Terms and Conditions of Data Protection of eKool

These terms and conditions of data protection regulate the processing of the personal data of the users of the study information system of the eKool located at the web site www.ekool.eu (the users are hereinafter referred to as you) by eKool AS (registry code: 11160451, address: Telliskivi 60/1, 10412 Tallinn; hereinafter referred to as eKool or we). Personal data means any information relating to you (incl. name, contact details, information on studies, activities logs, etc.) and the processing of personal data contains any operation performed therewith (incl. consultation, storage, use, disclosure, etc.).

The protection of personal data is very important to eKool and we view the issue with the utmost concern. We shall process your personal data in compliance with the obligations arising from the legislation applicable in the European Union and in the Republic of Estonia and adhering to the principles of secure processing of personal data. You may contact the data protection officer of eKool via e-mail at gdpr@ekool.eu.

eKool processes your personal data as the controller to enable the use of the eKool information system as well as for the purposes relating to the services we provide you with. In addition, eKool processes your personal data as the processor when acting on behalf and under the responsibility of the school that designated you the role for the use of the eKool information system (hereinafter: the school).

Processing of Personal Data under Responsibility of eKool

Upon the subscription as the user of the eKool information system, you are requested to disclose certain personal data without which it is not possible to use the eKool information system. Your personal data shall be processed by eKool, first and foremost, to prepare and perform the contract concluded with you for the use of the eKool information system (the Terms and Conditions of Use of eKool can be found here). We shall also process your personal data on the basis of our legitimate interest related to the promotion of our business activities and provision of better service or your separate consent. In particular, your personal data may be processed by eKool for the following purposes:

• to identify an individual;
• to enable the use of the eKool information system (incl. to calculate and settle the fees);
• to perform and protect the rights of eKool arising from the contract concluded for the use of the eKool information system;
• to manage and develop the eKool information system and the services we provide as well as to devise new solutions;
• to analyse the functioning of the eKool information system and the applications related thereto as well as to devise and implement amendments and new solutions;
• to control and, if necessary, amend or supplement the data entered in the eKool information system on your request, e.g. to provide you with a help desk service;
• to assess and prevent potential business risks or damages related to the provision of the service;
• to transmit messages related to the use of the eKool information system and messages of educational content;
• to transmit general marketing communications promoting eKool and our services. You can decline the referenced communications according to the instructions displayed with each message;
• to enable you to file, via the eKool information system, requests or make other declarations of intent to receive services (e.g. insurance service) offered by third parties. Thereby we rely on your request for consuming the respective service or receiving an offer in respect of it, in our legitimate interests in extending the possibilities of use of the eKool information system and, in appropriate cases, on a legal basis arising from law;
• to display the advertisements and marketing communications appropriate for you. The processing of personal data for the referenced purpose is based on our legitimate interest consisting of our wish to enable the eKool information system to be used free of charge (except for the paid additional services set out in the price list) and, at the same time, to ensure that the displayed advertisements are appropriate, suitable and useful for you. By implementing the referenced practice we also wish to avoid overloading the eKool information system with marketing content that is useless and distracting for our users. We thus consider your affiliation with users of the same or similar roles, sex, age, class or school district as well as with users related to the same school when displaying various advertisements and marketing communications. Advertisements and marketing communications shall not be displayed if you have activated the respective additional paid service.

For the above purposes, the following categories of personal data may be processed by eKool:

• identification and contact data (incl. given name and surname, personal identification code, address, telephone number, e-mail address);
• data related to the user account of the eKool information system (incl. user name and password);
• consents or declarations of intent related to the processing of personal data or the use of the eKool information system;
• data related to the role(s) designated to you by the school;
• data related to the contracts concluded for the use of additional services;
• access log of the eKool information system;
• data related to the queries to the help desk;
• data relating to the user preferences of the eKool information system (incl. data relating to how actively the services are used, service preferences and page views of particular parts of the web sites, etc.);
• data related to the categorisation or segmentation of the users on certain grounds;
• assessments of tasks and lessons related to the learning activities and conclusions of the analysis related thereto;
• if you have submitted your request for consuming a service offered by a third party via the eKool information system, the data necessary in connection with the entry into a respective service contract (e.g. the data necessary for receiving an insurance offer and entering into an insurance contract (incl. the destination and dates of a trip)).

