Privacy notice

Working draft 0.1 for legal review, not yet in force. Open points are marked [TO CONFIRM].

This notice explains what personal data Brotelo collects about parents and children, why we collect it, who receives it, how long we keep it and what rights you have. Children can read a short version written for them on our page "Privacy for kids".

1 The short version

• Only adults have accounts. Children use a profile that their parent creates, with a nickname, an age and a preset avatar.
• Children never give us an e-mail address, a photo, a phone number or their location.
• We use data to run the courses, save progress, issue certificates, take payments and keep Brotelo safe.
• No advertising, no ad trackers, no selling of data, no chat and no public profiles.
• Our visit statistics use no cookies and never run in the children's area.
• You can see, correct, download and delete your data and your children's data.

2 Who is responsible for your data

The controller of your personal data is TOPFED WEB S.R.L., a company registered in the Republic of Moldova, IDNO 1026023125543, with its registered office at s. Pepeni, r-nul Sîngerei, MD-6234, Republic of Moldova. You can write to us at [email protected] about anything in this notice.

2.1 Representative in the European Union

Because we are established outside the European Union, we must appoint a representative in the EU (Article 27 GDPR). [TO CONFIRM: the name and contact details of the EU representative.]

2.2 Representative in the United Kingdom

[TO CONFIRM: if Brotelo is offered in the United Kingdom, the name and contact details of the UK representative under Article 27 UK GDPR.]

2.3 Data protection officer

[TO CONFIRM: whether a data protection officer must be appointed under Article 37 GDPR or Moldovan Law no. 195/2024; until then, write to [email protected].]

3 What data we collect

3.1 About you, the parent

• Account data: your e-mail address and how you sign in. If you sign in with Google, we receive the identifiers Google sends us. [TO CONFIRM: which Google profile data is stored; we recommend only the account identifier and the e-mail address.] Your password is handled by Firebase Authentication, a Google service, and we never see it.
• Order data: your full name, your country, the confirmation that you are 18 or older, the courses you buy, prices, taxes, currency, order date and number, payment status and the transaction reference from our bank. We do not receive or store your full card number. [TO CONFIRM: whether the bank sends us masked card details, such as the last four digits.]
• Records of your choices: your consents (child profiles, public certificates, newsletter), your consent to access starting straight away and your acknowledgement, your withdrawals and guarantee requests, with their dates.
• Messages: what you write to us (questions, complaints, safety reports, requests about your rights) and our replies.
• Newsletter and waitlist: your e-mail address, your language, and the date and proof of your consent and of your confirmation (double opt-in).
• Technical data: IP address, browser and device type, pages requested, and the date and time, in the security logs of our servers and of Cloudflare.

3.2 About your child

We only keep what you enter and what the child creates while learning:

• Profile: nickname, age or birth year, and the avatar chosen from our preset list.
• PIN: the optional 4-digit PIN, stored in protected (hashed) form. [TO CONFIRM: how the PIN is stored.]
• Learning data: the courses available to the profile, the slides completed, the answers to check questions and to the final quiz, quiz attempts and scores, and the dates of activity. [TO CONFIRM: whether answers to the check questions inside the slideshow are stored.]
• Certificates: the name you chose for the certificate (by default the first name and the initial of the surname), the course, the date, the certificate code and whether you made the certificate publicly verifiable.

3.3 What we never collect from children

• No e-mail address, phone number or postal address.
• No photos, videos, voice recordings or uploads of any kind.
• No messages or chat.
• No location.
• No advertising identifiers, no tracking for advertising and no visit statistics in the children's area.

4 Why we use data and on what legal basis

[TO CONFIRM: the legal basis for children's data (parental consent, our contract with the parent, or legitimate interests), and the basis for records required by Moldovan law, since Article 6(1)(c) GDPR covers only obligations under EU or Member State law.]

We do not use any data for advertising or for marketing profiles, and we do not make decisions based solely on automated processing that have legal or similarly significant effects on you or your child. Where we rely on legitimate interests, you can object (section 9).

5 Children's data and parental consent

Brotelo is made for children aged 8 to 14, but only adults hold accounts, and children never sign up by themselves.

Under the GDPR, when an online service relies on consent, a child below the age of digital consent needs the consent of the person with parental responsibility. That age is between 13 and 16 depending on the country, for example 16 in Romania. Because all children on Brotelo are 14 or younger and never sign up themselves, we always ask the parent, whatever the child's age and country.

When you create a child profile, you confirm that you are the child's parent or guardian, or that you have the permission of the person with parental responsibility, and you give your consent to our use of the child's data as described here. [TO CONFIRM: how we make reasonable efforts to check that consent comes from a person with parental responsibility (Article 8(2) GDPR) and, if the United States is served, the verifiable parental consent method under COPPA.]

• We collect as little as possible: a nickname instead of a full name, an age or birth year instead of a date of birth, preset avatars instead of photos.
• You stay informed: you see your child's progress and certificates in the parent area, and our page "Privacy for kids" tells your child that you can see them.
• You can change your mind: you withdraw your consent by deleting the child profile, which deletes the child's data (section 8). Withdrawing consent does not affect what we did before.
• We never use children's data for marketing, advertising or profiling, and we never sell it.
• If a child has signed up alone: if we learn that a child created an account by themselves, we delete it.

We assess the risks of our processing for children in a data protection impact assessment. [TO CONFIRM: complete the data protection impact assessment (DPIA) before launch.]

6 Who receives data

We do not sell personal data. We share it only with service providers that process it for us, on our instructions and under a contract (Article 28 GDPR), and with the few independent recipients listed below.

