Privacy Policy

Roles under the GDPR

Personal data of pupils and school staff is processed by Amosia Labs s.r.o. (see Contact below) as a processor within the meaning of Art. 28 of Regulation (EU) 2016/679 (GDPR). The controller of this data is the school using the Application.

The processing is governed by a separate data processing agreement concluded with each school. Concluding it is a precondition of starting operation — until then, no personal data of pupils is processed in the Application.

What data is processed

The Application processes the data the school's authorized staff enter into it: for pupils, the name and its stored variants used for pseudonymization, date of birth, an administrative note, class assignment, pedagogical observations, progress records and reflections; for school staff, the name, e-mail address, sign-in records (including IP address and browser details) and the audit trail of performed actions.

The data is processed solely for the purpose of providing the Application to the school. It is not used for any other purpose, and no marketing messages are sent.

Artificial intelligence

Free texts passed to an artificial intelligence system are first pseudonymized by the Application: the pupil's name and its stored variants (including nicknames and name forms added by teachers) are removed from the texts before they leave the Application, and no account identifiers are sent. The pseudonymized material is passed to the language-model provider — see Sub-processors below. Pseudonymized data nevertheless remains personal data and is treated as such.

AI outputs are advisory only, clearly marked, and decisions are always made by the teaching staff. The Application performs no automated individual decision-making within the meaning of Art. 22 GDPR.

Sub-processors

Further processors take part in providing the Application — third parties that process personal data on the provider's behalf. Their current overview, including purpose, data categories and processing location, is published in the sub-processors list.

Retention, export and erasure

Personal data is processed for the duration of the contract with the school. For the duration of the contract and for 30 days after its termination, the school may request an export of its data in a common machine-readable format (e.g. CSV or JSON). After this period, the provider erases personal data following the procedure of the data processing agreement.

Data subject rights

Rights under the GDPR — in particular the rights of access, rectification and erasure — are exercised by pupils, their legal guardians and school staff with the school as the controller. The provider assists the school in handling these requests under the data processing agreement, including materials for a data protection impact assessment (DPIA) and cooperation with the school's data protection officer.

Contact

The operator of the Application and the processor of personal data is Amosia Labs s.r.o., with its registered office at Vápenná 281, 790 64 Vápenná, Czech Republic, company ID (IČO): 29691419, registered in the Commercial Register kept by the Regional Court in Ostrava under file no. C 104354. Direct requests concerning personal data to your school as the controller; the school handles them with the provider following the data processing agreement.