How we process personal data in IziEdu

IziEdu is operated by SC IZIEDU EDUCATIONAL SRL, with the identification details in the block above. For any question or request about personal data, you can write to us at adrian.stratulat@iziedu.com.

The platform is multi-tenant, and the role depends on the data, not on the page you are reading:

For student data, IziEdu acts only on the teacher’s documented instructions and does not decide the purposes of the processing. A data processing agreement is available and sets out those instructions, the sub-processors and the security measures. Where IziEdu itself runs a workspace as the teacher, it holds both roles for that workspace, but the allocation above still describes which capacity applies to which data.

We do not sell personal data and we do not use it for behavioural advertising. We do not ask for sensitive data (about health, ethnic origin, religious beliefs, sexual orientation) and we ask you not to send it to us.

We collect only the data needed to create and run the teacher’s workspace, organise the register and issue invoices for the subscription. The table below groups it by category and states who is the controller of each category.

We do not use traffic analytics tools, advertising pixels or fingerprinting. We do not ask you for data we do not use: the telephone number is optional and never becomes an authentication identifier.

Data for which IziEdu is the controller. We rely on:

• Performance of the contract (art. 6(1)(b)) — creating the teacher account, providing the software, invoicing the subscription and supporting the workspace.
• Legal obligation (art. 6(1)(c)) — keeping accounting and tax records, responding to requests from the authorities.
• Legitimate interest (art. 6(1)(f)) — platform security, limiting login attempts, fraud prevention, defending a legal claim. We have assessed this interest and limit it to what is necessary; you may object, on the conditions set by law.
• Consent (art. 6(1)(a)) — only where we ask for it explicitly. You may withdraw it at any time, without affecting the lawfulness of prior processing.

Student data. IziEdu does not choose the legal basis for student data. As processor, we process it only on the teacher’s documented instructions. The teacher, as controller, determines and documents the basis, including any parental consent and any consent for the optional Discord link, and provides the privacy notice to their students and their students’ parents.

Students in a teacher’s register may be minors, and this is the category that requires the most care. Because the teacher is the controller of the student data, the teacher decides whom to enrol, which students may use the portal and whether the Discord integration is offered to them. The teacher is responsible for the lawfulness of that processing and for obtaining the consent of a parent or guardian where the student is a minor.

Our rules when we process student data as processor:

• We act on the teacher’s instructions. We host the register and the portal, and we do not add students, change their data or use it for our own purposes.
• Minimisation. We keep the student’s full name, module, cohort, enrolment and attendance status, credits, feedback, portal questions and, where the teacher enables it, a Discord identity link. We do not ask for a home address, the child’s telephone number, health data or other sensitive data.
• No marketing to children. We do not send commercial offers directly to minors and we do not use their data for profiling.
• Rights are exercised through the teacher. A parent or guardian may request access to the child’s data, rectification, erasure, restriction of processing or objection from the teacher, who answers as controller. If a request reaches IziEdu directly, we forward it to the teacher and assist. We may ask for the information needed to identify the request, and for a minor the teacher confirms the guardian’s status.

If we learn that we hold data about a child that the teacher is not authorised to process, we tell the teacher and delete the data as instructed. If you are a parent and believe this has happened, contact the teacher first; you can also write to us at adrian.stratulat@iziedu.com.

We do not sell data. We disclose it only to the people who help us provide the service, to the extent necessary, and to authorities that request it under the law. For teacher and billing data, the providers below are our processors. For student data, they are sub-processors acting on the teacher’s instructions through IziEdu, except where they act as independent controllers (for example, Discord for its own platform, or the teacher’s own Discord server).

Correspondence sent to the contact address adrian.stratulat@iziedu.com is hosted by GoDaddy.com, LLC as an e-mail provider (a US company); the same transfer safeguards described in section 6 apply.

The data processing agreement with the teacher lists the sub-processors used for student data and sets out how changes to that list are notified. We do not transfer data to advertising networks, data brokers or for other commercial purposes. If a provider changes, we update this list before using it for real data.

Yes, some of the data is transferred outside the European Economic Area. Railway is a US company, and Discord, GoDaddy and Resend process data in the United States. Even though the region configured for hosting the application and the database is Western Europe (Amsterdam), administrative and support access, as well as the services of the US processors, involve a transfer outside the EEA. Student data is transferred only as part of the processing the teacher instructs.

The basis for the transfer is the standard contractual clauses adopted by the European Commission (Decision 2021/914), together with an assessment of the supplementary measures applicable to each provider. We do not rely on a certification we have not verified, and we do not claim that any particular provider is certified under the EU–US framework.

You may request a copy of the applicable safeguards by writing to adrian.stratulat@iziedu.com. We will send the relevant version, with confidential commercial information removed.

