Privacy and Data Protection Policy

This Policy applies to the Mindexy platform, accessible at https://www.mindexy.com and https://www.appcoursesonline.com, as well as to the associated applications, subdomains and features, together referred to as the "Platform".

The document is drafted in Romanian for users in Romania/the EU. If an English-language version also exists, for users resident in Romania the Romanian-language version shall prevail.

Platform Controller:
Wiki Kids Online FZC (free zone company)
Registration No.: 4420233
Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Email: office@mindexy.com
Phone: +40 765 910 743 (RO) / +971 585 249 816 (UAE)

Data Protection Officer (DPO): the data protection officer function is provided externally by atty. Natalia Dumitrescu (avocat-natalia.ro). The data protection officer may be contacted using the contact details published on the indicated website or at office@mindexy.com, with the wording "DATA PROTECTION" in the subject line.

Relevant legal framework: Regulation (EU) 2016/679 ("GDPR"), Law No. 190/2018, Directive 2002/58/EC ("ePrivacy") for cookies and electronic communications, Federal Decree-Law No. 45/2021 („PDPL") for users in the UAE, to the extent applicable, as well as Regulation (EU) 2024/1689 ("AI Act"), to the extent the Platform uses AI features.

In its current model, the Platform operates on the basis of the relationship with schools and teachers ("School Beneficiaries" / "Teacher Beneficiaries", in accordance with the Terms and Conditions), which may enrol students for educational purposes. Mindexy's role differs depending on the specific purpose of the processing.

(a) Mindexy is a CONTROLLER when it determines the purposes and means of the processing, including for: administering the Platform, School/Teacher accounts, security, logs, payments, invoicing, support, operational communications, evidence of consents, GDPR requests, the defence of rights, marketing to adults and the Platform's own features.

(b) Mindexy is a PROCESSOR when it processes, on behalf of a School or a Teacher, the data of students and their parents for the provision of the educational service through the Platform. In this situation, the School/Teacher is the data controller for its own students, and Mindexy processes the data on the basis of the Data Processing Agreement included in the Terms or in a separate DPA.

(c) The School or the Teacher may act as an independent controller for its own activities, such as the contractual relationship with parents, the fees it collects, its own communications, the organisation of sessions and its own decisions concerning students. For such processing, the parent should also consult the notice of the relevant school/teacher.

For questions about a child's data, the parent may contact both the school/teacher through which the child uses the Platform and Mindexy at office@mindexy.com. Mindexy will cooperate with the relevant controller to resolve requests within the legal time limit.

The Platform is also used by children/students. In the current model, children cannot enrol on their own, but only through a parent, legal guardian, authorised representative, school or teacher.

• the child's first name and surname;
• the child's date of birth, to determine the regime applicable to the minor and, where appropriate, the transition to adulthood;
• the student account and the data necessary for authentication;
• educational progress: lessons completed, exercises, results, levels, progress statistics;
• voice sequences for pronunciation exercises in the English course (processed transiently and not transmitted for storage) and recordings of read-aloud exercises (kept temporarily, for a maximum of 30 days), only if the feature is active and separate parental consent exists;
• audio/video recordings of course sessions, only if made by the School/Teacher and separate parental consent exists;
• data entered in the enrolment form directed to a school chosen by the parent.

For children under 16, processing based on consent in connection with information society services is carried out only with the authorisation of the holder of parental responsibility, in accordance with the GDPR and Law No. 190/2018.

Parental consent must be obtained separately for the features that require it: processing of the child's voice, the AI features associated with pronunciation, the recording of course sessions and the use of image/voice for promotional purposes.

Individual progress statistics are visible in the child's account, accessed by the child and/or the parent. The teacher to whom the child is assigned may view the progress of their students strictly for pedagogical purposes. We do not publish and do not publicly compare children's results.

Sessions may be recorded only by the School or Teacher that organises them, under the conditions established by them and in compliance with their obligations to provide information and obtain consent. Recording a minor is permitted exclusively on the basis of separate, specific and informed consent.

Refusal of consent for recording must not automatically lead to the loss of the child's access to the course, if participation without recording is technically and pedagogically possible. Alternative solutions may be used: disabling the camera/microphone, participation without recording, or alternative materials.

Recordings involving minors are kept for a maximum of 12 months from the date of the session, after which they are deleted or irreversibly anonymised, except where retention is legally necessary, for the handling of a complaint or the defence of a right.

