Account privacy notice

1. Controller

The controller is Arwell Works s.r.o., registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, section C, file 458253, company ID (IČO) 302 09 781 ("Arwell", "we"). Data protection contact: privacy@arwell.works. We have not appointed a data protection officer, because the GDPR does not require us to.

Arwell runs teacher accounts and the ambassador programme across campaigns as an independent controller. Campaign organisers (e.g. Club Alpbach Czechia & Slovakia for Velvet Week 2026) have no access to the data in your account, with one exception: authorised staff of the organiser may verify teachers manually on our behalf (see section 2). In that case they act as our processor under a data processing agreement, only on our instructions and only for this purpose. Otherwise, they receive at most aggregate information, such as how many schools took part.

The exception is the e-mail reminder about the next campaign for campaigns organised with Club Alpbach Czechia & Slovakia, z. s.: Arwell and that association are joint controllers of it (section 4). The reminder, the ambassador programme and teacher accounts are three separate processing operations, each with its own purpose and legal basis: we do not link an address given for the reminder to an ambassador or teacher account, and an ambassador or teacher account does not sign you up for the reminder.

2. Teachers

What data we process: your e-mail address, first name, school, the subjects you teach (chosen from a list), your e-mail domain, verification status (pending / verified / rejected), the verification method, when and by whom the verification was decided and any reason for rejection, a record of your acceptance of the terms of use and of this document (version and time), the times of account creation and last sign-in, and your confirmation that the QR codes have been put up at your school. We obtain the data from you; only during manual verification may your school tell us whether you work there. If you registered through a link carrying a source label (for example from the campaign organiser's e-mail), we store that label with your registration (e.g. “salesforce-2-11”). We use it only to learn which way of reaching schools works; organisers see it only as a count of a school's teachers per source, never with your name or e-mail address.

Why, and on what basis:

Who sees your data: authorised Arwell staff and, for manual verification, also authorised staff of the campaign organiser in your country (as our processor). They see your first name, e-mail address, domain, school and subjects.

Do you have to provide this data? No law requires you to. Your e-mail address, first name, school and subjects are, however, necessary to create and verify a teacher account; without them we cannot set up or verify the account.

What you will see about students: only aggregate results for your school (number of participants, points, ranking) and for classes with at least 10 participants. You do not see individual students, their nicknames or data from other schools.

3. Ambassadors

The ambassador programme is voluntary and is intended for students aged 15 or over in the Czech Republic and 16 or over in Slovakia. We do not offer it to younger students.

What data we process: your e-mail address, country, school and the date you chose it, school-leaving year, ambassador number, a record of your consent (version and time) and of your declaration that you meet the age limit, the times of account creation, last sign-in and any ending of your participation, your commitments to put up QR codes, and the ideas you send us.

Linking to a game profile. If you link your ambassador account to a game profile in a campaign, a link is created between your e-mail address and the otherwise pseudonymous game profile (nickname, school, class, points). This lets us credit you with points for classmates you invite and show you on the ambassador leaderboard. Linking is voluntary. The link ends when the ambassador account is deleted or when the game profile is deleted after the campaign ends.

Who will see you: the ambassador leaderboard (ambassador number, nickname, school, points) is visible only to other ambassadors. Nobody except authorised Arwell staff sees your e-mail address.

Certificate. After a campaign ends you can download a certificate for your CV. We use the name you type on it only to create that PDF at the moment you download it. We don't store it or record it anywhere. The certificate contains only what you see in your ambassador profile (school, points, place, rank, badges). It includes your app nickname only if you tick it. Legal basis: your consent to take part in the programme (Art. 6(1)(a) GDPR); entering the name is voluntary.

Legal basis: your consent (Article 6(1)(a) GDPR), which you give when joining the programme and can withdraw at any time – by ending your participation or deleting your account in your profile, or by e-mail. Withdrawal does not affect processing carried out before it. Protection against misuse and keeping records of consent: legitimate interests (Article 6(1)(f) GDPR).

Age. We check age with a question you answer yourself; we do not ask for a date of birth. If we find that a younger student has joined the programme, we delete their account.

Do you have to provide this data? No. Without an e-mail address, a school and the age declaration, however, you cannot join the ambassador programme.

4. Reminder about the next campaign

If the organiser enables it for a campaign, a student aged 15 or over (in the Czech Republic) or 16 or over (in Slovakia) can enter an e-mail address at the end of the campaign so that we can tell them about the next campaign. The form first asks whether the student is at least 15 or 16 respectively; without that confirmation no address can be entered and nothing is stored. We do not otherwise ask for an age or a date of birth.

