Last updated: 14 October 2026

01. INTRODUCTION

Welcome to Aristo Grace Academy.

At Aristo Grace Academy, we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, protect and, where necessary, share personal information when you visit our website, contact us, subscribe to our communications or interact with our educational projects and products.

This Policy applies to www.aristograce.com and to personal data processed by the website operator in connection with its operation.

Aristo Grace Academy creates and presents educational and creative products for children, families and educators, including illustrated books, interactive adventures, printable learning cards, educational games and physical learning materials.

Our website provides information about our educational projects and products and directs visitors to external online stores where purchases can be completed.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Czech data protection legislation.

​

02. DATA CONTROLLER

The data controller responsible for personal data processing in connection with the operation of this website is:

Company: NordFrey s.r.o.
Company Identification Number (IČO): 07776136
Registered Office: Kaprova 42/14, 110 00 Prague 1 – Staré Město, Czech Republic
Commercial Register: Municipal Court in Prague, Section C, File 307409
Brand: Aristo Grace Academy
Website: www.aristograce.com
Contact Email: aristo.grace.academy@gmail.com

NordFrey s.r.o. determines the purposes and means of personal data processing carried out in connection with this website.

For privacy-related questions or requests, please contact us using the email address above.

​

03. PERSONAL DATA WE COLLECT

The categories of personal data we process depend on how you interact with our website.

3.1 Information provided voluntarily

When you contact us by email or through an available website form, we may collect:

• Your name, if provided.

• Your email address.

• Your telephone number or other contact details, if provided.

• The contents of your message.

• Information necessary to respond to your enquiry.

3.2 Technical information

When you visit our website, certain technical information may be processed automatically by our hosting and infrastructure providers.

This may include:

• Internet Protocol (IP) address.

• Browser type and version.

• Device type and operating system.

• Date and time of website access.

• Pages requested or visited.

• Referring website information.

• Technical identifiers and cookie-related information.

• Security and diagnostic information.

3.3 Subscription information

Where visitors use an available subscription function, we may collect:

• Email address.

• Name, if requested.

• Subscription preferences, where applicable.

• Records of subscription requests and consent.

• Information relating to unsubscribing or withdrawing consent.

3.4 Sensitive personal information

We do not intentionally request special categories of personal data, such as health information, religious beliefs, political opinions or biometric information, through ordinary website communications.

Please avoid including sensitive personal information unless it is necessary for your enquiry.

​

04. HOW PERSONAL DATA IS COLLECTED

We may collect personal data:

• Directly from you when you contact us.

• When you voluntarily submit information through a website form.

• When you subscribe to communications.

• Automatically through the technical operation of the website.

• Through cookies and similar technologies, where applicable.

• Through service providers supporting website hosting, security, consent management or communications.

We seek to limit the collection of personal data to what is necessary for the relevant purpose.

​

05. PURPOSES AND LEGAL BASES OF PROCESSING

We process personal data only where an appropriate legal basis exists under Article 6 of the GDPR.

5.1 Responding to enquiries

We process contact details and correspondence to respond to messages, provide information and communicate with visitors.

Legal basis: Legitimate interests under Article 6(1)(f) GDPR or steps taken at your request before entering into a contract under Article 6(1)(b), where applicable.

5.2 Operating and securing the website

Technical data may be processed to maintain website functionality, diagnose technical issues, protect against misuse and ensure security.

Legal basis: Legitimate interests under Article 6(1)(f) GDPR.

5.3 Compliance with legal obligations

Where necessary, personal data may be processed to comply with applicable legal requirements or lawful requests from competent authorities.

Legal basis: Article 6(1)(c) GDPR.

5.4 Optional analytics and cookies

Where non-essential analytics or other optional technologies are enabled and consent is legally required, processing takes place on the basis of consent.

Legal basis: Article 6(1)(a) GDPR.

5.5 Marketing communications

Where visitors subscribe to promotional communications, we process the relevant contact information for the stated subscription purpose.

Legal basis: Consent under Article 6(1)(a) GDPR where required, or another applicable legal basis where permitted by law.