Processing of Personal Data under Responsibility of School

The School shall process your personal data by using the eKool information system to perform a task carried out in the public interests (to provide an educational service) and fulfil their statutory obligations. Personal data shall be processed on behalf and under the responsibility of the school in the eKool information system for the following purposes inherent to the activities of the school:

• to manage the learning process in the school and the collection and storage of the personal data required by law in relation thereto;
• to support cooperation between the school and a local government to the extent provided by law;
• to enable information on studies to be accessed by a pupil, parent, legal representative or other person designated by the school;
• to support the learning process through the analytics of the learning results;
• to support communication and cooperation between home and school.

For the above purposes, the following categories of personal data shall be processed by the school in the eKool information system:

• identification and contact data (incl. given name and surname, personal identification code/date of birth, address, telephone number, e-mail address);
• data related to a person (e.g. sex, relation to a pupil, a role designated in the eKool information system);
• data related to learning, learning results and behaviour (e.g. data on enrolment and status of the studies, subjects, curriculum, grades, certificate of developmental assessment, class, parallel, data related to attendance, data on decrees, notices, data on decisions of the teachers' council, performance reviews and discussions) and
• other data necessary to organise the activities of an educational institution (e.g. data on meals, food preferences, attached documents, notes made by the school and the number, date of issue, school and access log of the school card (an electronic student or school card issued to pupils)).

Please note that in addition to the processing of personal data in the eKool information system in accordance with the Terms and Conditions of Data Protection, your personal data shall be processed by the school pursuant to the aims, rules and principles established by them. To obtain further information thereon, please contact the school.

Exercise of Rights Related to Processing of Personal Data

As a data subject, you have the following rights:

• the right to receive information on whether and what kind of your personal data are processed by eKool in the course of their activities as well as how the data are processed. To a certain extent, your personal data, privacy settings and the roles related to the schools can also be accessed on the profile page of the eKool information system. Access to the information on studies is granted in accordance with the roles designated to you by the school: a pupil can access the information on their studies, and a parent, legal representative or other person designated by the school can access the information on the studies of the pupil related to them. Any amendments made to the information on studies (incl. the erasure and rectification thereof) are accessible in the eKool information system within 30 days of the amendment. For the ongoing school year, full information on grades, attendance, notices, description of the classes and discussions can be accessed. For the previous school years, only the concluding grades can be accessed. If the role designated to you is terminated by the school, the School shall lose their access to the personal data contained in your profile. Personal data shall only be processed for the purposes they were collected.
• the right to request the rectification, specification or supplementation of your personal data, if they are incorrect, deficient or insufficient. To a certain extent, your personal data may be amended and supplemented on the profile page of the eKool information system. However, you cannot amend your name or personal identification code when in a pupil role as these data are connected to the information related to the studies held by the schools. Please contact the school to amend the information related to studies held by them.
• the right to request the erasure of your personal data. First and foremost, your personal data may be erased if, for example, eKool or the School no longer need your personal data for the purposes described in these Terms and Conditions of Data Protection or for other lawful purposes, or if your personal data are processed by eKool based on your consent and you withdraw your consent, or if your data have been unlawfully processed;
• the right to object to the processing of your personal data. First and foremost, you may object to the processing of your personal data if the data are processed on the basis of the legitimate interest of eKool or in relation to profiling and direct marketing. To lodge an objection to the processing of personal data, you will need to log in to the eKool in a secure way (by using an ID card, a mobile ID, a smart ID or bank links). We shall respond to your objection within one month of the lodging thereof.
• the right to request the restriction of processing of your personal data. First and foremost, you may request the restriction of the processing of your personal data if you have disputed the accuracy of your personal data; eKool or the School no longer need your personal data to provide you with the educational service, but you do not wish the data to be erased; or if you object to the processing of the data;
• the right to have your personal data transmitted to another controller is applicable if eKool processes the personal data you have disclosed to us based on your consent, or in relation to a contract concluded with you or in the preparation thereof. Upon the transmission of the data, the personal data can be transmitted in a machine-readable format directly to another processor you have indicated. The information on studies related to the school shall not be contained in the transmissible data as the processing thereof is based on the performance of a public task of the school . If necessary, these data shall be transmitted in agreement with the educational institution. To request the transmission of personal data, you will need to log in to the eKool in a secure way (by using an ID card, a mobile ID, a smart ID or bank links). The data shall be issued within one month of the filing of the request. The request can be filed free of charge but in the case of unfounded or excess requests, eKool may demand a fee or decline the request.
• the right to submit other requests or applications related to the processing of your personal data or to request additional information thereon.