The Platform may allow the parent or legal representative to complete the data necessary for the child's participation in a course and to choose the school to which they wish the enrolment request to be directed.

In this flow, the data entered by the parent is saved in the Platform's database and becomes visible exclusively to the selected school, in a dedicated page or area of the Platform, strictly for the purpose of reviewing and managing the enrolment request.

The data may include: the parent's first name and surname, email, phone, the child's name, the child's date of birth, the course/programme chosen, the selected school and the information voluntarily provided through the form.

The selected school acts as an independent controller for the processing it carries out after accessing/taking over the request, including contacting the parent, organising the child's participation in the course and managing its own relationship with the parent/student.

If the parent does not have an active account and wishes to delete the information entered, they may send a request to office@mindexy.com with the wording "Delete enrolment data". The data will be deleted or anonymised, except where retention is legally necessary, for the defence of a right, the handling of a complaint or the demonstration of the consents/instructions received.

We do not send commercial communications to children. Communications regarding a student's account are addressed exclusively to the parent, legal guardian, authorised representative or the school/teacher, as applicable.

Upon reaching the age of 18, the account may be taken over by the former minor in their own name, if this mechanism is available, or may be deleted in accordance with the applicable retention policy.

In short, for children: On Mindexy, your parents or the responsible adults are the ones who decide about your account. We keep your exercises and your progress so that you can see how much you have learned. Only you, your parents, your teacher and authorised persons can see how you work. If you or your parents no longer want this, your data can be deleted, in compliance with the legal rules.

Category	Examples	Data subjects
Identification and contact	first name, surname, email, phone, name of the school/company, contact person	schools, teachers, parents, students
Data about minors	the child's name, the child's date of birth, the student account	students
Authentication	email, password stored cryptographically as a hash, authentication logs	all users
Payments and invoicing	transaction history, billing data; we do not store full card details	schools, teachers, parents, individual users, as applicable
Technical data	IP, browser, operating system, access logs, device identifiers	all users
Educational activity	progress, lessons accessed, answers, results, statistics	students
Voice / AI	audio sequences for pronunciation exercises (processed transiently, not transmitted for storage) and voice recordings of read-aloud exercises (kept temporarily), only if the feature is active and consent exists	students
Session recordings	audio/video of lessons, only with separate consent	students, teachers
Communications	messages through forms, email, support, complaints	all users
Consents and evidence	options ticked/refused, withdrawals, document versions, timestamp, IP	parents, guardians, representatives, schools/teachers
Enrolment requests directed to schools	parent data, child data, course chosen, selected school, information entered voluntarily	parents, students, selected schools

Special categories of data: we do not intentionally request or process special categories of data within the meaning of Art. 9 GDPR. Voice sequences are used exclusively for pronunciation feedback and not for the unique identification of the person; Mindexy does not use the child's voice for biometric identification.

Purpose	GDPR basis	Mindexy's role
Creating and administering School/Teacher accounts	Art. 6(1)(b) contract; Art. 6(1)(c) legal obligations where applicable	controller
Providing educational services to students through the school/teacher	the School's/Teacher's contract with Mindexy; the primary controller's basis for students' data	processor
Processing children's data for the account and progress	parental consent where necessary; performance of the contract; limited legitimate interest for security and administration	processor / controller for own features
AI voice analysis of pronunciation	specific parental consent - Art. 6(1)(a) + Art. 8 GDPR	controller/processor, depending on the specific flow
Recording sessions with minors	separate parental consent; the primary controller is the organiser of the session	processor/technical provider, as applicable
Processing payments and invoicing	Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation	controller
Access expiry notifications and operational communications	Art. 6(1)(b) contract	controller
Direct marketing to adults	Art. 6(1)(a) consent, with unsubscribe at any time	controller
Security, anti-fraud, unauthorised access	Art. 6(1)(f) legitimate interest	controller
Aggregated/anonymised statistics for improving the Platform	Art. 6(1)(f), if the data is not anonymous; anonymous data does not fall under the GDPR	controller
Tax/accounting compliance	Art. 6(1)(c)	controller
Defence of rights	Art. 6(1)(f)	controller
Directing the enrolment request to the chosen school	Art. 6(1)(b) pre-contractual steps; Art. 6(1)(a)+Art. 8 for child data where necessary	controller for collection/transmission; the school subsequently becomes an independent controller

The Platform uses or may use AI features in two ways: the generation of exercises and indicative pronunciation feedback. AI features must be presented clearly to users and parents before use.