5.6 Legal claims and disputes

We may process relevant personal information where necessary to establish, exercise or defend legal claims.

Legal basis: Legitimate interests under Article 6(1)(f) GDPR or another applicable legal basis.

We do not process personal data for incompatible purposes without an appropriate legal basis.

​

06. WEBSITE HOSTING AND WIX SERVICES

Our website is created and hosted using Wix.

Wix provides website infrastructure and related technical services that may involve processing personal data.

Depending on the website configuration, these services may include:

• Website hosting and content delivery.

• Website security and technical maintenance.

• Contact form functionality.

• Technical performance and diagnostics.

• Communication-related features.

• Other website functions enabled by the operator.

Wix may use infrastructure and service providers located in different countries.

Further information about Wix's privacy practices is available at:

https://www.wix.com/about/privacy

NordFrey s.r.o. remains responsible for its own data protection obligations in connection with the configuration and operation of the website.

​

07. EDUCATIONAL PRODUCTS AND EXTERNAL PURCHASES

Aristo Grace Academy presents original educational products in digital and physical formats.

These include illustrated children's books, educational cards, printable activities, interactive stories, learning games and other creative educational materials.

Our collections include Aristo Grace Kingdom and the Aris & Grace storybook series.

The website provides information about these products and may contain links to external online stores where visitors can make purchases.

Purchases are not completed directly through www.aristograce.com.

The website does not currently operate its own product checkout, process customer payments or independently arrange the delivery of purchased products.

When visitors follow a purchasing link, they enter an external sales environment.

Personal data collected during a purchase, including customer identification, payment information, billing details and delivery addresses, is processed according to the respective responsibilities and privacy information of the external store and the contractual seller.

NordFrey s.r.o. does not automatically become the controller of all personal data processed during an external purchase merely because the visitor reached the store through our website.

If a visitor separately contacts Aristo Grace Academy about a product, we may process the information voluntarily provided to respond to the enquiry.

This Privacy Policy governs the processing activities associated with our website and does not replace the privacy notices applicable to independent purchasing transactions.

​

08. CONTACT FORMS AND COMMUNICATIONS

Visitors may contact Aristo Grace Academy through available website forms or by email.

When you contact us, we may process your name, email address, message and other information voluntarily provided.

This information is used to understand and respond to your request, provide relevant information and manage related correspondence.

Submitting an ordinary contact enquiry does not automatically constitute consent to receive promotional emails.

We do not require visitors to provide unnecessary personal information simply to request general information about our educational projects.

Contact correspondence is retained only for as long as reasonably necessary for its purpose, subject to applicable legal obligations or legitimate retention requirements.

 

09. NEWSLETTERS AND SUBSCRIPTIONS

Where newsletter or subscription functions are available, visitors may choose to receive communications from Aristo Grace Academy.

These may include:

• Announcements of new books and educational collections.

• Information about creative projects.

• Educational activities and resources.

• Product news and launches.

• Academy updates and related communications.

Where consent is required, visitors must provide valid consent before receiving marketing communications.

Consent may be withdrawn at any time.

Subscribers may unsubscribe through an available unsubscribe mechanism or by contacting:

aristo.grace.academy@gmail.com

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

We do not treat the submission of an ordinary contact form as automatic consent to marketing.

​

10. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies.

Cookies are small files or technical identifiers used to support website functionality, maintain security, remember preferences and perform other functions.

10.1 Strictly necessary cookies

These may be required for essential website functionality, security and technical operations.

Strictly necessary cookies may operate without consent where permitted by applicable law.

10.2 Preference cookies

These may remember visitor settings or choices.

10.3 Analytics cookies

Where enabled, analytics technologies may help us understand website usage and performance.

Where consent is legally required, these technologies should operate only after the appropriate consent has been obtained.

10.4 Marketing cookies

Where enabled, marketing technologies may support advertising or promotional activities.

Such technologies are subject to applicable consent requirements.

Not all cookie categories described above are necessarily active on our website.

