1. Introduction

The protection of personal data is very important to us. In this Privacy Policy, we explain what personal data we process in connection with our website, our online tutoring service, the Konomondo learning app, and our communication with users and students.

The entity responsible for data processing is:

edventure Studios GmbH
Elisabethstraße 85/W616
8010 Graz
Austria
Email: office@edventure.studio
Phone: +43 676 945 05 30

This Privacy Policy applies to our website, our online tutoring services, the Konomondo learning app, our communications with users and students, and the administration of existing contractual relationships.

To the extent that personal data of individuals residing in Switzerland is processed, we additionally comply with the applicable provisions of the Swiss Data Protection Act.

2. Storage Location and Hosting

Our website, our internal systems, and customer data are hosted on servers operated by Hetzner Online GmbH in Germany.

In particular, the following data may be processed:

• IP address
• Technical access data
• Server log files
• Website data
• Customer data
• Contract data
• Communication data
• Learning materials and other content provided as part of the tutoring services

Processing is carried out to provide our website, for technical administration, to fulfill contracts, to ensure IT security, and to manage our services.

The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures, as well as Article 6(1)(f) of the GDPR based on our legitimate interest in the secure and functional operation of our website and our systems.

3. Website and Access Data

When you visit our website, technically necessary data is processed to display and operate the website. This includes, in particular:

• IP address
• Date and time of access
• Pages accessed
• Browser type and version
• Operating system used
• Referrer URL
• Technical server log files

This data is processed to provide the website, ensure technical security, and analyze errors.

The legal basis is Art. 6(1)(f) of the GDPR.

4. Registration and Contract Data

When users register for our services, book a tutoring package, or enter into a contract with us, we process the data provided during this process.

This includes, in particular:

• User’s name
• Student’s name
• Email address
• Phone number
• Billing address
• Booked package
• Payment and billing data
• Grade level
• Details regarding tutoring needs
• Organizational information regarding tutoring

This data is processed to conclude contracts, organize tutoring services, issue invoices, manage payments, and provide support to students.

The legal basis is Article 6(1)(b) of the GDPR. To the extent that statutory retention obligations apply, processing is additionally based on Article 6(1)(c) of the GDPR.

5. CRM and Internal Administration

To manage clients, contract data, and tutoring organization, we store personal data in an internal CRM spreadsheet in our Nextcloud instance on our server.

In particular, the following data may be processed:

• Name and contact information
• Billing information
• Booked tutoring package
• Payment status
• Scheduled appointments
• Organizational notes
• Information regarding tutoring needs
• Internal support notes

This processing is carried out for the purpose of organizing, conducting, and managing our tutoring services.

The legal basis is Article 6(1)(b) of the GDPR and Article 6(1)(f) of the GDPR, based on our legitimate interest in efficient customer and contract management.

6. Online Tutoring via Jitsi

We use our own Jitsi server to conduct online tutoring sessions.

In particular, the following data may be processed:

• Name or display name
• Audio and video data during the session
• Chat messages
• Technical connection data
• Time and duration of participation
• IP address
• Device and browser information

Processing is carried out for the purpose of conducting the booked online tutoring sessions.

The legal basis is Article 6(1)(b) of the GDPR.

Online tutoring sessions are generally not recorded. Recording takes place only if the explicit consent of the data subjects has been obtained in advance.

7. Use of Miro in Tutoring

We use the Miro platform for interactive online tutoring sessions. Students do not need their own Miro account for this; instead, they receive guest links to participate.

In particular, the following data may be processed:

• Name or display name
• Content on whiteboards
• Text entries
• Drawings
• Comments
• Uploaded files
• Technical usage data

Processing is carried out for the purpose of conducting interactive online tutoring sessions and collaboratively working on learning materials.

The legal basis is Article 6(1)(b) of the GDPR.

8. Communication via WhatsApp Business

We use WhatsApp Business to communicate with users and, to the extent necessary for organizing or conducting tutoring sessions, also with students.

In particular, the following data may be processed:

• Name
• Phone number
• Profile information
• Message content
• Transmitted files
• Photos and screenshots
• Learning materials
• Technical communication data

Communication via WhatsApp Business is used to organize tutoring sessions, coordinate schedules, provide customer support, answer questions, and fulfill existing contractual obligations.

The legal basis is Article 6(1)(b) of the GDPR, to the extent that the communication is necessary for the performance of a contract. To the extent that WhatsApp Business is used for other purposes, processing is based on Article 6(1)(f) of the GDPR or, if necessary, on consent pursuant to Article 6(1)(a) of the GDPR.

The use of WhatsApp Business is voluntary. Users may alternatively contact us via email.

9. Submitted Study Materials and Screenshots

When users or students send us study materials, assignments, class notes, screenshots, photos, or other school-related documents via WhatsApp Business, email, or other communication channels, we store and process these documents for the purpose of preparing for, conducting, and following up on tutoring sessions.

These materials may include, in particular, the following data:

• Student’s name
• Grade level
• Assignments
• Information on performance or academic progress
• Handwritten or digital notes
• Content from school materials

Processing is carried out exclusively for the purpose of conducting and improving tutoring sessions.

The legal basis is Article 6(1)(b) of the GDPR.

