Student privacy notice

1. Who is responsible for your data

The following are jointly responsible for processing your data in the campaign (as joint controllers under Article 26 GDPR):

• Arwell Works s.r.o., registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, section C, file 458253, company ID (IČO) 302 09 781 ("Arwell"), which operates the Eolin platform, and
• the organiser of the campaign you are taking part in. We name the organiser of each campaign in section 12 and in the campaign rules.

The ambassador programme is run by Arwell alone, as the sole controller. Arwell is responsible for the e-mail reminder about the next campaign, for campaigns organised with Club Alpbach Czechia & Slovakia, z. s. (Pauza na Samet, Pauza na Nežnú) jointly with that association; it is a separate processing operation, unrelated to the ambassador programme. Both are governed by the Account privacy notice.

We have not appointed a data protection officer, because the GDPR does not require us to. You will find contact details in section 11.

2. How we split responsibilities between us

Arwell and the organiser have concluded a joint controller arrangement. In essence:

• Arwell is responsible for the technical operation and security of the platform, for selecting processors and the contracts with them (section 7), for handling your requests (section 10) and for notifying any security incidents.
• The organiser is responsible for the content and purpose of the campaign, for communication with schools, for the competition rules, and for evaluating the results and handing over the prizes.
• You can exercise your rights with either of them. Whoever receives your request will make sure it is dealt with.

3. What data we process

Game profile. When you first enter a campaign, the app creates a pseudonymous account for you – a random identifier with no name or e-mail. Your sign-in is stored in a cookie in your browser.

Membership data. The school, year and class you choose yourself, and a nickname generated by the app. You cannot enter your own nickname.

Game activity. Which activities and challenges you have opened and completed, your quiz answers (correct/incorrect and response time), points earned, competition days and streaks of active days, and the times of individual actions. We do not store how long you use the app with your profile – we count it only as a total for the whole campaign and day.

Invitation links. Your personal invitation link and whose link you joined through. This is how points for invitations are credited.

Confirmation of the rules. A record that, on entry, you confirmed you had read the campaign rules, the Terms of use and this document, and which version.

"Write to us". Messages are anonymous. We store only the type of message, the text, the campaign, the screen, the app version, the device type (e.g. "iOS / Safari") and the day it was sent – none of this is linked to your profile. Do not write your name or any other personal data in a message; if a message contains any all the same, we will delete it. Messages are deleted together with the campaign data.

What we do not process. Your name, e-mail, phone number, date of birth or age. The app itself does not store your IP address or any device data – with one exception: for an anonymous "Write to us" message we store a rough device type (e.g. "iOS / Safari"), not linked to your profile. We do not link your game profile to social media accounts in any way.

Operational logs. The hosting providers Vercel and Supabase (section 7) keep short-term technical logs that may contain your IP address and browser type. These serve only to ensure security and operation and are automatically deleted, usually after a few days, depending on the provider's settings.

Videos and audio recordings. Some activities contain a video or recording from YouTube, Vimeo, SoundCloud or Spotify. The player loads only when you tap "Play" – until then nothing is sent to that service. Once you start it, your browser talks directly to that service: it receives your IP address and browser details, may store its own cookies in your browser, and processes this data as an independent controller under its own privacy policy. We start YouTube in its privacy-enhanced mode. We do not pass your nickname, school, class or any other game-profile data to that service. If you prefer, do not start the video or recording.

4. Research surveys and quiz answers

Taking part in surveys is voluntary – if you don't want to, you keep playing without any restrictions. All we store against your profile is the fact that you completed the survey, so that points can be credited to you.

The answers themselves are first saved in a temporary store that no one can access, and are then moved in batches with other answers (by the end of the competition day at the latest) to storage with no link to your profile, school or class. After that, it is no longer possible to find out who answered what, which is why these answers cannot be traced, corrected or individually deleted. We show results only as summaries for groups of at least 10 people.

Comparison surveys are the exception. Some surveys are asked twice (at the start and at the end of the campaign) so that we can compare the answers of the same students. Their answers therefore stay in the temporary store linked to your profile for longer: until the campaign ends, but no longer than 7 days after you answer. They are then moved to storage with no link to your profile, school or class like all other answers, and everything above applies. We show comparison results only as summaries. The app tells you that a survey is a comparison survey before you answer it.

Please don't write your name, or anything that could identify you, in free-text answers. We check free-text answers before any further use.

5. Why, and on what legal basis

Why legitimate interests and not consent. The campaign is a voluntary educational activity for schools. To run it, we need only a minimum of data, and that data is pseudonymous – without your name. In our assessment we gave particular weight to the fact that most participants are minors: that is why we do not collect names or contact details, we only generate nicknames, we publish results only under nicknames and we delete the data soon. You can object to this processing at any time (section 10). We will send you a summary of the assessment on request.

Do you have to give us this data? No law requires you to, and taking part is voluntary. If you want to play, however, you must choose your school, year and class, because points also count for your class and school. Without them we cannot create a game profile. You never have to fill in research surveys, and you keep playing without any restrictions.

We do not carry out automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you. Points and rankings are calculated automatically according to the published rules; a decision to disqualify is always made by a person.