Information about the actual technologies used, their purposes, providers and durations should be available through the website's cookie information and consent controls.

​

11. COOKIE CONSENT MANAGEMENT

Our website uses Usercentrics for Wix to support the management of cookie consent.

Where applicable, the consent management system allows visitors to:

• Accept optional cookies and technologies.

• Reject optional cookies and technologies.

• Review available cookie categories.

• Manage or change consent preferences.

• Withdraw previously granted consent.

The system may process information necessary to record and manage consent choices.

Visitors may also manage cookies through their browser settings.

Disabling certain technologies may affect website functionality.

Additional information is provided in our separate Cookie Policy.

​

12. SHARING PERSONAL DATA

We do not sell personal data.

We may share personal data where necessary and legally justified.

Depending on the relevant processing activity, recipients may include:

• Website hosting and infrastructure providers.

• Website security and technical support providers.

• Contact form and communication service providers.

• Cookie consent management providers.

• Email service providers.

• Professional advisers where necessary.

• Public authorities where disclosure is legally required.

Where a provider processes personal data on our behalf, we take appropriate steps to ensure that applicable contractual and legal safeguards are in place.

Certain third-party services may act as independent data controllers for their own processing activities.

We do not disclose visitor information for unrelated third-party marketing without an appropriate legal basis.

​

13. INTERNATIONAL DATA TRANSFERS

Some of our website infrastructure and technology providers may process personal data outside the European Economic Area (EEA).

Where such transfers are subject to the GDPR, appropriate legal mechanisms must be used.

Depending on the circumstances, these may include:

• Adequacy decisions adopted by the European Commission.

• Standard Contractual Clauses approved by the European Commission.

• Other lawful transfer mechanisms permitted under the GDPR.

Where necessary, additional safeguards may be applied.

Visitors may contact us for further information about applicable international transfers and relevant safeguards.

​

14. DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by applicable law.

14.1 Contact correspondence

Messages and contact information are retained for the period reasonably necessary to respond to enquiries, manage follow-up communication and address related matters.

14.2 Subscription information

Where subscriptions are used, relevant information is retained while the subscription remains active and, where necessary, for an additional period to document consent, withdrawal or compliance with legal obligations.

14.3 Technical information

Technical information is retained according to operational needs, security requirements and the relevant provider's retention settings.

14.4 Cookie and consent information

Cookie-related information and consent records are retained according to their purposes, configured durations and applicable legal requirements.

14.5 Legal obligations and claims

Where information must be retained to comply with legal obligations or establish, exercise or defend legal claims, it may be retained for the relevant period.

When personal data is no longer necessary, we take appropriate steps to delete or anonymise it unless continued retention is legally justified.

​

15. DATA SECURITY

We take reasonable technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration and unlawful disclosure.

These measures may include:

• Using established website infrastructure providers.

• Restricting access to personal information.

• Applying appropriate account security measures.

• Maintaining relevant technical safeguards.

• Limiting unnecessary data collection.

• Reviewing security issues when identified.

The level of protection is assessed in relation to the nature of the processing and the risks involved.

No method of internet transmission or electronic storage can be guaranteed to be completely secure.

Where a personal data breach occurs, we will assess the incident and comply with applicable GDPR notification obligations.

​

16. YOUR RIGHTS UNDER THE GDPR

Subject to the conditions and exceptions established by applicable law, you have the following rights concerning your personal data.

16.1 Right of access

You may request confirmation of whether your personal data is being processed and obtain access to relevant information.

16.2 Right to rectification

You may request correction of inaccurate personal data or completion of incomplete information.

16.3 Right to erasure

You may request deletion of personal data where the legal conditions are met.

This right is subject to applicable exceptions, including legal retention obligations.

16.4 Right to restriction of processing

You may request restriction of processing in circumstances specified by the GDPR.

16.5 Right to data portability

Where the relevant conditions are met, you may request certain personal data in a structured, commonly used and machine-readable format.

16.6 Right to object

You may object to processing based on legitimate interests on grounds relating to your particular situation.

You may object at any time to processing for direct marketing purposes.

