Privacy and data protection policy

What your personal data is

Your personal data is any information, on paper or in electronic form, that can lead, directly or in combination with other information, to your unique identification or to your being located as a natural person. Depending on your role on the Platform, it includes information such as your name, date of birth, enrolment, class and attendance details, attendance records, activities and daily reports, role and access rights, postal and email addresses, landline and mobile telephone numbers, documents, messages, photos or videos posted on the Platform, identifiers of your equipment or devices (computer, smartphone, tablet), connection details and log files (log files, cookies and the like), and any other information that allows you to be uniquely identified under the General Data Protection Regulation — Regulation (EU) 2016/679 (GDPR), Law 4624/2019, Greek law in force from time to time, and the decisions and guidelines of the Hellenic Data Protection Authority (HDPA).

What personal data we collect

We process your personal data in accordance with the law, and protect it, when you visit our website, when you contact us, when the educational institution you are connected with enters into a contract with us and creates user accounts on the Platform, or when you sign in and use the functions of the Platform (enrolment and class details, attendance, activities and daily reports, fees and payments, photo and video albums per class, documents, messages and announcements).

In particular, depending on the category of user you belong to and the functions your educational institution has enabled, the personal data that may be processed through the Platform includes:

Students

• name, date of birth, gender and student number,
• class, year group and enrolment details at the educational institution,
• attendance and absences, with their reasons,
• activities and daily reports,
• fees (tuition, instalments) and recorded payments,
• the people authorised to collect the student (name, relationship, telephone),
• health notes (such as allergies, medical conditions and medication) and documents (such as medical certificates and signed declarations), where the educational institution records them (see the note below), and
• photos and videos posted by the institution's staff in class albums.

Students who are minors do not have their own account on the Platform; they are represented by their guardians. Only adult learners may have their own account, which the educational institution creates.

Parents and legal guardians

• name,
• contact details (such as email address, telephone number, postal address),
• family relationship or relationship of representation with the student, and the link to the student's record, and
• messages, announcements and other communication exchanged through the Platform with teachers or the institution's management.

Teachers and other staff of educational institutions

• name,
• contact details (such as work or personal email address, telephone number),
• role, assigned classes and access rights on the Platform,
• the attendance, activity and daily-report entries they make, and the documents, photos or videos they post, and
• messages and announcements they exchange through the Platform with guardians, adult learners or colleagues.

Educational institutions (their legal representatives, administrators and contact persons)

• name, position and work contact details of the people who represent the school, tutoring centre or educational institution or manage its account, and
• billing details, tax details (tax ID, tax office, registered name, registered office) and payment details under the commercial contract for services between the educational institution and the Company.

Technical account, connection and browsing data (for all users of the Platform and visitors to the website)

• account identification details (email address as user name, hashed password, unique user identifier),
• technical connection and security logs, such as the date and time of sign-in, Internet Protocol (IP) address, browser type and version, and operating system,
• where a user turns on notifications, their browser's notification subscription identifier, and
• data collected through cookies or similar technologies as described in section 7.

Note on special categories of data (GDPR Article 9): The Platform gives the educational institution an optional health-notes field for each student (such as allergies, medical conditions and medication) and the ability to keep documents (such as medical certificates), so that staff know what is necessary for the student's safety and care. This is health data, a special category of personal data. The Platform has no fields for learning difficulties or special educational needs, religious or philosophical beliefs, or racial or ethnic origin, but such information may occasionally be included in free-text fields, messages or documents on the initiative of users themselves (for example documents justifying a student's absence, or messages from guardians to the school or tutoring centre). Recording and any other processing of such data takes place under the responsibility of the educational institution concerned, requires a specific assessment of lawfulness under GDPR Article 9(2) and Article 22 of Law 4624/2019, and is subject to enhanced security safeguards and restricted access (see section 3 below). We ask users not to post sensitive data in messages, documents or albums that a wider circle of users can see.

Lawful processing

Your personal data is processed only for specified, explicit and legitimate purposes, under Article 6 of Regulation (EU) 2016/679 (GDPR) and Law 4624/2019. Depending on the nature of each function of the Platform, processing is based on the performance of a contract or on steps taken at the data subject's request before entering into a contract (GDPR Art. 6(1)(b)), on compliance with a legal obligation of the controller (GDPR Art. 6(1)(c)), on the legitimate interests of the controller or a third party, provided that these are not overridden by your interests or fundamental rights and freedoms, in particular where the data subject is a child (GDPR Art. 6(1)(f)), or, in exceptional cases, on the protection of vital interests (GDPR Art. 6(1)(d)). Consent (GDPR Art. 6(1)(a)), which you may freely withdraw at any time without affecting the lawfulness of processing before the withdrawal, is not a general legal basis for all the functions of the Platform; it is asked for only where a specific optional processing operation is not covered by another legal basis.

