LANGUAGE TICKET LLC

PRIVACY POLICY

Version 3.0 • Effective 5 September 2026 • Arab Republic of Egypt

English: This document is written for the LanguageTicket service and is intended to be read together with the applicable checkout/order information.

1. SCOPE AND PURPOSE

Language Ticket LLC (“LanguageTicket”, “we”, “us” or “our”) respects privacy and processes personal data in accordance with applicable Egyptian law, including Personal Data Protection Law No. 151 of 2020 and its applicable Executive Regulations, including Minister of Communications and Information Technology Decision No. 816 of 2025, as amended from time to time. This Policy explains what personal data we collect, why we use it, how we protect it, when we disclose it, and the choices and rights available to you.

2. CONTROLLER AND CONTACT

The data controller is Language Ticket LLC, registered in the Arab Republic of Egypt. Commercial-registration, tax-registration and registered-office details applicable to a particular transaction are provided in the relevant contracting, invoice or order record. Privacy and data-protection requests may be sent to [email protected]; general support is available at [email protected] and WhatsApp +20 155 866 5466.

3. PERSONAL DATA WE MAY COLLECT

Depending on your use of the service, we may collect identification and contact information (such as name, email, phone number and country); account and authentication information; learner information (such as level, goals, lesson history, progress, teacher feedback and preferences); booking and attendance information; payment and transaction information received from payment providers; communications and support records; and technical information such as IP address, browser, device, log, security and cookie information.

4. PURPOSE AND LAWFUL PROCESSING

We process personal data only for lawful and specified purposes, including creating and administering accounts, arranging lessons and teacher matching, delivering educational services, processing payments and invoices, communicating with you, providing support, maintaining security and preventing fraud, improving our services, complying with legal obligations, and exercising or defending legal rights. Where consent is required, we seek it in a clear manner and record it.

Where another lawful basis is permitted by Egyptian law, processing may be carried out on that basis.

5. LEARNING AND EDUCATIONAL INFORMATION

Learning information is used to deliver and improve educational services and to personalize the learner’s route. We do not sell personal data or educational records. We will not use sensitive personal data for unrelated purposes. If information that qualifies as sensitive personal data under applicable law is required, we will apply the additional safeguards, permissions and consents required by law.

6. SHARING AND PROCESSORS

We may disclose the minimum information necessary to service providers that act for or support LanguageTicket, including hosting, cloud technology, communications, scheduling, payment processing, customer support, security and analytics providers, and teachers where needed to deliver lessons. Such providers may process data only for authorized purposes and subject to appropriate contractual and legal safeguards.

We may also disclose information to regulators, courts, law-enforcement authorities or professional advisers when required or permitted by law.

7. INTERNATIONAL AND CROSS-BORDER PROCESSING

LanguageTicket is established in Egypt but may offer services to users internationally. Personal data may therefore be processed or accessed in Egypt and in other countries by approved service providers, including hosting, communications, payment, scheduling, analytics and security providers. We will apply appropriate legal and contractual safeguards required by the laws that apply to the relevant processing.

Where laws such as the EU General Data Protection Regulation (GDPR), UK GDPR/Data Protection Act requirements, California privacy laws such as the CCPA/CPRA, or other local privacy laws apply to a particular user or processing activity, we intend to honor the rights and obligations that are legally applicable to that activity, subject to any lawful exceptions.

Depending on the jurisdiction, additional notices, consent mechanisms, data-transfer safeguards, access/deletion/opt-out rights or representative/contact arrangements may apply. Nothing in this Policy is intended to remove a mandatory privacy right that cannot lawfully be waived.

Teachers and other contractors may receive limited student information needed to perform booked services; they may use such information only for legitimate service delivery and are required, through applicable contractual obligations, to protect it and comply with data-protection law.

8. COOKIES AND SIMILAR TECHNOLOGIES

We may use essential cookies for security and core website functions, preference cookies to remember choices, and analytics or similar technologies where permitted. Non-essential cookies are controlled through our cookie mechanism where implemented. You may change browser settings to block or delete cookies, although blocking essential cookies may affect the website.

9. DATA SECURITY AND BREACH RESPONSE

We use reasonable technical and organizational safeguards appropriate to the nature of the data and the risks of processing, including access controls, authentication, secure transmission where appropriate, restricted access, logging and incident procedures. No internet transmission can be guaranteed completely secure. Where Egyptian law requires notification or other action following a personal-data breach, we will follow the applicable statutory and regulatory procedures.

10. RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, to provide services, resolve disputes, maintain records, satisfy tax/accounting or other legal obligations, enforce agreements and protect security. When data is no longer required, it is deleted, anonymized or securely disposed of where practicable and legally permitted.

11. YOUR RIGHTS

Subject to the conditions, procedures and limitations in Egyptian law, you may have rights concerning access to, correction or updating of, deletion or restriction of, withdrawal of consent for, and objection to certain processing of your personal data, together with other rights granted by the Personal Data Protection Law and its regulations. Requests should be sent to [email protected]. We may need to verify identity before acting and may retain information where the law requires or permits it.