[TO CONFIRM: the contracting entity and the data processing agreement for each provider.]

Independent recipients, under their own privacy notices:

• MAIB (Moldova Agroindbank), Republic of Moldova, which processes card payments and the card data you enter on its payment page. [TO CONFIRM: whether MAIB acts as an independent controller or as our processor.]
• Google, if you choose to sign in with your Google account, as the provider of that account.
• Professional advisers, such as lawyers and accountants, who are bound by confidentiality.
• Authorities and courts, only when the law requires it, or to protect a child who may be in danger.

If our business, or part of it, is ever sold, the buyer may receive the data needed to continue the service, under this notice. We would tell you in advance.

7 International transfers

We are based in the Republic of Moldova, and our team accesses the data from there. The European Commission has not adopted an adequacy decision for the Republic of Moldova. [TO CONFIRM: the safeguards for access from Moldova, following the EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V GDPR.]

Our servers are in Germany, and Brevo works in the EU. Cloudflare and Google may process data in the United States. For these transfers we rely on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the standard contractual clauses of the European Commission. For users in the United Kingdom, we rely on the UK extension of that framework or on the UK addendum to those clauses. [TO CONFIRM: each provider's certification and safeguards at the date of publication.]

Card payments are processed by MAIB in the Republic of Moldova.

You can ask us for a copy of the safeguards we use by writing to [email protected].

8 How long we keep data

We keep data only as long as we need it. The periods below are proposals. [TO CONFIRM: every period below, against Moldovan accounting law, EU VAT rules and limitation periods.]

9 Your rights

You have the right to:

• access your data and get a copy of it;
• correct data that is wrong or incomplete;
• erase your data;
• restrict our use of your data in some cases;
• receive the data you gave us in a commonly used format and have it sent to another service (portability);
• object to our use of your data based on legitimate interests, and at any time to direct marketing;
• withdraw your consent at any time, without affecting what we did before;
• not be subject to decisions based solely on automated processing; we make no such decisions.

You exercise these rights for your child. When a child is old enough to understand, we take their views and best interests into account.

9.1 How to exercise your rights

In the parent area you can change or delete child profiles, turn the public verification of a certificate on or off, change your e-mail preferences and close your account. [TO CONFIRM: the self-service features available at launch, including downloading your data.]

You can also write to [email protected] from the e-mail address of your account. We may ask you to confirm your identity. We answer within one month. For complex or numerous requests, we may extend this by two more months and tell you why. Exercising your rights is free, unless a request is clearly unfounded or excessive.

10 Complaints to a supervisory authority

You can complain to a data protection authority:

• in the Republic of Moldova, the National Center for Personal Data Protection (NCPDP), www.datepersonale.md;
• in the European Union, the authority of the country where you live, where you work or where the problem happened; the European Data Protection Board lists them all at edpb.europa.eu; in Romania it is the ANSPDCP, www.dataprotection.ro;
• in the United Kingdom, the Information Commissioner's Office (ICO), ico.org.uk.

We would be grateful for the chance to deal with your concern first, so please write to us at [email protected].

11 Security

We protect data with technical and organisational measures that suit the risks, especially for children's data:

• all connections to Brotelo are encrypted (HTTPS);
• our servers are in Germany, and only the people who need access have it;
• passwords are handled by Firebase Authentication and are never stored by us;
• PINs are stored in protected (hashed) form;
• card data is handled by the bank, never by us;
• we keep our systems up to date and make regular backups.

[TO CONFIRM: the technical and organisational measures, as documented in the DPIA and the records of processing activities.]

If a personal data breach happens, we notify the competent authority within 72 hours where the law requires it, and we tell you without undue delay if it is likely to result in a high risk to you or your child.

12 Marketing e-mails

We send the newsletter and waitlist news only to parents who ask for them. Signing up uses a separate box that is never ticked in advance, and you confirm by clicking the link we send you (double opt-in). We never send marketing e-mails to children. Every e-mail has an unsubscribe link, and unsubscribing does not affect your account or your service e-mails. [TO CONFIRM: that open and click tracking is switched off in Brevo.]

13 Cookies and similar technologies

We only store on your device what Brotelo needs to work. We use no analytics cookies and no advertising cookies. Our Cookie policy lists everything.

14 Users in specific countries

14.1 United Kingdom

If you live in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. We follow the ICO's Age Appropriate Design Code (the Children's Code): high privacy by default, data minimisation, no profiling, no nudges to share more data, and privacy information that children can understand.

14.2 United States

[TO CONFIRM: whether Brotelo is offered in the United States at launch. If so, COPPA compliance is needed before launch: direct notice to parents, verifiable parental consent before collecting personal information from children under 13, a written data retention policy, an information security program, and an online notice that includes a telephone number.] Parents in the United States can review their child's personal information, ask us to delete it and refuse its further collection or use. We do not ask a child for more information than is reasonably needed to take part in an activity.

14.3 Republic of Moldova

Our processing is also subject to Law no. 195/2024 on personal data protection of the Republic of Moldova. [TO CONFIRM: the provisions that apply, their entry into force and any registration or notification duties towards the NCPDP.]

15 Changes to this notice

We may update this notice. The date at the top shows the current version. We will tell you by e-mail before important changes take effect, and we will ask for your consent again if a change needs it.

16 Contact

TOPFED WEB S.R.L., s. Pepeni, r-nul Sîngerei, MD-6234, Republic of Moldova. E-mail: [email protected].