Privacy Policy

This Privacy Policy explains how PEQUEDU processes personal data when you visit or use the PEQUEDU website and services.

Data Controller

PEQUEDU
Calle Riu Gorgos 3
03750 Pedreguer, Alicante
Spain

NIF/NIE: X2266810E
Email: support@pequedu.com

For privacy-related questions, requests or concerns, you can contact us at:

support@pequedu.com

PEQUEDU is responsible for determining the purposes and means of the processing of personal data described in this Privacy Policy, except where a third-party provider processes information independently under its own legal responsibility, such as certain payment-processing activities.

This Privacy Policy applies to personal data processed through:

• the PEQUEDU website;
• PEQUEDU account registration;
• PEQUEDU family accounts;
• Profiles created within an account;
• learning activities and progress;
• PEQUEDU games and interactive features;
• achievements, badges and rewards;
• PEQUEDU room and in-app features;
• customer support;
• bug reports;
• subscription and payment-related processes;
• security and fraud-prevention measures; and
• other services provided directly by PEQUEDU.

Some third-party services used by PEQUEDU may have their own privacy policies. Where this is relevant, we identify the relevant provider and explain its role.

PEQUEDU uses an adult-controlled account model.

The person registering an account is responsible for the account and the Profiles created within it.

An account can contain up to three Profiles.

Profiles are not independent PEQUEDU accounts.

The account holder controls account settings and Profile management and is responsible for determining who is authorised to use the Profiles within the account.

Certain sensitive account or Profile-management functions may be protected by a parental or account passcode.

PEQUEDU aims to collect only the information necessary to provide, secure and improve the service.

Depending on how you use PEQUEDU, this may include the following categories.

4.1 Account information

When you create a PEQUEDU account, we may process:

• email address;
• account authentication information;
• email-verification status;
• account status;
• language or interface preferences;
• information relating to legal acceptance; and
• information necessary to manage your account.

We do not require you to provide a real-world name in order to create a Profile.

4.2 Profile information

An adult account holder can create up to three Profiles.

A Profile may contain:

• a display name;
• a selected PEQUEDU avatar;
• learning progress;
• completed activities;
• achievements;
• badges;
• rewards;
• in-app items;
• room/customisation information; and
• other information generated through use of PEQUEDU.

The Profile display name does not have to be the user's real name.

PEQUEDU does not require a Profile to contain:

• a date of birth;
• age;
• email address;
• telephone number;
• physical address;
• payment information; or
• a real name.

We deliberately designed Profiles this way to minimise the amount of personal information associated with younger or other Profile users.

PEQUEDU is designed so that an adult creates and controls the account.

Children do not independently register PEQUEDU accounts.

The adult account holder creates and manages the Profiles used within the account.

PEQUEDU does not require the adult to provide a child's date of birth or age when creating a Profile.

A Profile may use a nickname, pseudonym or other display name rather than a child's real name.

PEQUEDU nevertheless processes information generated through use of the service, such as learning progress, completed activities, achievements and rewards, because this information is necessary to provide the personalised learning experience.

The adult account holder is responsible for creating and supervising the Profiles within their account and for ensuring that use of the service is appropriate for the people using those Profiles.

PEQUEDU applies data-minimisation and privacy-by-design principles to Profile information. This means that information that is not necessary for providing the learning service is not required merely because a Profile belongs to a child or younger user.

PEQUEDU processes information for specific purposes, including:

Providing the PEQUEDU service

We process account and Profile information so that we can:

• create and maintain accounts;
• provide access to PEQUEDU;
• provide Profiles;
• remember learning progress;
• provide games and activities;
• record achievements and rewards;
• provide personalised learning features; and
• maintain the PEQUEDU room and other in-app features.

Account security

We process information necessary to:

• authenticate users;
• verify email addresses;
• protect accounts;
• prevent unauthorised access;
• detect abuse;
• protect the service against automated attacks; and
• maintain the security of PEQUEDU.

Legal compliance

We may process information where necessary to comply with legal obligations, including accounting, taxation, consumer-protection and data-protection requirements.

Subscription and payment management

Where a user purchases a PEQUEDU subscription, information is processed to:

• establish the subscription;
• determine entitlement to the service;
• process subscription status;
• manage billing-related events;
• identify payment failures or cancellations; and
• maintain appropriate records relating to the contractual relationship.

Payment processing is performed through Stripe as described below.