12. CHILDREN AND MINORS

LanguageTicket is intended to be used with appropriate parental or guardian involvement where required. If a learner is a minor, the person providing consent or completing a purchase on the learner’s behalf represents that they are authorized to do so. We do not knowingly process children’s personal data contrary to applicable legal requirements.

13. THIRD-PARTY SERVICES AND LINKS

Our website may link to or integrate with third-party services, including payment, communications and scheduling tools. Their privacy practices are governed by their own policies. We encourage you to review those policies before providing information directly to a third party.

14. MARKETING COMMUNICATIONS

We may send service messages necessary to administer your account or bookings. Promotional electronic marketing will be sent only in accordance with applicable law and, where required, with the required consent and opt-out mechanism. You may contact us to stop promotional communications.

15. CHANGES TO THIS POLICY

We may update this Policy when our services, technology or legal obligations change. The current version and effective date will be displayed with the Policy. Changes will not remove mandatory rights granted by applicable law.

16. GOVERNING LAW, INTERNATIONAL PRIVACY RIGHTS AND CONTACT

This Policy is primarily governed by the laws of the Arab Republic of Egypt, including Personal Data Protection Law No. 151 of 2020 and its applicable Executive Regulations, but this governing-law statement does not remove any mandatory privacy rights or regulatory protections that apply to you under the law of your country, state or region. Where a mandatory local privacy rule gives you stronger rights, those rights apply to the extent required by law.

Questions or requests may be sent to [email protected] or [email protected], or by WhatsApp at +20 155 866 5466.

LANGUAGE TICKET LLC

Version 3.0 • Effective 5 September 2026 • Arab Republic of Egypt

SUPPLEMENTARY LEGAL CLARIFICATIONS

17. REGULATORY COMPLAINTS AND BILINGUAL INTERPRETATION

Where applicable under Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, a data subject may use the complaint or regulatory procedures available before the competent Personal Data Protection Center in addition to contacting LanguageTicket directly.

This Policy is published in English and Arabic. Both versions are intended to have the same meaning. Any inconsistency shall be resolved in accordance with mandatory Egyptian law and the context of the original notice provided to the data subject.

18. GOOGLE OAUTH AND USER DATA POLICY DISCLOSURE

18.1 Application Identity and Scope: LanguageTicket (“LanguageTicket”, “we”, “our”, or “us”) operates the public educational website and learning platform at https://www.languageticket.com and its official subdomains. This section describes specifically how LanguageTicket accesses, uses, stores, shares, and protects user data obtained through Google OAuth 2.0 authentication services in full compliance with the Google API Services User Data Policy.

18.2 Google User Data Accessed: When you choose to authenticate or register for LanguageTicket using your Google Account, we request access only to fundamental identity information via standard Google OAuth 2.0 scopes: (a) openid (to cryptographically verify your identity), (b) https://www.googleapis.com/auth/userinfo.email (to access your primary email address for account identification and transactional updates), and (c) https://www.googleapis.com/auth/userinfo.profile (to retrieve your name, given name, family name, and profile picture avatar for your learner profile). We do not request, access, read, or store any sensitive Google Drive files, Gmail correspondence, contacts, calendar events, or Google account passwords.

18.3 How We Use Google User Data: LanguageTicket uses information retrieved from Google APIs exclusively for the following core educational purposes: (a) To authenticate your identity and allow you to log in to your authorized student, parent, or organization portal securely without managing a separate password; (b) To create and maintain your LanguageTicket learner profile and display your name and avatar in your live classroom dashboard; (c) To send transactional and operational notifications regarding scheduled live 1-on-1 English lessons, instructor assignments, CEFR milestone assessments, and billing receipts. Google user data is never used for any purpose outside these educational and account management functionalities.

18.4 How We Store and Protect Google User Data: All Google user data transmitted between your browser, Google authentication servers, and LanguageTicket is encrypted in transit using industry-standard Transport Layer Security (TLS 1.2/TLS 1.3). Data stored in our database is encrypted at rest using AES-256 bit encryption and protected by database Row-Level Security (RLS) policies. Access to internal databases is restricted to authorized personnel on a strict need-to-know basis protected by Multi-Factor Authentication (MFA).

18.5 No Sale and Sharing Restrictions: LanguageTicket does NOT sell, rent, lease, or trade Google user data to third parties, data brokers, or advertising networks. We do not use Google user data for serving personalized advertisements, behavioral targeting, or retargeting. Furthermore, we do not use Google user data to train generalized artificial intelligence (AI) or machine learning (ML) models.

18.6 Google Limited Use Compliance: LanguageTicket's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

18.7 Data Retention, Revocation, and Deletion: We retain Google user data only for as long as your LanguageTicket account remains active. You may revoke LanguageTicket's access to your Google Account at any time directly through Google Account Security Settings at https://myaccount.google.com/permissions. You may also permanently delete your LanguageTicket account and request complete erasure of all associated Google user data by emailing [email protected] or via your portal account settings. All verified deletion requests are permanently fulfilled within thirty (30) days.