Who is responsible for the reminder. For campaigns organised by Club Alpbach Czechia & Slovakia, z. s. and marked as such in Eolin (in 2026, Pauza na Samet and Pauza na Nežnú), Arwell Works s.r.o. and Club Alpbach Czechia & Slovakia, z. s., company ID (IČO) 218 86 369, registered office at Jar. Svobody 235/36, 664 47 Střelice, Czech Republic ("CACS") are joint controllers under Article 26 GDPR of the list of reminder addresses (the interest list). Arwell is responsible for technical operation, security, the notice that the next campaign is starting and handling requests. CACS receives the confirmed addresses given on a form that named CACS as an export (a CSV file) and sends its messages about its campaigns, activities and projects with its own tools; it is responsible for their content. You can exercise your rights with either of them – at privacy@arwell.works or at pauzanasamet@clubalpbach.cz; whoever receives your request will make sure it is dealt with. For all other campaigns Arwell is the sole controller, the form does not name CACS and CACS does not receive the addresses.

What we use the address for. For campaigns organised with CACS, Arwell and CACS use the address to tell you about the programme's next campaigns and about related CACS activities and projects; for other campaigns, Arwell uses it only for a single notice that the next campaign is starting. We use it for nothing else and pass it to nobody else. If you signed up before the form also named CACS, we will use your address only for a single notice that the next campaign is starting, as we promised you then, and CACS will not receive it.

• We store only the e-mail address, the campaign we are announcing, the language, the confirmation status and time, the age threshold you confirmed, and whether the form also named CACS. We do not link the address in any way to a game profile, school or class.
• We send the e-mail only after you confirm via the link we send you (double opt-in).
• Every e-mail contains a one-click unsubscribe link; we then delete the address immediately, and it disappears from backups within 7 days at the latest.
• We delete an unconfirmed address after 7 days, and a confirmed one within 30 days after the start of the campaign we are announcing, but no longer than 12 months after confirmation.
• The copy CACS receives by export for campaigns organised with CACS is kept by CACS for no longer than 14 months from the export; CACS deletes an address from its copy once you withdraw your consent.
• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time – with the unsubscribe link in every e-mail or at either of the contacts above. Withdrawal does not affect processing before it.

5. Signing in

You sign in with a one-time code that we send you by e-mail; we do not store passwords. Requesting a code creates a sign-in record with your address. Your sign-in is stored in a strictly necessary cookie that works only on the eolin.app website.

6. Processors and transfers

Your data is processed by our processors: Supabase (database and sign-in, EU – Ireland), Vercel (running the website, EU – Dublin, Ireland) and Resend (sending e-mails, including sign-in codes, EU – Ireland). These providers are based in the USA; any access from the USA is protected by standard contractual clauses (Article 46 GDPR) and, for certified providers, also by the EU–US Data Privacy Framework (Article 45 GDPR). We will give you a copy of these safeguards on request. Details are in the List of processors document. We do not sell the data or use it for advertising.

7. How long

• Teacher and ambassador accounts: until deleted, at most 12 months after the last sign-in (for ambassadors, also 12 months after leaving the programme). When we delete an account, we also delete the sign-in e-mail address.
• Reason for rejecting verification: 30 days.
• Ambassadors' ideas: separated from the author when the account is deleted, and deleted after a further 12 months.
• Reminders: see section 4.
• Details are in the Data retention and deletion document.

8. Your rights

Right to object. We verify teachers (section 2 and the Verification data document) and protect the ambassador programme against misuse (section 3) on the basis of legitimate interests. You can object to this at any time on grounds relating to your particular situation, at privacy@arwell.works. We will comply unless we demonstrate compelling legitimate grounds that override your interests, or the data is needed to establish, exercise or defend legal claims. Without verification, however, we cannot give you access to the school's results.

You have the right of access, rectification, erasure, restriction of processing and portability, the right to object to processing based on legitimate interests, and the right to withdraw your consent at any time.

• Downloading your data: in your profile on eolin.app ("Download my data"), in a machine-readable format.
• Deleting your account: in your profile on eolin.app, immediately; the data disappears from backups within 7 days at the latest.
• Other requests: to privacy@arwell.works; for the reminder (section 4), also to Club Alpbach Czechia & Slovakia at pauzanasamet@clubalpbach.cz. We will reply without undue delay and within one month at the latest; dealing with your request is free of charge.
• Complaints: to the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz) or, from Slovakia, also to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, www.dataprotection.gov.sk).

We do not carry out automated decision-making with legal effects. Automatic teacher verification based on your e-mail domain can only verify you; a rejection is always assessed by a person.