Website terms of use: https://dogacademies.com/en/user-agreement
Who is responsible for the data
Responsibility for data processing in operating dogacademies.com and providing NSHSS services rests with ТОВАРИСТВО З ОБМЕЖЕНОЮ ВІДПОВІДАЛЬНІСТЮ «НАЦІОНАЛЬНА ШКОЛА СЛУЖБОВОГО СОБАКІВНИЦТВА», ЄДРПОУ registration code 32167398, referred to below as NSHSS. Questions about data and consent: support@dogschool.od.ua. Contact telephone: +380733113847.
This Policy explains the processing of data about visitors, applicants, customers, students, participants in assessments and the Instructor Register, review authors and people contacting NSHSS. It covers the website, its forms and chat, enquiries recorded in the CRM, placing and fulfilling orders, and related activities. A specific programme or service may provide a separate notice before collecting additional data.
Reading this Policy or visiting the website does not constitute consent to advertising, optional analytics, or publication of a name or image. Acceptance of the public offer and optional consents are handled separately. Processing is governed by Ukrainian law; the GDPR and other mandatory rules apply where the relevant relationship falls within their scope. A contractual choice of law does not override mandatory data protection rights.
What data we receive and where it comes from
Forms, orders and correspondence provide the information you enter: name, telephone number, email or selected messenger contact, language, city, training programme and format, question or comment. Applications for sessions may include the dog's name, breed, age and necessary information about behaviour and training. Information about a dog linked to its owner's record is processed as part of that record.
Order fulfilment involves the selected product, price and currency, agreed terms, order identifiers, payment or refund status and history, access provided and enquiries about the order. Payment results come from the payment service and banks. The WayForPay payment form opens to make the relevant payment; full card details should be entered only in the payment service's designated secure form, not in NSHSS's chat or application.
Training and assessments may involve the selected group, attendance, completed assignments, results, assessment materials, and details of documents issued and their verification. If a programme involves recording a class or submitting an examination video, the recording's contents, purpose and access arrangements are explained before recording or submission. Recordings containing participants' personal data do not automatically become public.
When you use the website, its infrastructure receives the IP address, request time, requested page, and browser and device information needed to deliver the page and protect the service. After you open the chat or leave contact details for an enquiry in it, the service uses a session identifier, messages, delivery and read statuses, time, language and enquiry page. The chat also sends the CRM the IP address, approximate country and city inferred from network infrastructure, device type and browser language. This location may be inaccurate; it is not access to the device's GPS. You may separately provide your name and telephone number for a response and to match the enquiry with your customer record.
If you allow optional technologies, browser and session identifiers, visit events, referral source, limited advertising campaign identifiers, and application and order events are also processed. See the cookie section. Authorised staff and teachers may add information about service delivery; payment participants add payment information, and the assessment panel adds assessment information. If we receive data about you from someone else, we provide the necessary information about its source and processing in the circumstances and time limits required by law.
Do not use general forms to send passport copies, full card details, passwords, medical documents or excessive information about other people. If a particular programme objectively requires human health data or other specially protected information, NSHSS must first provide a separate notice, identify a specific lawful ground and arrange a secure transfer method. A standard application, interest in canine-assisted therapy or information about a dog's health does not constitute consent to processing a person's medical data.
When a form is submitted, the CRM stores the enquiry, selected programme, language and submission page, together with source and campaign tags (UTM) present in that enquiry. This is context for handling that particular enquiry and internal records, not permission to load optional trackers or send contact details to an advertising platform.
Purposes and lawful grounds
Enquiries and preparing an order. Contact details, the enquiry and selected programme are used to respond, clarify the request, agree terms and take steps towards a contract at your request. Necessary pre-contractual steps and contract performance are based on the relevant contractual relationship. A voluntary enquiry unrelated to a contract relies on consent for a specific purpose where the form requests it, or a justified legitimate interest in addressing the enquiry and protecting the rights concerned. This does not authorise adding the contact to an advertising mailing list.
Contracts, training and support. Order data, contacts and necessary training information are used to provide the selected service or access, organise classes, communicate schedules, assess work, conduct agreed assessments, honour guarantees, process refunds and handle complaints. Service messages about a paid product or progress of an enquiry do not depend on consent to advertising messages.
Records and mandatory documents. NSHSS processes necessary payment information and documents to meet accounting, tax and other duties under applicable law. The Ukrainian ground is compliance with a statutory duty. If the GDPR also applies to these data, the specific ground is determined under Article 6: a Ukrainian duty does not itself replace the requirement in Article 6(3) for EU or Member State law. Where appropriate, the legitimate interest in accurate records and protecting rights is considered, with a necessity and balancing assessment.
