PRIVACY POLICY AND COOKIE POLICY

Voimassa alkaen: 7.8.2016
Rekisterinpitäjä: Polku Learning
Y-tunnus:
Yhteystiedot: info@polkulearning.com
Verkkosivusto: polkulearning.com

This Privacy Policy explains how Polku Learning processes personal data in connection with its website, Open Digikalenteri, purchases, customer service and mailing list.

1. Personal data we process

We may process the following personal data:

User account information

• name

• email address

• username

• account identifier

• login method and login times

• account status.

Polku Learning does not see or store the user's password in readable form.

Purchase and payment information

• purchased product

• order date and order identifier

• amount paid

• payment status

• billing and receipt information

• Stripe payment identifier.

Polku Learning does not store complete payment card details. Payment card details are processed by Stripe.

Information saved in Open Digikalenteri

• calendar entries

• timetables

• subjects

• teaching plans

• meetings

• tasks

• notes

• other information added to the calendar by the user.

Customer service and communication information

• messages sent to Polku Learning

• customer support requests

• complaints

• requests concerning account deletion or data protection rights.

Mailing list information

• email address

• marketing consent

• time at which consent was given

• technical information relating to message delivery and unsubscribing.

Technical information

• IP address

• browser and device type

• operating system

• login and usage times

• session and log information

• technical information relating to security and errors

• information stored using cookies and similar technologies.

2. Sources of personal data

Personal data is mainly obtained from:

• the user

• the user's device and use of the service

• Stripe

• an authentication provider if the user selects an external login method

• technical service providers.

If the user chooses to sign in with a Google account, Polku Learning receives the basic information needed for authentication according to the user's choice and the settings of the authentication service.

3. Purposes and legal bases of processing

Performance of a contract

Personal data is processed to:

• create and manage user accounts

• provide the purchased Open Digikalenteri service

• enable authentication

• save and display calendar information

• process orders and payments

• send messages relating to the contract

• provide customer support requested by the user.

Without this information, Polku Learning cannot provide the account or purchased service.

Legal obligation

Personal data is processed when necessary:

• for accounting purposes

• to comply with consumer protection obligations

• to comply with a lawful request from an authority.

Consent

Consent is used as the legal basis for:

• joining the mailing list

• sending marketing messages

• using any non-essential cookies.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Legitimate interests

Personal data may be processed on the basis of legitimate interests to:

• maintain service security

• prevent fraud and misuse

• investigate technical errors

• establish, exercise or defend legal claims

• manage the ordinary customer relationship.

In these situations, Polku Learning's legitimate interests are assessed against the user's rights and privacy.

4. Information saved in Open Digikalenteri

Open Digikalenteri is intended for planning teaching and other work. The calendar must not be used to store:

• health information

• national identification numbers

• passwords

• confidential pupil or student records

• disciplinary or student welfare information

• other sensitive or confidential personal data.

When making entries relating to pupils or students, users should use general descriptions, initials or other identifiers that do not directly identify the person.

The user is responsible for ensuring that there is a lawful basis for processing any personal data added to the calendar.

5. Payments and Stripe

Payments are processed by Stripe. Stripe may process:

• payment card details

• billing details

• email addresses

• IP addresses

• technical payment information

• information needed to prevent fraud.

Polku Learning receives the information needed to manage the payment, order, receipt and customer service. Stripe also processes some information as an independent controller in accordance with its own legal obligations and privacy practices.

6. Service providers and recipients

Polku Learning uses the following service providers:

• Hostinger, for website hosting, website forms and related technical services

• Base44 and Wix, for the Open Digikalenteri platform, user management, authentication, data storage and technical maintenance

• Stripe, for payment processing

• Google, if the user selects Google authentication

• other necessary subprocessors used by the service providers listed above.

Service providers process personal data on behalf of Polku Learning to perform agreed services. Some providers may also process certain information as independent controllers under their own privacy policies.

Personal data may also be disclosed to an authority where required by law or by a lawful request.

Polku Learning does not sell personal data.

7. Transfers outside the EEA

The Base44 platform may store and process Open Digikalenteri data in the United States. Other service providers or their subprocessors may also process personal data outside the European Union or European Economic Area.

Personal data is transferred outside the EEA only where there is a lawful transfer mechanism. Safeguards may include:

• an adequacy decision adopted by the European Commission

• the EU-US Data Privacy Framework

• Standard Contractual Clauses approved by the European Commission

• another safeguard permitted under data protection law.

Further information about the applicable transfer mechanisms may be requested from info@polkulearning.com.

8. Retention periods

Personal data is retained only for as long as necessary for the purposes described in this policy.

