, we collect first name, age group, and email address. For full-year programs, we also collect a home address. Student email addresses are used only for enrollment confirmation and online class access — never for marketing, newsletters, or any promotional communication. Home addresses are used solely for program administration and are never shared with third parties for commercial purposes.

Schools that enroll students take on responsibility (as data processors) for ensuring that appropriate consent has been obtained from parents or guardians in accordance with their local data protection requirements.

We keep your data only as long as necessary:

• Enquiry & contact data Retained for 2 years from last contact, then deleted or anonymised unless a program relationship develops.
• Program participant data Retained for the duration of the program plus 3 years for administrative and legal purposes, then securely deleted.
• Newsletter subscribers Retained until you unsubscribe. Unsubscribing removes you from all marketing lists within 7 days.
• Anonymous analytics data Retained in aggregated form indefinitely as it cannot be used to identify individuals.

You can request deletion of your data at any time by emailing us, regardless of the above timelines — unless we have a legal obligation to retain it (for example, financial records required by Czech tax law).

We take reasonable and appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction.

This includes encrypted data transmission (HTTPS), access controls limiting who within our team can access personal data, and using reputable, security-vetted third-party service providers.

No method of internet transmission or electronic storage is 100% secure. If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

We review our security practices regularly and update them as technology and best practices evolve.

Questions about this policy, your data, or how we operate? We'd genuinely rather you asked us directly than wondered.

This policy was last reviewed in January 2025. We will update it if our practices change and post the new version here with an updated date. Continued use of our website or programs after an update constitutes acceptance of the revised policy — but we'll always flag significant changes clearly.