Administrator privacy notice

1. Controller

The controller is Arwell Works s.r.o., registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, section C, file 458253, company ID (IČO) 302 09 781 ("Arwell", "we"). Data protection contact: privacy@arwell.works. We have not appointed a data protection officer, because the GDPR does not require us to.

Arwell runs the administration for every campaign as the independent controller of the data about administrator accounts. If you access the administration on behalf of a campaign organiser, the administrator of your organisation who invited you decides about your access; the data about your account, however, is managed by Arwell under this document.

2. What data we process

• E-mail address – used to sign in; we send your invitation and one-time sign-in codes to it.
• Name, if the person who invited you entered one, organisation and permissions – which programmes, editions and campaigns you can access and what you may do in them.
• Second sign-in factor – a record of the authenticator app you set up. Its secret key is stored in the Supabase Auth sign-in service and is used only to check your code.
• Sign-in records – when the account was created, when you were invited and when you last signed in; sign-in sessions, for which the sign-in service also stores the IP address and browser identification you sign in from; and the sign-in service's records of sign-ins, which may contain an IP address.
• Audit record of sensitive actions – for example publishing and activating campaign versions, verifying teachers, exports, permission changes and access to research data, with your account's identifier and the time.
• Record of your confirmation of this document – version and time.
• Short-term technical operating logs at the providers Vercel and Supabase, which may contain an IP address.

We obtain the data from you and from the administrator who invited you.

Do you have to provide the data? No law requires you to. Without an e-mail address, an authenticator app and your confirmation of this document, however, we cannot give you access to the administration.

3. Why, and on what basis

4. Who sees your data

• Authorised Arwell staff.
• Administrators of your organisation who manage access – they see your e-mail, name, permissions and whether you have accepted your invitation.
• Other administrators see you in the audit record only as "Administrator", without your name or e-mail.
• The processors listed in section 5, only as far as their service requires.

We do not sell the data or use it for advertising.

5. Processors and transfers

The data is processed by our processors: Supabase (database and sign-in, EU – Ireland), Vercel (running the administration, EU – Dublin, Ireland) and Resend (sending invitations and sign-in codes, EU – Ireland). These providers are based in the USA; any access from the USA is protected by standard contractual clauses (Article 46 GDPR) and, for certified providers, also by the EU–US Data Privacy Framework (Article 45 GDPR). We will provide a copy of these safeguards on request. Details are in the List of processors.

6. How long

• Administrator account – e-mail, sign-in factors and sign-in sessions: 3 years after the account was last used. Last use is the end of your access or, if your access never ended, your last sign-in or your last activity in a signed-in session. We then delete the account automatically, including the sign-in e-mail. We do not delete the account of an administrator with access to the whole platform while that access lasts; once it ends, the same rule applies as for everyone else.
• Name and permissions are removed from the account as soon as your access ends; which permissions were removed stays in the audit record.
• The record of your confirmation of this document is kept for as long as the account exists, because it is how we demonstrate that we informed you; it is deleted together with the account.
• Audit record: 3 years after each record was created, independently of the account.
• If you use the same e-mail address for a teacher or ambassador account on eolin.app, or to play in a campaign, the sign-in record is deleted only under that account's rules; the administrator account's data is deleted regardless.
• The data disappears from database backups within 7 days at the latest. Records kept by the Supabase Auth sign-in service itself and Vercel's technical logs are deleted by those providers under their own retention rules.

7. Your rights

Right to object. We process the data about administrator accounts on the basis of legitimate interests. You may object to this at any time on grounds relating to your particular situation, at privacy@arwell.works. We will comply unless we demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise or defence of legal claims. Without sign-in data and the audit record, however, we cannot provide access to the administration.

You have the right of access, rectification, erasure, restriction of processing and the right to object to processing based on legitimate interests.

• Correcting your name or permissions: with the administrator of your organisation who manages access, or at privacy@arwell.works.
• Erasure: at privacy@arwell.works. Deleting the account ends your access to the administration.
• Other requests: at privacy@arwell.works. We will reply without undue delay and within one month at the latest; handling is free of charge.
• Complaint: to the Czech Office for Personal Data Protection (www.uoou.gov.cz) or, from Slovakia, also to the Office for Personal Data Protection of the Slovak Republic (www.dataprotection.gov.sk).

We do not carry out automated decision-making with legal effects.

8. Changes to this document

When we change this document, we publish a new version. Before you use the administration again, we will ask you to confirm the new version; until you do, the administration will not open for you.