Security and protection of rights. Technical logs, consent records, necessary order actions and material correspondence may be used to prevent abuse, protect access, investigate faults, fulfil data requests and resolve a specific dispute. NSHSS's legitimate interests are secure services, evidence of performance and protection of rights. Processing is limited to what is necessary and takes individual rights and interests into account. This ground is not used for undisclosed advertising tracking.
Analytics, advertising and publications. Optional Google analytics and Meta advertising technologies are enabled through separate choices in the cookie settings. Advertising messages and publication of a review, image or public Register profile require separate grounds and consents where consent is necessary. Refusal does not prevent ordering, handling an ordinary enquiry or training. Taking an assessment does not itself authorise publication of a personal profile.
Under Ukrainian law, these grounds are provided in particular by Article 11 of the Law “On Personal Data Protection”. Where the GDPR applies, the relevant Article 6(1) grounds are used: consent, contractual necessity, an applicable statutory duty or legitimate interests. Specially protected data additionally require a condition under Article 9 GDPR and/or Article 7 of the Ukrainian Law; the ordinary contractual ground alone is insufficient.
To prevent fraud, mass fictitious orders, unauthorised access and intellectual property infringement, NSHSS may compare necessary information about requests, orders, access and confirmed incidents. The basis is the legitimate interest in protecting the service and rights, subject to necessity and a balancing of interests. A complaint, negative review or refund request is not, by itself, fraud; disputed circumstances require review. This does not permit publicly accessible blacklists.
Required and optional fields
Forms identify the fields needed for the selected action. Without a contact for a response, NSHSS may be unable to reach you; without necessary order information, it may be unable to place the order, provide access or identify a payment. Optional fields may be left blank. Refusing marketing, optional analytics or public publication does not remove paid services or statutory rights.
Who can access the data
Data are accessible to authorised NSHSS employees and engaged specialists within their duties: handling enquiries, organising and delivering classes, assessment, payments, support and system protection. Infrastructure and service providers support the website, CRM, electronic communication, learning services and payments. Recipient categories include hosting and technical support; CRM and storage services; email and communications services; learning platforms and video conferencing used for a particular programme; banks, acquiring services and the WayForPay payment service.
If you select the relevant category, Google receives data through Google Analytics and/or Meta through advertising technologies. Their own processing is governed by applicable service terms and privacy notices: https://policies.google.com/privacy and https://www.facebook.com/privacy/policy/. An external provider may act as a processor or an independent controller depending on the operation; one status does not automatically cover all its services.
Public authorities, courts and professional advisers receive information where an applicable legal ground exists and only to the necessary extent. In response to a request about your data, NSHSS provides recipient information to the extent required by law. This Policy does not grant every listed category unrestricted access to the entire customer database.
If you visit an external website or payment page, or choose to communicate through a messenger, its operator receives data needed for its work under its own applicable terms. Linking to an external service does not itself mean that the service receives the whole history of your relationship with NSHSS.
For a video-course order through Goodboy, the platform receives necessary order data: name, email, phone, language, product, amount, technical order identifiers and IP address; it handles payment confirmation, access and support. With the relevant separate permission, analytics or advertising information described in the cookies section is also linked to the order. Refusing it does not stop processing necessary for the order itself.
International processing
NSHSS is located in Ukraine. When foreign infrastructure, communications and analytics services are used, processing may take place outside Ukraine, including in the European Economic Area and the United States, depending on the service and actual processing route. You should not assume that all data are hosted only in Ukraine or only in the EU.
International transfers are subject to Article 29 of the Ukrainian Law “On Personal Data Protection” and, where the GDPR applies, its Chapter V. Each transfer requires identifying the recipient, country and applicable protection mechanism. You may request information about the specific recipient, actual processing location and the ground or safeguards applicable to your transfer from support@dogschool.od.ua. Where the law provides for a copy of safeguards, you are entitled to obtain one subject to permitted protection of confidential information.
This Policy is not your consent to any transfer to any country. Ordinary cookie consent is not separate explicit consent to a risky international transfer under the Article 49 GDPR derogation. A provider's publication of standard terms does not itself establish that the necessary contracts have been concluded with NSHSS.
Public profiles, reviews and images
Publication in the public Register is chosen separately for first and last name, category, confirmed modules, record number, confirmation date, validity period and neutral current status. Additional country and city of professional practice, photograph and professional contact are published only as agreed. You can check the selected values before publication. A private address, documents, examination videos and private correspondence do not become public through inclusion in the Register.