• User account and calendar information is retained for as long as the account remains in use.

• When an account is deleted, account and calendar information is removed from active systems within a reasonable period. Information may remain in technical backups for the period specified in the service provider's deletion procedures.

• Order, payment and accounting information is retained for the period required by accounting legislation.

• Customer service messages are retained for as long as necessary to deal with the matter and any related legal claims.

• Security and log information is retained for as long as necessary to protect the service and investigate misuse.

• Mailing list information is retained until the user withdraws consent or the mailing list is discontinued. Minimum information about an opt-out may be retained to ensure that no further marketing messages are sent.

Information may be retained for longer where required by law, an authority or the handling of a legal claim.

9. Data security

Polku Learning protects personal data using appropriate technical and organisational measures.

These measures may include:

• encrypted connections

• personal user accounts

• access restrictions

• reliable service providers

• log monitoring

• system maintenance and security updates.

Online services always involve some security risks. Users must therefore not save sensitive or confidential information in Open Digikalenteri.

10. Data protection rights

Subject to applicable data protection law, users may have the right to:

• receive information about the processing of their personal data

• access their personal data

• request correction of inaccurate or incomplete information

• request deletion of personal data

• request restriction of processing

• object to processing based on legitimate interests

• object to direct marketing

• receive data they have provided in a portable format where this right applies

• withdraw consent

• lodge a complaint with a supervisory authority.

These rights are not absolute in every situation. For example, accounting information cannot be deleted before the statutory retention period has ended.

Requests concerning data protection rights can be sent to info@polkulearning.com. Polku Learning may request additional information where necessary to verify the identity of the person making the request.

The Finnish supervisory authority is the Office of the Data Protection Ombudsman:

Website: tietosuoja.fi
Email: tietosuoja@om.fi
Postal address: PO Box 800, FI-00531 Helsinki, Finland

11. Marketing and the mailing list

Messages necessary for the service or a completed purchase may be sent without marketing consent. These may include order confirmations, receipts, authentication messages, security notices and information about material changes to the service.

Marketing messages and information about new applications are sent by email only with the user's consent.

Users may unsubscribe at any time by using the unsubscribe link in the message or by contacting info@polkulearning.com.

Using the service or purchasing Open Digikalenteri does not require the user to join the mailing list.

12. Automated decision-making

Polku Learning does not use personal data to make decisions that produce legal or similarly significant effects concerning users.

13. Changes to this Privacy Policy

Polku Learning may update this Privacy Policy if its processing activities, services or applicable legislation change.

The current version will be published on the website. Users will be informed in a reasonable manner of material changes affecting them.

COOKIE POLICY

This Cookie Policy applies to polkulearning.com and Open Digikalenteri at kalenteri.polkulearning.com.

1. Cookies and similar technologies

Cookies are small files or pieces of information stored on a user's device by a website.

The service may also use similar technologies, such as browser storage. In this policy, the general term cookies also covers these technologies.

2. Essential cookies

Essential cookies and similar technologies may be used to:

• authenticate users

• maintain logged-in sessions

• operate user accounts

• protect service security

• provide shopping cart and payment functions

• operate forms

• remember language and cookie preferences

• prevent technical errors.

Essential cookies are necessary to provide a service requested by the user. Separate consent is not requested for their use.

Blocking essential cookies in browser settings may prevent authentication, payment or other parts of the service from working.

3. Analytics and marketing cookies

At the effective date of this policy, Polku Learning has not enabled Google Analytics, Meta Pixel, Hotjar or other analytics or marketing cookies on its website.

If non-essential analytics or marketing cookies are introduced later:

• they will not be set before the user gives consent

• the user will be able to accept or reject them

• rejecting cookies will be as easy as accepting them

• the user will be able to withdraw consent later

• their purposes, providers and expiration periods will be stated in the cookie settings.

New non-essential cookies will not be introduced merely by changing this policy. Appropriate consent management must be in place before they are used.

4. Third-party cookies

Hostinger, Base44, Stripe and an authentication provider selected by the user may use their own essential cookies to operate the website, application, authentication or payment process.

When the user enters a third-party service, that provider's own privacy and cookie policies may apply.

5. Changing cookie choices

Users can change their consent concerning non-essential cookies through the website's cookie settings.

Cookie settings: [add a permanent link or button]

Cookies can also be removed through browser settings. Blocking cookies through the browser may affect the operation of the service.

6. Changes to this Cookie Policy

Polku Learning will update this Cookie Policy if the cookies or similar technologies used on the website or in Open Digikalenteri change.

The current version will be published on the website.