Customer support

When you contact PEQUEDU, we process the information you provide in order to:

• respond to your enquiry;
• investigate technical problems;
• provide support;
• respond to account-related requests; and
• improve the reliability of the service where appropriate.

Depending on the purpose, PEQUEDU relies on different legal bases under applicable data-protection law.

Processing	Main legal basis
Creating and managing an account	Performance of the contract
Providing Profiles and learning functionality	Performance of the contract
Recording learning progress and achievements	Performance of the contract
Subscription administration	Performance of the contract
Payment/accounting records	Legal obligation and/or performance of the contract, as applicable
Email verification and account security	Performance of the contract and legitimate interests in securing the service
Fraud, abuse and security prevention	Legitimate interests and, where applicable, legal obligations
Customer support	Performance of the contract and/or legitimate interests, depending on the request
Legal acceptance records	Legitimate interests and legal obligations to demonstrate compliance
Non-essential cookies or similar technologies, where used	Consent
Optional marketing communications, if introduced	Consent where required

PEQUEDU does not use consent as a substitute for another appropriate legal basis where another legal basis applies.

Where consent is required, it will be requested separately and can be withdrawn.

When you register, PEQUEDU processes your email address to create and secure your account.

PEQUEDU uses an email-verification process to confirm that the person registering has access to the supplied email address.

Verification information may be stored temporarily or as necessary to maintain the security and integrity of the registration process.

PEQUEDU may also process security information relating to registration attempts, including information necessary to prevent automated or abusive registrations.

PEQUEDU uses a server-side CAPTCHA mechanism during registration to help prevent automated account creation and abuse.

The current CAPTCHA is designed to operate using PEQUEDU's own server-side infrastructure rather than requiring a third-party CAPTCHA provider.

The CAPTCHA challenge and its answer are processed temporarily for verification purposes.

The expected CAPTCHA answer is not intentionally exposed to the browser.

Security information associated with registration may also be processed where necessary to protect PEQUEDU against abuse.

During registration, the account holder is required to confirm acceptance of the PEQUEDU Terms & Conditions and acknowledge the Privacy Policy.

PEQUEDU records:

• the account to which the acceptance relates;
• the document type;
• the document version;
• the date and time of acceptance;
• the IP address; and
• the user-agent information associated with the acceptance.

This information is used to maintain an auditable record of the contractual and privacy information accepted during registration and to demonstrate which version of the documents applied at that time.

PEQUEDU does not store the entire text of the Privacy Policy or Terms & Conditions as part of each acceptance record.

PEQUEDU processes learning-related information associated with each Profile.

This may include:

• completed games;
• learning progress;
• completed activities;
• achievements;
• badges;
• rewards;
• Leaves and other in-app balances;
• purchased or earned in-app items;
• room placements; and
• other information required to provide the Profile's learning experience.

This information is used to allow PEQUEDU to remember progress and provide continuity between learning sessions.

It is not used to create an unrelated advertising profile of the Profile user.

PEQUEDU uses Stripe for subscription payment processing.

When you subscribe, Stripe processes payment information required to establish and manage the subscription.

PEQUEDU does not intentionally store complete payment-card numbers or security codes in its own application database.

PEQUEDU receives and processes information necessary to determine the status of the subscription and the user's entitlement to PEQUEDU.

This may include information such as:

• Stripe customer or subscription identifiers;
• subscription status;
• selected subscription plan;
• trial status;
• billing status;
• relevant payment status;
• cancellation status; and
• other information necessary to administer the subscription.

Stripe may process personal data under its own privacy documentation and legal responsibilities.

You should also review Stripe's privacy information presented during checkout and available through Stripe.

PEQUEDU uses verified subscription information to determine whether an account is entitled to Premium access.

The PEQUEDU application does not rely solely on information supplied by the user's browser to determine whether an account has paid.

Subscription information may be updated when PEQUEDU receives and verifies relevant information from Stripe.

If a subscription expires, is cancelled, becomes invalid or otherwise no longer provides entitlement to Premium access, PEQUEDU may restrict Premium access in accordance with the applicable subscription terms.

PEQUEDU may offer a special Founding 500 subscription.

Information relating to qualifying subscriptions may be processed to determine whether the account qualifies for the Founding 500 offer.

Founding status may be associated with the relevant subscription/account records.

If a Founding 500 subscription is cancelled, the associated founding status may be permanently lost in accordance with the Terms & Conditions.