6. Who will see your data

• The public: student leaderboards publicly show only your nickname and points, and the final results also your school; class leaderboards show the class name and the school. Participants and visitors from the campaign's other countries can see them too. After the campaign ends, the organiser will publish the winners' nicknames and schools. Only signed-in participants of the same campaign see your class next to your nickname, and only in the app. We don't ask for a name or an e-mail address to play, and every player has a randomly generated nickname. Because your class is not shown publicly next to your nickname, it is harder to tell whose profile it is; classmates who play the same campaign do see the class in the app, though, so some of them may still recognise your profile.
• Teachers see only aggregate results for their school and for classes with at least 10 participants – not individual students.
• Your school finds out who the winner is when the prize is handed over, once you show it the winning profile.
• The organiser and the campaign administrators at Arwell see data to the extent needed to run and evaluate the campaign; access is restricted and logged.
• Ambassadors: if you are an ambassador and link your ambassador account to your game profile, other ambassadors will see your ambassador number, nickname, school and points on the ambassador leaderboard (see the Account privacy notice).
• We do not sell your data or pass it on to advertisers or any other third parties, nor to partners who donate prizes – you redeem a voucher code with the partner yourself. We disclose it to public authorities only where the law requires us to.

7. Processors and where the data is stored

We run the primary database in the EU (Ireland); the app runs in the EU (Dublin, Ireland). These providers are US companies, however, so in limited cases (e.g. during technical support) the data may be accessed from the USA. Such a transfer is protected by standard contractual clauses approved by the European Commission (Article 46 GDPR) and, for providers certified under the EU–US Data Privacy Framework, also by the Commission's adequacy decision (Article 45 GDPR). We will give you a copy of these safeguards on request (privacy@arwell.works). Details are in the List of processors document.

8. How long we keep the data

• We delete or irreversibly anonymise campaign data (game profile, membership, activity, points, invitation links) no later than 60 days after the campaign ends.
• The winner's screen with the code and the certificate download is deleted within the same period. So claim your reward in time, and download your certificate or take a screenshot of it. To verify certificates we keep, without time limit, only a record with no link to any participant: the verification code (only as a fingerprint from which the code cannot be recovered), the name of the reward and of the campaign, the date of issue and the date of handover. It contains no nickname, class, school, place or any other information about the winner.
• After that, all that remains are anonymous aggregate statistics (e.g. numbers of participants, school participation, aggregate results) and anonymous survey answers, from which no individual can be identified.
• The hosting providers' operational logs are deleted automatically, usually after a few days, depending on the provider's settings.
• Details are in the Data retention and deletion document.

9. Losing your profile

Your profile is tied to your browser and device. If you clear your cookies, use private browsing or switch to another device, you will lose your profile and it cannot be restored – we don't know your name or e-mail, which we would need to verify you. This is a consequence of us knowing as little about you as possible.

10. Your rights

Right to object. We process your data in the game on the basis of legitimate interests (section 5). You can object to this at any time on grounds relating to your particular situation. Just write to privacy@arwell.works or to the campaign organiser. We will then stop processing your data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. The game cannot work without this data, so upholding your objection means deleting your game profile and ending your participation in the campaign and the competition.

You have the right:

• of access – to find out what data we process about you;
• to rectification of inaccurate data;
• to erasure;
• to restriction of processing;
• to object to processing based on legitimate interests;
• to data portability, where the GDPR allows it;
• to withdraw your consent at any time, where processing is based on consent – this does not affect anything that happened before the withdrawal;
• to lodge a complaint with a supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz); participants from Slovakia may also complain to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, www.dataprotection.gov.sk).

Deletion right in the app. The simplest way to have your data deleted is in the app: in Profile, choose “Delete my data”. You send the request from the device you play on, and that alone shows it is yours – we need nothing else from you. The campaign team handles it within one month at the latest; until then you can cancel it in Profile. Once it is approved, we delete your nickname, school, year and class, points, completed activities, goals and rewards in every campaign you play with this profile, and the game profile itself; the app will then no longer recognise you, and you lose your place in the competition and any prize. We take your points off the class and school rankings. Only what does not identify you stays: answers to polls, research and quizzes stored with no link to you (they cannot be found or deleted), totals without names, and class results already published as final – without your nickname. If we refuse the request, you will see the reason in Profile. You can also write to privacy@arwell.works.

How we recognise you. Your game profile has no name, so we can only act on your request if you show that the profile is yours. A deletion request sent from the app shows this by itself; for other requests, show us the profile on the device where you have it open. Without this, we could end up giving your data to a stranger.

We will reply without undue delay and within one month at the latest. If the request is complex, we may extend this period and will let you know. Dealing with your request is free of charge.

Until you are 18, your parents or another legal guardian can also exercise your rights. You can also exercise them yourself; if you are unsure, talk to your parents or a teacher. If your parents' request differed from what you want, we will take into account your age and what is in your interest.

11. Contact

• Arwell Works s.r.o.: privacy@arwell.works
• Campaign organiser: the contact given in section 12 and in the campaign rules.

12. Campaigns and their organisers

Velvet Week 2026 – Pauza na samet (Czech Republic) and Pauza na Nežnú (Slovakia), 9–13 November 2026

• Organiser and joint controller: Club Alpbach Czechia & Slovakia, z. s., company ID (IČO) 218 86 369, Jar. Svobody 235/36, 664 47 Střelice, entered in the Register of Associations kept by the Regional Court in Brno, file no. L 30083; contact pauzanasamet@clubalpbach.cz.
• The campaign content is educational and politically non-partisan; it is prepared by the organiser.
• The co-organiser Díky, že můžem, z. s., company ID (IČO) 051 46 895, has no access to participants' personal data and receives only anonymous aggregate statistics.
• Competition rules: under Legal information on www.eolin.app, the document “Contest rules: Pauza na Samet / Pauza na Nežnú” (issued in Czech and Slovak).

13. Changes

We may update this document, for example when the app's features change. The current version, with its effective date, is always available here; you will find previous versions in the version history. We will inform you in the app about any significant changes made while a campaign is running.