We take the protection of personal data seriously. This policy explains how we process data through our website, online tutoring, Konomondo and our communication with learners and customers.
The controller is edventure Studios GmbH, Elisabethstraße 85/W616, 8010 Graz, Austria. Email: office@edventure.studio, phone: +43 676 945 05 30. Swiss data-protection law is additionally considered where applicable.
Our website, internal systems and customer data are hosted on servers operated by Hetzner Online GmbH in Germany. Data may include IP addresses, access logs, website, customer, contract and communication data, and learning materials.
Processing supports service delivery, administration, contracts and IT security under Article 6(1)(b) and (f) GDPR.
Technically necessary access data such as IP address, time, requested pages, browser, operating system, referrer and server logs are processed to provide and secure the website and analyse errors under Article 6(1)(f) GDPR.
When you use a newsletter, trial-session, support or contact form, we process the data you enter and the time of consent. This may include email, name, phone number, school type, year group, subject, message, organisation, tutoring needs and contact preferences.
For job applications, we process the selected role, name, email address, optional phone number and portfolio URL, your message, the required CV and any optional additional application document. We use this information only to assess and process your application and take pre-contractual steps. Uploaded files are retained in private, non-public storage until successful internal delivery.
After completing the optional entry assessment, you may send us your assessment. We store your email address, selected learning route, year group, individual answers, the related questions and correct answers, the server-calculated total score and the skills profile. With your consent, we use this data to review the result free of charge, email the complete assessment to you and contact you by email.
Newsletter signups are currently forwarded to edventure Studios as an internal email request. They are not yet added to a newsletter mailing list automatically. Form confirmations and internal notifications are sent through an SMTP service; delivery status and bounded error messages are stored in an outbox. Open and click tracking is disabled by default. Processing is based on consent, pre-contractual steps or our legitimate interest under Article 6(1)(a), (b) or (f) GDPR. Consent can be withdrawn at any time by email.
During checkout we process student details (name, date of birth, school type, year group and optional school), contracting-party details (name, optional salutation, address, email address and phone number), any separate billing address and confirmation of parental or legal authority.
We also store the selected plan, contract number, language, start, term and termination details, prices, payment method and status, applied discount codes, and the relevant confirmations with their wording version and timestamp. The details at conclusion are preserved as an immutable contract record; we generate and store the associated contract documents as PDFs. We also process communications and information concerning withdrawal, cancellations and support.
The purposes are pre-contractual steps, contract conclusion and administration, invoicing, service delivery, learner support, withdrawal and cancellations, related communication and legal documentation. Required details are needed to process the contract and provide the services.
The legal bases are Article 6(1)(b) GDPR for contracts and pre-contractual steps and (c) for statutory documentation and retention duties. Where students are not themselves contracting parties, their necessary details are processed under (f) to organise and deliver the support booked by their parents or guardians. IT security, abuse prevention and establishing or defending claims rely on (f). Consent under (a) applies to optional purposes such as statistics or marketing. Acknowledging this privacy policy does not constitute blanket consent to contract processing.
The website checkout stores contract data, billing addresses, confirmations and PDFs in the PostgreSQL database of our website infrastructure. We also use a Nextcloud instance on our server for internal customer and tutoring organisation, including appointments and support notes.
Access is limited to the people responsible for administration and support as needed for their tasks. The legal basis is Article 6(1)(b) and (f) GDPR.
Our own Jitsi server may process display name, live audio and video, chat, connection data, participation time, IP address, device and browser details. Sessions are not recorded unless everyone concerned has expressly agreed.
Miro guest links support interactive tutoring without requiring a learner account. Whiteboard content, text, drawings, comments, files and technical usage data may be processed to deliver the session under Article 6(1)(b) GDPR.
WhatsApp Business may be used voluntarily for scheduling and support. Names, phone numbers, profile data, messages, files, photos, screenshots and learning materials may be processed under Article 6(1)(a), (b) or (f) GDPR. Email remains available as an alternative.
Submitted exercises, notes, photos, screenshots and other school materials are processed to prepare, deliver and review tutoring. They are normally deleted no later than twelve months after the contract ends unless legal retention or a legitimate reason applies.
Konomondo may process email address, player ID, progress, completed questions, answers, learning-goal analyses and technical data. Unity authentication may be required. Processing supports app delivery and personalised learning under Article 6(1)(a) or (b) GDPR.
Learning-goal reviews may contain completed questions, correct and incorrect answers, progress, recommendations and support notes. They are used to deliver and improve tutoring under Article 6(1)(b) GDPR.
We use Matomo to analyse and improve our website. Matomo is self-hosted by edventure Studios GmbH. Information about page views, visit time, browser, operating system, referrer and interactions may be processed.
Matomo is loaded and used only after you have expressly consented to the Statistics category. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time for the future through the Privacy settings link in the footer.
Strictly necessary technologies operate the website and store your privacy choice. Matomo and its statistics technologies are disabled by default and activated only after express consent. Your selection is stored in a necessary first-party cookie and can be changed at any time through Privacy settings.
We currently do not actively embed YouTube videos. Future third-party embeds may transfer data to their provider and will be identified before activation.
With consent, contact details may be used for offers, new services and price changes. Consent can be withdrawn by email. Contractually necessary information is sent independently of marketing consent.
Hosting and storage use the website infrastructure described in section 2. PDFs are generated within our website application; no data is sent to an external PDF service for this purpose. Contract documents are sent to the supplied email address and our internal contract archive. The SMTP email service processes the recipient address, message content and PDF attachments. A mail outbox records delivery status and enables retries if delivery fails.
Zoho Books is planned for invoicing and receivables management. Checkout data is currently not transmitted automatically to Zoho Books. A future integration is intended to use the customer name, contact and billing address, and necessary contract, invoice and payment details. Before activation, this policy will be updated with the relevant recipient and, where applicable, international-transfer information.
Currently, bank transfer is the only available checkout payment method. Stripe and PayPal are not yet enabled, so checkout sends no data to these providers and collects no card details or PayPal credentials. Any required transfers will be explained before a future payment option is used.
The support, communication and authentication services described in this policy receive only data needed for their function. Other recipients may include legal and tax advisers and competent authorities where needed for contract performance, statutory duties or legitimate interests.
Contract and communication data is retained during the contractual relationship and afterwards only as required for statutory duties or specific outstanding claims. Tax-relevant contract records, invoices and accounting documents are generally retained for seven years from the end of the calendar year to which they relate (section 132 of the Austrian Federal Fiscal Code, BAO). Records needed for pending proceedings are retained beyond that period until the proceedings have concluded.
The same purpose-related periods apply to contract PDFs and supporting records; an immutable record does not mean indefinite retention. Data is deleted when its purpose ends and applicable retention duties expire. Learning materials follow the period in section 10. Consent-based data is deleted following withdrawal unless another legal basis requires continued storage.
We use appropriate technical and organisational safeguards, HTTPS encryption and restricted access to internal systems.
You may request access, correction, deletion, restriction, portability, object to processing, withdraw consent and complain to a data-protection authority. Contact office@edventure.studio.
In Austria, the Austrian Data Protection Authority is the relevant supervisory authority. Third-party sites are responsible for their own processing.
This policy may be updated when our processing, systems or legal requirements change. Last updated: 22 September 2026.