A review's text, rating, displayed name and additional materials are agreed separately. The contact used to verify a review is not intended for publication. Consent to a particular review or profile does not automatically permit using the image in other advertising.
Public information is available to internet users and may be indexed by search engines. When the ground for publication ends, publication under NSHSS's control ends; legally required steps concerning recipients and copies are taken. NSHSS cannot guarantee that independent copies disappear from the internet immediately. Withdrawal of consent to a public profile does not itself cancel an assessment result. Necessary private retention of evidence of a result or dispute is considered separately.
How retention periods are determined
NSHSS retains identifying data only while necessary for a specific lawful purpose. The period depends on the data type, stage of the relationship, mandatory retention period and any specific unresolved claim. One enquiry does not justify retaining all information about a person indefinitely.
Enquiries without an order and related correspondence are retained for the response, necessary clarification and completion of the discussion you initiated. Once an enquiry is closed, data are deleted or anonymised unless particular information must be retained for a statutory duty or specific claim. Resuming substantive communication may require continued processing of the relevant history.
Data concerning an active order, training and access are retained throughout performance of the relevant obligations. Afterwards, documents and information needed for payments, mandatory records, guarantees and handling claims within applicable periods are identified separately. Accounting and tax documents are retained for the statutory periods for their category; the course access period does not replace those periods.
A learning recording containing participant data is retained during the access period promised by the programme and to the extent necessary to honour that access. Examination materials are retained during assessment and the established review procedure; evidence of results, issued documents and status history is retained while needed for verification and protection of related rights. A public profile remains only while its publication has a lawful ground. This does not authorise retaining every video indefinitely for status history.
An advertising contact is used until consent is withdrawn or the purpose ends. A minimal suppression record may be retained to honour an opt-out. Evidence of consent, withdrawal, contract formation and material actions is retained to the necessary extent while needed to demonstrate lawful processing or defend a specific claim.
Technical logs are retained for the time needed to identify and investigate faults and abuse; material concerning a particular incident may require separate retention until its investigation ends. Backups are used for recovery and must not return deleted data to ordinary processing. Their contents and retention are considered when handling erasure requests.
Technical lifetimes for cookies and browser storage are stated below. A cookie's lifetime is not the retention period for events in the CRM, Google or Meta. On request, NSHSS provides the period applicable to your information or the specific criteria for determining it. Extended retention for a dispute, inspection or mandatory requirement is limited to necessary data and the relevant legal ground.
Cookies and settings
Cookies, localStorage and sessionStorage store small values in your browser. Necessary technologies provide communications, security, retention of your choices and operation of a requested function. Optional analytics and advertising measurement are off by default. Continuing to browse or closing the window does not itself enable these categories.
“Google analytics”. If allowed, Google Analytics receives website visit and event information, browser and session identifiers, language, and limited source and advertising campaign information. Identifiers obtained with consent may link a visit in the CRM to an application and order outcomes, including confirmed payments and refunds, to evaluate website performance. Analytics events are not intended to contain question text, names, telephone numbers or email addresses. Technical identifiers and linkable events mean this processing cannot be considered fully anonymous. Google Signals and Google advertising personalisation are disabled in the current configuration.
“Google Ads measurement”. A separate voluntary permission connects ad clicks with CRM enquiries, their processing stages and payments using technical Google identifiers, including the click identifiers gclid, gbraid and wbraid. These events do not include your name, phone number, email or enquiry text; advertising personalisation is disabled. Google Analytics or Meta permission does not itself enable Google Ads. This choice requires Google analytics to be enabled and can be changed in “Cookie settings”. Declining does not prevent an enquiry or order.
With Google analytics permitted, measurements also cover viewing an offer and price, clicking purchase or contact buttons, starting a form, submitting and creating an order, and categories of checkout errors. This helps assess the website and the path to payment. An event may include the product, price and currency, button placement, error code and name of an invalid field; the entered field value, name, phone, email and message text are not included in these events.
“Meta advertising”. With separate permission, Meta Pixel measures referrals, applications and purchases to evaluate and improve advertising. It processes page and event information, browser and device details, IP address and advertising identifiers; purchase events include an event identifier, product, amount and currency. Server-side purchase events may also use hashed email addresses and telephone numbers to match the event to a Meta user. Hashing does not make this information anonymous. Related server-side purchase events are sent by the Goodboy payment platform where the appropriate permission exists. Meta may link received information to data from its services under its own applicable terms. Permission for Google Analytics does not include Meta, and cookie advertising consent does not subscribe you to a mailing list.