Such documents will be deleted no later than 12 months after the end of the contractual relationship, provided there are no legal retention requirements or legitimate reasons for longer storage.

10. Konomondo Learning App

Depending on the selected package, students are granted access to the Konomondo learning app. The Konomondo learning app is used to complete practice exercises, review learning content, and support online tutoring.

In particular, the following data may be processed:

• Email address
• Unique user or player ID
• Learning progress
• Completed exercises
• Answers and inputs
• Evaluations of learning objectives
• Technical usage data

To log in to the Konomondo learning app, a Unity account or authentication via Unity is also required. In this process, personal data may also be processed by Unity. Unity provides further information on this in its own privacy policy.

Personal learning progress may be automatically evaluated in the Konomondo learning app in the future. These evaluations serve to create individual learning goals, visualize learning progress, and improve support within the framework of online tutoring.

The legal basis is Art. 6(1)(b) GDPR, insofar as the processing is necessary for providing the Konomondo learning app and for conducting tutoring. To the extent that any additional analyses are based on consent, the legal basis is Article 6(1)(a) of the GDPR.

11. Learning Goal Analyses

Learning goal analyses may be created as part of the tutoring. These serve to illustrate students’ learning progress, identify learning needs, and plan tutoring in a targeted manner.

In particular, the following data may be processed:

• completed assignments
• correct and incorrect answers
• learning progress
• assessments of learning status
• recommendations for further exercises
• organizational support notes

The processing is carried out to conduct and improve tutoring.

The legal basis is Article 6(1)(b) of the GDPR.

12. Matomo

We use Matomo to analyze the use of our website. Matomo is hosted on our own server. We do not use Google Analytics.

When using Matomo, the following data in particular may be processed:

• IP address in anonymized form
• Pages visited
• Time of access
• Duration of visit
• Browser used
• Operating system used
• Referring page
• Interactions with the website

We have configured Matomo to be privacy-friendly. To the extent that Matomo is used without consent, this is done only in a privacy-friendly configuration, specifically with anonymized IP addresses. To the extent that consent is required for individual functions, processing is based on this consent.

The legal basis is Article 6(1)(f) of the GDPR, provided that Matomo is used in a privacy-friendly manner and without cookies that require consent. Otherwise, the legal basis is Article 6(1)(a) of the GDPR.

13. Cookies and Consent Management

Our website uses cookies and similar technologies. These may be technically necessary cookies or cookies used for analytical and statistical purposes.

Technically necessary cookies are required to provide the website and enable basic functions.

For non-necessary cookies, we obtain prior consent where required by law. Consent may be revoked or modified at any time.

We use a consent management tool to manage consent.

14. YouTube and Embedded Content

Our website may contain embedded content from third-party providers, in particular videos or content from external platforms. Embedded content generally behaves as if the respective external website were being visited directly.

Currently, no YouTube videos are actively embedded on our website. Should YouTube videos or other external content be embedded in the future, personal data may be transmitted to the respective provider when this content is accessed.

15. Offers, Price Changes, and Information About Our Services

If users provide their consent as part of the contract conclusion, we will use the contact information provided to inform them about current offers, new services, changes to our offerings, and price changes.

Consent may be revoked at any time with future effect. Revocation may be made, in particular, by email to office@edventure.studio.

The legal basis is Article 6(1)(a) of the GDPR.

Contract-related information, in particular changes to existing contractual terms, billing information, or necessary organizational notices, may be transmitted within the framework of the existing contractual relationship regardless of such consent.

16. Recipients of Personal Data

Personal data may be transferred to the following recipients or service providers to the extent necessary to provide our services:

• Hosting providers
• Providers of video conferencing and communication tools
• Providers of online whiteboards
• Providers of authentication services
• Payment and accounting service providers
• IT service providers
• Tax and legal advisors
• Government authorities, to the extent that a legal obligation exists

Personal data is disclosed only to the extent necessary for the performance of the contract, to comply with legal obligations, based on legitimate interests, or based on consent.

17. Retention Period

Personal data is stored only for as long as necessary for the respective purposes.

Contract and billing data are stored in accordance with statutory retention requirements.

Course materials, screenshots, photos, and other submitted materials are generally deleted no later than 12 months after the end of the contractual relationship, unless there are statutory retention requirements or legitimate reasons for longer storage.

Data processed on the basis of consent is deleted as soon as consent is withdrawn, provided there is no other legal basis for further processing.

18. Data Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, and unauthorized disclosure.

Our website uses SSL or HTTPS encryption. Access to internal systems is restricted and is granted only to authorized persons.

18. Rights of Data Subjects

Data subjects have the following rights, in particular, in accordance with applicable legal provisions:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent
• Right to lodge a complaint with a data protection supervisory authority

Inquiries may be directed to office@edventure.studio.

20. Right to lodge a complaint

Data subjects have the right to lodge a complaint with a data protection supervisory authority if they believe that the processing of their personal data violates data protection regulations.

In Austria, the Austrian Data Protection Authority is specifically responsible.

21. Third-Party Websites and Services

Our website may contain links to third-party websites or services. The respective providers are responsible for data processing carried out by these third parties. We have no control over what personal data these providers process when their websites or services are accessed.

22. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy if our data processing practices, our technical systems, or legal requirements change.

Effective: July 1, 2026