Privacy policy

1. Who we are and how to reach us

Operator of Spoudi CRM: [full name: sole proprietor or company], registration no. [ID], address [legal address].

For personal data questions write to support@spoudi.io. Responsible person: [name or position, if any].

2. Terms

• Service: the Spoudi CRM system and the website through which it is provided.
• Institution: a school, kids' center, studio or chain that uses the Service and is our customer.
• User: a staff member of an Institution, or a parent or legal guardian with an account in the Service.
• Institution Data: personal and other data of students, parents and staff that the Institution enters into the Service.

3. What data we process

Website visitors and demo requests:

• name, email, phone, organization name and type, number of students, the message you wrote;
• technical request data (IP address, browser type, date and time) in server logs;
• theme and language settings in your browser's local storage.

User accounts:

• name, email or phone, role in the Institution, password hash, sign-in data and actions in the system (change log).

Institution Data entered into the Service:

• about students: name, date of birth, group, attendance, grades, subscriptions, documents, teacher notes;
• about parents or guardians: name, contacts, link to the student, payments, balance, consents;
• about staff: name, contacts, position, schedule, data for payroll calculation;
• the Institution's financial records (income, expenses, debts).

We do not ask Institutions to enter health data, religious or political beliefs or other special categories, except where necessary for the educational process and the Institution has a legal basis.

4. Children

Children's data is entered into the Service by the Institution or their parents. We do not create accounts for children and do not communicate with children directly. Only adults may use the parent portal.

The Institution is responsible for having parental consent or another legal basis for processing a child's data. Spoudi provides tools for this: consent records and access separation by role and branch.

We do not use children's data for advertising, profiling or sale.

5. Why and on what basis

• To answer a request, run a demo, prepare a proposal: your consent and steps before entering a contract.
• To provide the Service to the Institution and Users: performance of the contract (Public Offer) and the Institution's instructions.
• Support, security, abuse prevention, change log: our legitimate interest and security requirements.
• Legal compliance (accounting, replies to authorities where the law requires): legal obligation.
• Service notices: contract and our legitimate interest. We send marketing emails only with your consent.

6. How we process Institution Data as a processor

We process Institution Data only on the Institution's documented instructions (settings and actions in the Service, the contract, the terms in Appendix 1 of the Public Offer). We do not use it for our own purposes.

Only Spoudi staff who need it to support the Service have access, under a confidentiality obligation.

We forward Users' requests about Institution Data (access, correction, deletion) to the Institution and help it fulfil them.

7. Who we share data with

We do not sell personal data or share it for advertising. To run the Service we use vetted providers, each processing data only for its own service:

• server hosting and backups: [name, country];
• email delivery: [name, country];
• payment services LiqPay, WayForPay, Monobank: only when the Institution has enabled online payment, within the payment;
• AI provider for the AI assistant: [name, country]. Data is sent only when a User makes a request and is not used to train models [confirm in provider terms].

We provide the current list of providers on request. We may also disclose data on the demand of an authorized body where the law provides.

8. Transfers abroad

If a provider is located outside Ukraine, we transfer data only to one that ensures a level of protection no lower than Ukrainian law requires (contract, standard clauses, adequate jurisdiction). Countries: [list].

9. How we protect data

• access separation by role, branch and group;
• change log for important data;
• encrypted connections (HTTPS) and password hashing [and encryption at rest: to be confirmed];
• regular backups and restricted server access;
• incident response: if a breach creates a risk to people's rights, we notify the Institution without undue delay and, where required, the relevant authority [deadline: 72 hours].

No system is 100% secure. We keep improving protection, and you should keep your passwords safe and not share access.

10. How long we keep data

• Demo requests: up to [12] months after the last contact or until you ask for deletion.
• Institution Data: while the contract is in force. After it ends the Institution can export data for [30] days, then we delete it from active systems, and from backups within [90] days, unless the law requires otherwise.
• Server logs: up to [90] days.
• Accounting and financial documents: as long as the law requires.

11. Your rights

Under the Law of Ukraine "On Personal Data Protection" (and GDPR for people in the EU) you have the right to:

• know what data about you is processed and receive a copy;
• require correction of inaccurate data;
• require deletion or restriction of processing where there are grounds;
• object to processing and withdraw consent (this does not affect lawfulness before withdrawal);
• receive your data in a portable format;
• complain to the Ukrainian Parliament Commissioner for Human Rights.

If your data was entered into the Service by an Institution (you are a parent, student or employee), contact the Institution. If you contact us, we will forward the request. We respond to requests within [30] days.

12. Cookies and local storage

Cookies and similar technologies (browser local storage) are of two kinds:

• necessary: theme and language settings, technical session cookies of the Service dashboard. They are needed for the site to work, so they do not require consent;
• optional (analytics, marketing): [not used at the moment]. If we add them, they will be switched on only after your consent in the banner, you will be able to refuse as easily as you agree, and change your choice at any time via "Cookie settings" at the bottom of the page.

We ask for consent again after about [6] months or after material changes. Without your consent, optional scripts are not loaded.

13. Changes to this policy

We may update this Policy. The current version is always on this page with its date. We notify Institutions of material changes by email or in the Service.