In the recommended configuration, only pedagogical parameters are transmitted to the AI providers, such as the level and type of exercise, without names, individual results or other personal data of the students.

With the specific consent of the parent, the student may use the microphone, and the voice sequence may be transmitted through a secure commercial API to the AI provider, which returns pronunciation feedback. The feature is optional and does not condition access to the rest of the course.

• the data must be transmitted through a commercial API covered by a DPA, not through public/free consumer accounts;
• the data must not be used for training models, if this is confirmed contractually and through the account settings;
• voice sequences are not used for biometric identification;
• AI feedback is indicative and may be verified by the teacher or the responsible person;

AI providers used for voice/text: Google (Speech-to-Text, Cloud Translation, Gemini), Anthropic and OpenAI, through a commercial API. The processing region is not currently fixed in code (global endpoint). In accordance with the policies of these providers for the commercial API, data sent through the API is not used for training models; contractual confirmation (DPA) and fixing the region remain the controller's responsibility.

AI feedback has an indicative pedagogical role. No decision with legal or similarly significant effect, such as admission, exclusion, official grading or the official determination of the educational level, is taken solely by automated means.

Mindexy must keep an internal record of the AI features used, the providers, the purposes, the data transmitted, the security measures, the settings regarding training and the instructions for the staff who operate the AI features.

Provider	Role	Data	Location / safeguards
Hosting & main database provider (Romania)	hosting of the Platform + main database	accounts, children's data, results	EU (Romania)
Stripe Payments Europe Ltd. and affiliates	card payment processing	payer email, payment data; the full card details are not stored by us	EU (Ireland)/USA — SCC
Zoho Books (Zoho Corporation)	invoice issuance	billing data	as per the contract
LiveKit (self-hosted)	video conferencing server	display name + audio/video streams	hosted on our VPS in the EU
Google Cloud Storage	storage of the lesson recordings	audio/video recordings of the lessons (the "uestorage" space)	EU (multi-region) — SCC
Google Speech-to-Text	converting the child's voice into text (pronunciation, conferences)	voice sequences — enabled ONLY with voice/AI consent	global endpoint (USA) — SCC
Google Cloud Translation	translation of subtitles	subtitle/transcript text	global endpoint (USA) — SCC
Google Gemini	contextual translation and conversation assistant	speech transcripts — enabled ONLY with voice/AI consent	global endpoint (USA) — SCC
Anthropic, Inc.	automatic correction of texts written by the child and of transcripts	text — enabled ONLY with the relevant consent	USA — SCC
OpenAI	chess explanations, definitions, chat assistant	query text	USA — SCC
Google Firebase (FCM)	push notifications	device token	global (USA) — SCC
Email/SMTP provider (configured: ROMARG, mail.mindexy.com)	transactional emails	recipient's address	Romania/EU
Third-party VPS provider	the chess database and the conferencing server	—	EU
TURN server	relay for video connections	IP addresses	—
Vimeo, YouTube	embedded educational video materials	IP address, viewing data	USA
Flaticon, Pixabay, The Noun Project	image search	server-side queries	third parties
Meta / Facebook (Pixel)	measurement of advertising campaigns	ONLY on the campaign page and ONLY with marketing consent (cookie banner)	USA — SCC
Front-end resources (fonts, icons, JS/CSS libraries)	hosted LOCALLY on the Platform's server; not loaded from third-party CDNs	Exception: the "livekit-client" conferencing library loaded from jsDelivr (CDN)	EU/global
Meta / WhatsApp	communications via WhatsApp, only if the user has indicated a phone number used for WhatsApp	phone number, content of the communication, metadata	USA — SCC; only when using WhatsApp, with dedicated notice at the time of contact
Accounting and legal consultants	compliance, accounting, defence of rights	the strictly necessary	RO/UAE, as applicable
Public authorities	fulfilment of legal obligations	data requested under the law	depending on the authority
The school chosen by the parent	handling of the directed enrolment request	data entered by the parent in the form, including strictly necessary data of the child	RO/EU or the school's country, as applicable

The complete and up-to-date list of processors and sub-processors can be requested at office@mindexy.com.

The data is hosted, according to the available information, on servers in Romania/EU. Since the Platform's controller is a company in the United Arab Emirates, certain data may be accessed from the UAE for administrative purposes. Furthermore, the AI functions, payments or other providers may involve transfers to the USA or other states outside the EU/EEA.