16.7 Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

16.8 Rights concerning automated decisions

You have rights under Article 22 GDPR concerning certain decisions based solely on automated processing, including profiling, where those decisions produce legal or similarly significant effects.

16.9 How to exercise your rights

To exercise your rights, please contact:

aristo.grace.academy@gmail.com

We may request information reasonably necessary to verify your identity.

We will respond without undue delay and within the time limits established by applicable law, generally within one month, subject to lawful extensions.

Requests are generally handled free of charge, except where applicable law permits otherwise.

​

17. CHILDREN'S PRIVACY

Aristo Grace Academy creates educational materials designed to support children's learning, creativity, communication and personal development.

Our website is intended primarily for adults, including parents, legal guardians, teachers and educators.

We do not intentionally request personal information directly from children through ordinary website functions.

Children are not required to create accounts or submit personal information to view general information about our educational projects.

Where processing involving a child's consent is subject to specific legal requirements, we will respect the applicable age and parental authorisation rules.

If we become aware that a child's personal data has been collected without an appropriate legal basis, we will take reasonable steps to address the situation, including deletion where required.

Parents and legal guardians may contact us regarding children's privacy at:

aristo.grace.academy@gmail.com

​

18. THIRD-PARTY LINKS AND SOCIAL MEDIA

Our website may contain links to external websites, online stores, social media platforms and other independent services.

These services may process personal data under their own privacy policies.

We do not control the independent privacy practices of external websites.

Visitors are encouraged to review the relevant privacy information before providing personal data to a third-party service.

Where visitors communicate with Aristo Grace Academy through social media, we may process the information provided in order to respond.

The relevant social media platform may separately process personal data in connection with its own services.

​

19. AUTOMATED DECISION-MAKING AND PROFILING

We do not currently use personal data collected directly through the ordinary operation of this website to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

If such processing is introduced, we will provide the information required by applicable data protection legislation and implement the necessary safeguards.

Automated processes operated independently by third-party services are subject to the respective responsibilities of those providers.

​

20. WHETHER PROVIDING PERSONAL DATA IS REQUIRED

Visitors are generally not required to provide personal information simply to browse our website.

Providing personal data is voluntary unless specific information is necessary for a requested service or required by law.

For example, an email address may be necessary for us to respond to an enquiry.

If necessary information is not provided, we may be unable to respond to or fulfil the relevant request.

Purchases completed through external online stores are subject to the information requirements and privacy notices applicable to those transactions.

​

21. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

Changes may be necessary due to:

• Updates to applicable legislation.

• Changes in website functionality.

• Changes in our educational products or services.

• Introduction or removal of website technologies.

• Changes in service providers.

• Changes in personal data processing activities.

When this Privacy Policy is updated, the date at the beginning of the document will be revised.

Where legally required, we will provide additional notice or obtain consent before implementing relevant changes.

Visitors are encouraged to review this Privacy Policy periodically.

​

22. RIGHT TO LODGE A COMPLAINT

If you have concerns about how your personal data is processed, you may contact us directly.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

In the Czech Republic, the supervisory authority is:

Úřad pro ochranu osobních údajů
Office for Personal Data Protection
Website: https://uoou.gov.cz

You may also have the right to lodge a complaint with the supervisory authority in the EU or EEA country of your habitual residence, place of work or place of an alleged infringement.

​

23. CONTACT INFORMATION

For questions concerning this Privacy Policy, personal data processing or the exercise of your data protection rights, please contact:

ARISTO GRACE ACADEMY
Where Values Shape the Future

Data Controller: NordFrey s.r.o.
IČO: 07776136
Registered Office: Kaprova 42/14, 110 00 Prague 1 – Staré Město, Czech Republic
Commercial Register: Municipal Court in Prague, Section C, File 307409
Website: www.aristograce.com
Email: aristo.grace.academy@gmail.com

We are committed to respecting the privacy of our visitors and handling personal data responsibly, transparently and in accordance with applicable law.

​

​

© 2026 Aristo Grace Academy. All rights reserved.