PEQUEDU does not use the Founding 500 information for unrelated purposes.

PEQUEDU may offer promotion codes providing discounts or, where specifically configured, free access.

Information necessary to apply and administer a promotion may be processed by PEQUEDU and/or Stripe.

Promotion codes may have eligibility requirements, usage limits, expiry dates or other conditions.

PEQUEDU does not treat the use of a promotion code as permission to use personal data for unrelated marketing.

PEQUEDU may use cookies or similar technologies that are necessary for the operation, security and functionality of the service.

These may include technologies required to:

• maintain secure sessions;
• remember necessary preferences;
• protect account access;
• provide requested functionality; and
• operate the website.

Where PEQUEDU uses cookies or similar technologies that require consent under applicable law, consent will be requested before those technologies are used for the relevant purposes.

Non-essential cookies will not be presented as necessary merely to encourage acceptance.

For complete information about the cookies and similar technologies actually used by PEQUEDU, please see the Cookie Policy.

PEQUEDU may in the future use services such as analytics tools, social-media integrations, review platforms or advertising technologies.

No such service is covered by this Privacy Policy merely because PEQUEDU may consider using it in the future.

If PEQUEDU introduces a service that involves additional processing of personal data, the relevant privacy information and, where required, cookie consent mechanisms will be updated before the relevant processing begins.

PEQUEDU will not treat the publication of a future possibility as consent to process personal data.

PEQUEDU may share or make personal data available to service providers where this is necessary to operate the service.

Depending on the services actually used, these may include:

• hosting and infrastructure providers;
• email and communications providers;
• payment and subscription providers such as Stripe;
• technical service providers;
• security providers where necessary;
• professional advisers where necessary; and
• public authorities or other recipients where required by law.

PEQUEDU seeks to ensure that service providers process personal data only for appropriate purposes and under appropriate contractual or legal arrangements where required.

PEQUEDU does not sell personal data.

PEQUEDU is operated from Spain and uses hosting infrastructure located in Germany.

The fact that the PEQUEDU website uses a .com domain does not change the applicable data-protection obligations.

Where PEQUEDU uses providers that process information outside the European Economic Area, the applicable legal safeguards required by data-protection law will be considered and implemented where necessary.

Specific third-party processing locations may depend on the services used by PEQUEDU at a particular time.

PEQUEDU aims to keep personal-data processing within the European Economic Area where reasonably possible.

Some third-party providers used to operate online services may process information outside the European Economic Area.

Where such processing occurs, PEQUEDU will rely on an appropriate legal mechanism under applicable data-protection law, such as an adequacy decision, Standard Contractual Clauses or another legally recognised safeguard, where required.

Information about significant third-party processing is provided in the relevant privacy information and, where applicable, the provider's own privacy documentation.

PEQUEDU does not keep personal data indefinitely.

Retention depends on the purpose for which the information was collected.

In general:

Active accounts

Account and Profile information is retained while the account is active and for as long as necessary to provide the service.

Deleted accounts

When an account is deleted, PEQUEDU will delete or anonymise associated personal information where appropriate, subject to information that must or may lawfully be retained.

Learning information

Learning progress, achievements, rewards and related Profile information are retained while necessary to provide the learning service and are handled according to the account's lifecycle.

Legal and accounting records

Certain information may need to be retained for periods required by tax, accounting, consumer-protection or other applicable legal obligations.

Legal acceptance records

Records showing acceptance of Terms & Conditions and the Privacy Policy may be retained for as long as reasonably necessary to demonstrate the applicable contractual and legal history and to establish, exercise or defend legal claims.

Security records

Security and technical logs may be retained for as long as reasonably necessary for security, fraud prevention, troubleshooting and legal purposes, after which they are deleted or anonymised where appropriate.

PEQUEDU applies the principle that personal information should not be retained for longer than necessary for the relevant purpose.

Depending on the circumstances and applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• request portability of data where the legal requirements are met;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a competent data-protection supervisory authority.

To exercise your rights, contact:

support@pequedu.com

We may need to verify your identity before fulfilling certain requests in order to protect your account and personal information.

You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that your personal data has been processed unlawfully.

For PEQUEDU, the relevant Spanish supervisory authority is:

Agencia Española de Protección de Datos (AEPD)

Website: www.aepd.es

This does not affect any other administrative or judicial remedy that may be available to you.