For users in the EU/EEA, transfers to states without an adequacy decision must be carried out only with appropriate safeguards, including, as applicable, Standard Contractual Clauses, a transfer impact assessment (TIA), the EU-U.S. Data Privacy Framework for certified providers and additional technical and organisational measures.

Category	Recommended/correlated retention period
Account and identification data	for the duration of the contract/account + 90 days from the expiry of access, then deletion or anonymisation, if there are no legal obligations/complaints/disputes
Educational activity / progress data	the same regime as account data, except where the School/Teacher sets a different period as controller
Voice sequences	recordings of read-aloud exercises are kept for a maximum of 30 days from recording, then automatically deleted; the voice sequences for pronunciation/conversation sent to the AI speech recognition services are processed transiently and are not stored
Audio/video recordings involving minors	a maximum of 12 months from the session, if this period is confirmed in the Terms, register and technical settings
Payment and billing data	the duration of the contract + the period required by the applicable tax legislation
Technical and access logs	a maximum of 12 months, except for the investigation of an incident or the defence of rights
Support/email communications	the duration of the contract + 12 months, except in cases necessary for the defence of rights
Evidence of consents / acceptances	the duration of the account + 3 years or the period necessary to prove compliance
Data for the defence of rights	for the duration of the applicable limitation periods
Enrolment requests directed to schools	for the period necessary to handle the request + a maximum of 12 months for requests without an account/contract, if there is no basis for retention

Upon expiry of the periods, the data is permanently deleted or irreversibly anonymised. Upon voluntary deletion of the account or upon request, the data is removed within a maximum of 30 days, subject to the legal exceptions.

We implement technical and organisational measures proportionate to the risk, including encryption in transit (TLS), storage of passwords as a cryptographic hash, access control on a need-to-know basis, restriction of administrator access, access logging, backups, recovery procedures, periodic security testing and the selection of providers based on security criteria.

Accounts created for students must be configured so that the parent/authorised user resets the password at first login, especially if the initial password is created by the school/teacher.

We use cookies and similar technologies. Cookies strictly necessary for authentication, session and security do not require consent. Preference, analytics, marketing or tracking cookies are enabled only after consent, expressed through a banner that allows acceptance, refusal and customisation of the options with equal ease.

The complete details (the list of cookies, providers, durations, purposes) are in the Cookie Policy. The cookie banner is implemented and allows acceptance, refusal and changing of preferences; non-essential (marketing) cookies are enabled only after consent.

Under the GDPR, you have the right of access, rectification, erasure, restriction, portability, objection, the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significant effects, and the right to withdraw consent at any time, with effect for the future.

Parents, legal guardians or authorised representatives exercise these rights on behalf of children. Requests are sent to office@mindexy.com. We respond within a maximum of 30 calendar days, a period which may be extended by a further 60 days in complex cases, with notice to the requester.

If the child's data is processed on behalf of a School or a Teacher, we will forward the request to the relevant controller and will cooperate for its resolution.

You have the right to lodge a complaint with the supervisory authority. For Romania: the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro. For other EU/EEA states: the authority of the state of residence. For the UAE: the UAE Data Office, to the extent applicable.

In the event of a personal data security breach that presents a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority within the period provided by the GDPR, as a rule within 72 hours of becoming aware of it. If we act as a processor, we will inform the affected controller without undue delay, so that it can fulfil its own obligations. If the risk is high, the data subjects will be informed in accordance with Art. 34 GDPR.

This Policy may be updated for legislative, operational, technical or technological changes. Minor changes may be published directly on the Platform. Material changes, such as new categories of data, new purposes, new relevant recipients, new AI functionalities, retention changes or additional international transfers, will be communicated by appropriate means, for example email, in-account notification or a notice visible on the Platform.

Where the law requires the consent of the data subject or the authorisation of the child's parent/guardian/representative, mere continued use of the Platform will not replace explicit consent. In such situations, the Platform will request a separate agreement, expressed through a clear affirmative action, before activating that processing.

For any question regarding personal data: office@mindexy.com, with the subject "DATA PROTECTION", or by phone at +40 765 910 743 (RO) / +971 585 249 816 (UAE).

Related documents: Terms and Conditions · Cookie Policy · Withdrawal and Refund Policy · Accessibility Statement.