To a certain extent and pursuant to the above, you can exercise your rights in the eKool information system independently. Failing that, you may request to exercise your rights by sending a digitally signed query to the e-mail address gdpr@ekool.eu or to the postal address Telliskivi 60/1, Tallinn, 10412.

Please note that your rights relating to the processing of personal data are not absolute and that in certain cases the rights of other persons or the legitimate interests and/or obligations of eKool or the school may restrict the exercise of your rights.

eKool wishes to ensure that your personal data are processed lawfully, transparently and respecting your rights and shall take reasonable measures to solve your objections and requests. If, in your opinion, the performance of eKool is not sufficient or your rights relating to the processing of your personal data are otherwise compromised, you have the right to contact the supervisory authority, namely the Data Protection Inspectorate, to protect your rights.

Storage of Personal Data in eKool Information System

Your personal data are stored in the eKool information system until your account is closed. The account can be closed on the profile page. To close the account, you will need to log in to the eKool in a secure way (by using an ID card, a mobile ID, a smart ID or bank links). After the account has been closed and the personal data related thereto erased, neither the account nor the personal data can be restored. However, you can add a new user account using the same user ID.

If you have not logged in to the eKool for at least five years and you have no active roles in any of the schools, your user account shall be closed and your personal data erased. The passive accounts shall be closed on 1 August each year.

In place of erasing your personal data, eKool may render the data anonymous, i.e. process the data in a manner that shall prevent you from being identified.

Regardless of the above, your personal data processed by eKool under the responsibility of the school as well as the information on your access log to the eKool information system and the discussions you have initiated and supplemented shall not be erased from the eKool information system upon the closure of the account. We shall store your access log to the eKool for five years. The personal data processed under the responsibility of the school shall be erased upon the expiry of the deadlines established for the storage thereof by the School or law.

Transfer of Personal Data to Third Parties

For the purposes of the processing of the personal data established in these Terms and Conditions of Data Protection and in relation thereto, your personal data may be transferred to the following third parties:

• cooperation partners of eKool that provide us with the service of processing personal data or any service related thereto (e.g. providers of data communication services, post delivery service, archiving, etc.) provided that these persons comply with the necessary organisational, physical and IT requirements to keep the personal data confidential and protected. The referenced third parties are the processors of personal data who shall have the right to process the personal data only on the basis of the instructions of eKool, to the extent and in the manner necessary for the provision of the respective service, and in compliance with the requirements established for the processing of personal data in the applicable legislation;
• consultants or other persons providing eKool with services (e.g. auditors, legal and financial advisers, law firms or other persons) who process the personal data in the course of providing their services either as processors with the authorisation from eKool, or as controllers on an autonomous legal basis, provided that the respective persons ensure the compliance with the requirements established for the processing of personal data in the applicable legislation;
• as a summary statement to the operators of schools and the Ministry of Education and Research;
• to other third parties to exercise and protect the rights of eKool (e.g. to the provider of debt collection services upon an infringement of a contract concluded for the use of the eKool information system, to a credit data enterprise, to law enforcement authorities) or to perform the obligations arising from the applicable legislation;
• to third parties for the receipt of whose services you have filed your request or another declaration of intent (e.g. to the insurer) via the eKool information system;
• if the respective obligation arises from the legislation applicable to eKool or from the binding instructions of the school as the controller.

In any case, personal data shall be disclosed to third persons only to the extent necessary pursuant to the purpose of the respective processing of personal data or the need or obligation to disclose the data. Personal data shall not be transferred to any third parties located in a country with an insufficient data protection level.

Ensuring Personal Data Security

The eKool information system and the personal data contained therein shall be stored and processed in digitally and physically secure servers. Any and all personal data processed by us or our cooperation partners shall be accessed only by our employees or the employees of our cooperation partners who need these data to perform their duties under the employment contracts related to the purposes established by these Terms and Conditions of Data Protection and who are obliged to comply with the requirements established by the applicable personal data protection legislation and this privacy policy upon the processing of the data.

Amendment of Terms and Conditions of Data Protection

These terms and conditions of data protection shall be in effect as of 17.04.2019. eKool shall have the right to amend the terms and conditions of data protection unilaterally at any time. The amendments and modifications shall take effect after the new version of the terms and conditions of data protection has been published in the eKool information system and a notification has been published in the newsfeed of the eKool information system.