Regional Privacy & Consumer Rights

No country has been established as fully compliant by the current review. The Netherlands is the proposed first market for focused review because the operator is registered there; it is not yet legally cleared. Country blocking has not been enabled. Website accessibility is not evidence of legal approval, and this page is not a country allowlist.

The reviewed regions below still require applicable-law assessment and, where necessary, additional parental verification, vendor/transfer evidence and consumer controls. All other countries and territories remain unreviewed. A country access rule, if introduced, will be described separately and will not extinguish existing customers’ privacy or consumer rights.

Our Chingelish Policies explains the operator, worldwide policy scope, mandatory local rights and educational and medical limitations. Website policies are not a substitute for local licensing or our own legal obligations.

Where GDPR or UK GDPR applies, rights include access, correction, erasure, restriction, applicable portability, objection and withdrawal of consent, subject to lawful conditions and exceptions. Requests normally receive a response within one month, with lawful extensions explained. You may complain to the Dutch Autoriteit Persoonsgegevens, the UK ICO, or your competent local supervisory authority.

For consent-based online services offered directly to children, the GDPR national consent age varies from 13 to 16; the UK age is 13. All Chingelish learners aged 4–12 are below those thresholds. Other legal bases must be assessed by purpose; having an adult contract does not automatically settle the child’s legal basis. The UK Children’s Code also addresses best interests, high privacy defaults and age-appropriate transparency.

International transfers require the applicable adequacy or other lawful safeguards, with the correct EU or UK instruments and assessments. A privacy-policy acceptance is not a blanket transfer permission. See Refunds & Cancellation for distance-contract withdrawal and statutory service remedies.

Sources: GDPR; UK Children’s Code.

COPPA covers qualifying collection from children under 13 by child-directed services. It may require direct parental notice and verifiable parental consent before collection, parental review/deletion and refusal of further collection, minimisation, written security and retention measures, and separate consent for certain disclosures. A declaration, microphone permission or ordinary email verification is not automatically verifiable parental consent. The current parent check must not be represented as a COPPA-approved verification method.

The ordinary compliance transition for the 2025 COPPA amendments ended on 22 April 2026. State privacy, biometric, child-safety and subscription laws can add obligations; COPPA is not a complete US legal clearance. We do not run advertising tracking or sell data to brokers. Applicability of statutory sale/sharing definitions and vendor processing still requires review.

Sources: 2025 COPPA rule; FTC COPPA guidance.

UAE federal privacy and child-protection legislation, including the applicable child digital-safety framework, require their own scope and implementation review. DIFC and ADGM have separate data-protection regimes where their legal nexus exists; merely living in the UAE does not make every regime apply. Consent, guardian authority, data rights, transfers, regulator contacts and any registration or privacy-officer duties must be assessed under the applicable regime.

Do not read this notice as a claim of approval under the federal PDPL, DIFC or ADGM. UAE mandatory consumer rights are preserved where applicable. Sources: UAE child digital safety; ADGM guidance.

These are separate countries, not one UAE/GCC privacy regime. Each requires review of territorial scope, guardian authorization, sensitive/children’s information, rights, transfers and any permits or registrations. Qatar’s special-nature processing rules and Oman’s permit categories warrant particular review. Consumer and language requirements also differ; no single GCC-wide cancellation period is asserted.

Sources: Saudi PDPL implementing rules; Qatar privacy guidance.

Applicable federal and provincial laws can require meaningful guardian consent, access/correction rights, accountable privacy management and safeguards for foreign processing. Quebec has additional requirements, including its under-14 consent rules, transfer assessments and language obligations. No uniform nationwide digital-consent age or automatic legal clearance is asserted.

Source: Canadian meaningful-consent guidance.

Applicable privacy coverage, children’s capacity, overseas processing and consumer guarantees need separate assessment in each country. Small-business status is not conclusive. New Zealand privacy-officer and overseas-disclosure requirements, and applicable biometric rules, must be checked. Australian statutory consumer remedies are not excluded by a no-refund term; there is no universal online change-of-mind period asserted here. Draft codes are not treated as binding without checking commencement.

Sources: Australian children’s privacy code information; New Zealand overseas-disclosure principle.

The DPDP framework uses an under-18 child definition and contains guardian verification and child-processing safeguards. Commencement of the Act and the staged 2025 Rules must be checked provision by provision; this notice does not claim that every future child-verification rule is already operative. Applicable transitional privacy and consumer rules remain relevant. An educational purpose does not itself establish an exemption from tracking or child-consent requirements.

Source: 2025 DPDP Rules.

Brazil requires assessment under the LGPD, child/adolescent best-interest rules, the Digital ECA, applicable transfer safeguards and consumer law. Where child consent is relied on, it requires specific parental authorization and reasonable verification. Singapore’s PDPA and children’s guidance require appropriate parental authorization for young users, accountability, a public privacy contact and comparable protection for overseas transfers. These are separate frameworks, not interchangeable approvals.

Sources: Brazil Digital ECA; Singapore PDPC.

Use Parent Consent & Data Rights for contact and deletion instructions. Your statutory rights and relevant deadlines depend on the law that applies, not just the list on this page. No policy can replace jurisdiction-specific safeguards, registrations, contracts or qualified legal review.