• Teacher account: for as long as the account is active. After closure, the data is deleted or anonymised; it may remain temporarily in database backups (see the note below).
• The student register, including minors: the teacher, as controller, decides how long student data is kept. IziEdu keeps it for as long as the workspace is active and the teacher keeps the record, and deletes or returns it on the teacher’s instruction and at the end of the agreement. We do not apply a separate retention period of our own to student data.
• Billing data: for as long as the contractual relationship exists. Invoicing data is kept for 10 years from the close of the financial year, in accordance with accounting legislation.
• Subscription invoices: 10 years, for accounting and tax obligations.
• Discord identifiers: for as long as the link is active. We delete them when it is disconnected; they may remain temporarily in database backups (see the note below).
• Security counters: HMAC digests of the e-mail address and IP address, kept only for as long as they are relevant to limiting attempts (a one-hour window, a block of at most 15 minutes) and deleted on successful sign-in.
• Technical hosting logs: kept by Railway under its own retention settings. We do not run our own logging system containing personal data.
• Correspondence: for as long as necessary to resolve the request and to defend a legal claim, and deleted afterwards.

Note on backups. The database point-in-time restore window is approximately 4 weeks. Daily volume backups are kept separately.

When a period expires, we delete or anonymise the data, except for what the law requires us to keep.

The measures below are implemented in the application, not just promised:

• passwords are stored as scrypt hashes with a random salt per account; the plaintext password is not stored and is not returned by any API;
• the session token is 32 random bytes and is stored only as a SHA-256 digest; the cookie is HttpOnly, SameSite=Lax and Secure in production, with a lifetime of 30 days;
• login attempts are rate-limited per account and per IP address, using HMAC digests, so that a copy of the database does not contain the addresses or e-mails attempted;
• every query is scoped to the session’s organisation, and pages and APIs that touch tenant data verify the session against the database, not just the presence of the cookie;
• traffic is served over HTTPS; access to the database and to environment variables is restricted to the application’s services.

We do not claim additional application-level encryption for database rows, nor any security certification we have not obtained. No system is impossible to compromise; if an incident affects your data, we notify the competent authority within 72 hours and the affected individuals without undue delay, in accordance with art. 33–34 GDPR. Where the incident affects student data, we notify the teacher as controller without undue delay.

Under the GDPR, you have the following rights. How you exercise them depends on the data and on who is its controller.

Teacher account, billing and correspondence. IziEdu is the controller. Send an e-mail to adrian.stratulat@iziedu.com, ideally with the subject “GDPR – [right requested]”, from the e-mail address of the account or of the billing contact.

Student data. The teacher is the controller. Requests about a student should be addressed to the teacher, who answers them and instructs us. If a request reaches us directly, we forward it to the teacher and assist. We may ask for the information needed to identify the request, and for a minor the teacher confirms the guardian’s status.

• Access — a copy of the data we process about you and information about the purpose, recipients and duration.
• Rectification — correcting a name, an e-mail address or other inaccurate data.
• Erasure — deletion of data, except for what the law requires us to keep (for example, invoices).
• Restriction — limiting processing while we verify a dispute.
• Portability — receiving data in a structured, commonly used format, for the data you provided and that is processed on the basis of contract or consent.
• Objection — to processing based on legitimate interest; we will review it and stop processing if we do not have compelling legitimate grounds.
• Withdrawal of consent — at any time, without affecting processing already carried out.
• Not to be subject to an automated decision — see section 12.

Where IziEdu is the controller, we reply within one month. If the request is complex, the period may be extended by up to two months, and we will let you know. Requests are free of charge, unless they are manifestly unfounded or repetitive. Where the teacher is the controller, we assist the teacher so that the request is answered within the same period.

If you believe that the processing infringes the GDPR, you may lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP):

• address: 28–30 General Gheorghe Magheru Blvd., Sector 1, Bucharest
• e-mail: anspdcp@dataprotection.ro
• website: dataprotection.ro

You may also lodge the complaint with the supervisory authority in the country where you have your habitual residence, your place of work or the place of the alleged infringement. If your complaint concerns student data, please raise it with the teacher first; you can still complain to the supervisory authority. We ask you to write to us first: many problems are resolved faster directly.

We have not appointed a data protection officer (DPO). In the current version we do not carry out an activity that triggers the obligation under art. 37 GDPR: we do not systematically process special categories of data and we do not systematically monitor individuals. If the activity expands, we will reassess the obligation and publish the DPO’s contact details.

Internal data-protection documentation, including any record of processing activities required by art. 30 GDPR, is not published here; you can ask us about it at adrian.stratulat@iziedu.com.

We do not make automated decisions that produce legal effects or significantly affect you. We do not carry out commercial profiling, we do not grade students and we do not use your data to decide who is admitted to a teacher’s sessions.

The subscription fee is a price set by IziEdu, not a decision taken about you by an automated system.

We use a single, strictly necessary cookie: iziedu_session, which holds the authentication session. It is HttpOnly, SameSite=Lax, has a lifetime of 30 days and is deleted on sign-out. Without it, the console and the portal cannot work.

We do not use analytics, advertising or remarketing cookies, or social network pixels. The Discord community opens in a separate application with its own privacy policy; we do not embed Discord widgets in our pages.

We may update this policy when we change a processor, a retention period or a practice. The version and the date of the last update appear at the top of the page. Material changes are announced by e-mail or in the platform, with reasonable advance notice, and where a change affects student data we inform the teacher as controller. Previous versions can be requested at the contact address.

For any question about personal data, to exercise a right or to report a security incident, write to adrian.stratulat@iziedu.com. If your question concerns student data, contact the teacher first; we assist the teacher as processor.

The controller’s full details are in the identification block at the top of the page. The terms of use for the service are in the Terms and conditions.