You can allow selected categories, reject all optional categories or change your choice in “Cookie settings”. Withdrawal in the settings stops new optional browser events covered by the withdrawn permission. The associated withdrawal request goes to the CRM for Google and to the Goodboy payment platform for Meta. After receiving the request, the platform stops subsequent server-side purchase events based on the withdrawn consent. If offline, the request is saved and retried when the connection returns. You can also contact support@dogschool.od.ua to stop other consent-based processing or check previously transmitted events. Information already received by an external service is not automatically deleted by clicking the button: contact NSHSS to exercise erasure or other rights; Google and Meta also offer their own mechanisms through their privacy notices.
Technical lifetimes of browser technologies:
— optional category choices are saved for up to 180 days from the choice; a new choice is requested sooner if required changes to purposes or the scope of consent occur;
— Google analytics cookies prefixed nshss_ga last up to 180 days in the website configuration, without automatic renewal on every visit; auxiliary source and event submission markers in sessionStorage last for the browser session;
— the __Host-nshss_chat chat identifier lasts up to 365 days from the chat service's last response, to continue the requested conversation; deleting the cookie may disconnect the browser from the earlier chat but does not itself delete the correspondence from the CRM;
— the local log preventing repeated Meta event submission uses entries up to 180 days old when it is updated; an old value remaining physically in localStorage does not authorise a new submission;
— Meta cookies, including _fbp and _fbc, are created by external code after permission; the external recipient's duration and rules depend on its technology and settings, not the lifetime of NSHSS's local log. Meta cookie information: https://www.facebook.com/privacy/policies/cookies/.
You can also delete website storage or block cookies through your browser. This may reset your saved choice and disrupt the function associated with a necessary identifier. Contact support in that case to obtain your paid service. Refusing optional categories must not block ordering or core functions.
In the current notice, Accept all enables all optional categories and Decline disables all; Settings lets you choose them separately. You can later change the choice through Cookie settings in this section. Wording about continuing to use the website does not constitute consent to optional technologies: they require the relevant affirmative choice. Settings apply to this browser; a different device or deletion of storage may require a new choice.
Your rights and requests
Where provided by law, you may find out whether your data are processed, obtain access and information about sources, purposes and recipients, correct inaccuracies, request an end to unlawful processing and erasure, withdraw consent, raise a statutory objection and challenge a decision. Where the GDPR applies, restriction and portability rights also apply under its conditions. You can object to processing for direct marketing at any time; after such an objection, data are no longer used for that purpose.
Send requests to support@dogschool.od.ua with the subject “Personal data”. Specify the data or relationship concerned and the action you request. NSHSS may ask for information needed to establish identity and meet applicable request requirements. A passport copy is not automatically required for every request. Knowing another person's telephone number or order number alone does not entitle anyone to their data.
Under Ukrainian law, an access request is assessed within ten working days and fulfilled within thirty calendar days of receipt unless the law provides otherwise; deferral of a person's access to their own data is not permitted. Where the GDPR applies, information about action on a request is provided without undue delay, normally within one month; any permitted extension requires timely notice and reasons and does not override a stricter applicable duty. Refusal includes the reasons and appeal procedure.
Withdrawal of consent does not make earlier lawful processing unlawful. It ends processing whose sole ground was the withdrawn consent. An erasure request does not cancel mandatory retention of a particular document or necessary action on a lawful claim; if a request is limited, NSHSS explains the applicable ground and information retained.
You may complain to the Ukrainian Parliament Commissioner for Human Rights: https://www.ombudsman.gov.ua/; where the GDPR applies, to a competent supervisory authority, particularly where you habitually reside or work or where the alleged infringement occurred, and to a court. Contacting NSHSS first is not a prerequisite for a complaint unless the law requires it.
Security, children and decisions
NSHSS must take protective measures appropriate to the risks, restrict staff access and respond to unlawful disclosure. Where the law requires an incident to be reported to an authority or affected individuals, that duty is carried out as prescribed. Do not share passwords or access secrets; report accidental disclosure to support.
General forms are not intended for children to submit sensitive data independently. If a programme allows a minor to participate, participation arrangements, the legal representative's authority and the necessary processing ground are determined separately according to age and applicable law. This Policy does not set a universal age of consent for all countries.
Statistics, enquiry routing and technical payment-status checks do not replace human consideration of a dispute. You may contact NSHSS and provide explanations about matters affecting contractual rights or an assessment result. Where rules on solely automated decisions with legal or similarly significant effects apply, their grounds and safeguards are observed.
Changes to this Policy
The current version is published on this page with its date. Material expansion of purposes, published information or optional technologies requires appropriate information and fresh consent where necessary. Publishing a new version does not itself authorise incompatible use of previously collected data.