For privacy questions, data-protection requests or concerns, please contact:

PEQUEDU
Calle Riu Gorgos 3
03750 Pedreguer, Alicante
Spain

Email: support@pequedu.com

We encourage you to contact us first where you have a question or concern about how your information is being processed so that we can investigate and, where appropriate, resolve the matter promptly.

Nothing in this Privacy Policy limits any statutory right to contact a supervisory authority or exercise any other legal remedy available under applicable law.

PEQUEDU implements technical and organisational measures intended to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• accidental loss;
• destruction;
• alteration; and
• other unlawful or unauthorised processing.

Security measures include, where appropriate:

• authenticated account access;
• server-side authorisation;
• protected sessions;
• access controls;
• server-side validation;
• secure password hashing;
• protection against unauthorised direct access to protected learning media;
• CAPTCHA and anti-abuse mechanisms;
• database access controls;
• restricted server-side resources; and
• ongoing security improvements.

No internet service can guarantee that security incidents will never occur. PEQUEDU nevertheless aims to maintain appropriate security measures proportionate to the risks associated with the service.

If PEQUEDU becomes aware of a personal-data breach, it will assess and respond to the incident in accordance with applicable data-protection law.

Where notification to a supervisory authority or affected individuals is legally required, PEQUEDU will make the required notification within the applicable timeframe.

PEQUEDU is designed with data minimisation and privacy considerations from the beginning.

Examples include:

• Profiles do not require a real name;
• Profiles do not require a date of birth or age;
• Profiles do not require an email address;
• Profiles do not require payment information;
• Profiles do not require a telephone number;
• account and Profile functions are separated;
• sensitive account functions are protected;
• learning data is associated with the relevant Profile;
• Premium access is determined server-side;
• payment-card details are handled through the payment provider rather than stored directly by PEQUEDU; and
• unnecessary personal information is not requested simply because it might be useful in the future.

This reflects the GDPR principle of data protection by default.

PEQUEDU does not use personal data to make decisions that produce legal or similarly significant effects on users through automated decision-making.

PEQUEDU may use learning progress and activity information to provide personalised learning features and to determine in-app progress, achievements or rewards.

This type of personalisation is part of the requested learning service and is not used to make decisions about a person's legal rights or eligibility outside PEQUEDU.

PEQUEDU does not sell customer personal data.

PEQUEDU does not use Profile learning information to create advertising profiles of Profile users.

If PEQUEDU introduces optional marketing communications in the future, the relevant legal basis and consent mechanism will be provided where required.

Users will not be required to agree to unrelated marketing in order to use the core PEQUEDU learning service.

PEQUEDU may contain links to third-party websites or services.

When you follow a link to a third-party website, that website operates under its own privacy and cookie policies.

PEQUEDU is not responsible for the privacy practices of third-party websites that it does not control.

You should review the relevant third party's privacy information before providing personal information to it.

PEQUEDU may update this Privacy Policy when:

• the service changes;
• the categories of information processed change;
• new service providers are introduced;
• legal requirements change;
• security practices change; or
• other circumstances require an update.

The current version will be made publicly available through the PEQUEDU website.

Where an update materially affects existing users or requires renewed consent under applicable law, PEQUEDU will take the appropriate steps required by law.

The document version and update date appear at the beginning of this Privacy Policy.

PEQUEDU provides this Privacy Policy in:

• English
• German
• Spanish
• Valencian

English is the master language version used by PEQUEDU for the interpretation of the document.

Translations are provided to make the information accessible to users in the languages supported by PEQUEDU.

This language provision does not limit any mandatory rights or protections granted by applicable law.

If you believe that any aspect of PEQUEDU's privacy practices does not comply with applicable law, we encourage you to contact us at support@pequedu.com before initiating formal proceedings where legally permissible.

This gives PEQUEDU the opportunity to investigate the matter and, where appropriate, correct or resolve it promptly.

Nothing in this section limits any statutory right to contact the AEPD, another competent supervisory authority, a court or other competent body, or to exercise any other legal remedy available under applicable law.

This Privacy Policy describes PEQUEDU's intended and actual processing based on the services and technologies currently used by PEQUEDU.

PEQUEDU will not rely on this document to justify processing that is not actually carried out.

Where new technologies, third-party services, analytics, advertising systems or other processing activities are introduced, PEQUEDU will review and update its privacy and cookie information as appropriate before or when the relevant processing begins.