Because the Platform is used by schools, tutoring centres and other educational institutions, the purposes and the corresponding legal bases fall into two categories, according to who determines the purposes and means of the processing:

A. Purposes for which the educational institution is the controller (and the Company acts as processor under GDPR Article 28)

For the functions below, the Company processes data solely on behalf of and on the instructions of the school, tutoring centre or educational institution that the student attends or the teacher works for. The exact legal basis of each processing operation is determined by the educational institution itself in the specific privacy notice it gives you:

1. Keeping enrolment, class and contact details of students, guardians and staff: Students' identification, enrolment and class details, the details of guardians and of the people who collect the student, and the details of staff are processed to organise attendance and the educational work. As regards the institution's relationship with parents/guardians (or adult learners), processing is as a rule necessary for the performance of the contract for educational services (GDPR Art. 6(1)(b)); as regards teachers, it is based on the performance of their employment or independent services contract (GDPR Art. 6(1)(b) and Article 27 of Law 4624/2019). Where education law makes specific provision for a particular level of education, processing may also be based on a legal obligation of the institution (GDPR Art. 6(1)(c)).

2. Recording, keeping and sharing attendance, absences, activities and daily reports: This processing serves to monitor the student's attendance and to keep the student's parents or legal guardians (or the student, if an adult) accurately informed. The legal basis the institution applies is the performance of the contract for educational services (GDPR Art. 6(1)(b)) and, where education law requires student and attendance registers to be kept, compliance with a legal obligation of the institution (GDPR Art. 6(1)(c)).

3. Keeping fees and payment records: Recording tuition fees, instalments and payments per student and family serves the financial management of the institution's relationship with guardians. The Platform records payments but neither makes nor handles them. The legal basis is the performance of the contract for educational services (GDPR Art. 6(1)(b)) and, where applicable, the institution's tax obligations (GDPR Art. 6(1)(c)).

4. Communication between teachers, the institution's management and parents/guardians: Messages, announcements and updates exchanged on the Platform serve smooth educational cooperation, informing guardians about attendance matters and the administrative organisation of classes. The processing is based on the performance of the contract for educational services (GDPR Art. 6(1)(b)) and on the institution's legitimate interest in effective and secure communication within the school community in a closed digital environment, balanced against users' rights (GDPR Art. 6(1)(f)).

5. Photos and videos of students: The Platform has no areas open to the general public; all its content is visible only to signed-in users of the same educational institution. Photo and video albums are visible only to the classes the institution chooses. Particular care is needed to distinguish content posted only within the closed digital environment of one class for educational purposes from the posting of students' photos or videos to a wider circle of users beyond their own class, which is not a function necessary for providing education. Posting photos and videos of students requires, at the institution's discretion and in any case for posting beyond the student's own class, prior, specific, explicit and freely revocable consent (GDPR Art. 6(1)(a)), collected and documented under the institution's responsibility from the minor's parents/legal guardians (or from the student, if an adult). Refusing or withdrawing that consent does not affect the student's attendance or access to the essential functions of the Platform in any way.

B. Purposes for which the Company (the Provider) acts as an independent controller

For the functions below, the Company itself determines the purposes and means of the processing:

1. Concluding, performing and managing the commercial contract with educational institutions, invoicing and accounting: We process the details of the legal representatives, administrators and contact persons of the schools, tutoring centres and educational institutions we work with, and billing and payment details, in order to activate the service, meet our contractual obligations and issue the invoices the law requires. The legal basis is the performance of the contract or steps taken at the prospective customer's request before entering into a contract (GDPR Art. 6(1)(b), where the counterparty is a natural person or sole trader), the Company's legitimate interest in performing the contract with a legal entity through its representatives and agents (GDPR Art. 6(1)(f)), and the Company's compliance with its tax and accounting obligations (GDPR Art. 6(1)(c)).

2. Technical account management, user authentication, information security and prevention of fraud or abuse: We process access credentials, technical connection metadata and log files (IP addresses, timestamps) to let authorised users sign in securely, to prevent unauthorised access or malicious actions, to detect technical faults, and to ensure the integrity, confidentiality and availability of the Platform. The legal basis is the overriding legitimate interest of the Company and of the institutions we work with in network and information security and in protecting users' data, including that of minors (GDPR Art. 6(1)(f)), together with the legal obligation to take appropriate security measures under GDPR Article 32 (GDPR Art. 6(1)(c)).

3. User support and answering requests, questions or reports of technical problems: We process the contact details and content of messages you send us directly through the contact forms on our website or by email, in order to answer questions about our services, arrange a demonstration, resolve technical issues and consider your suggestions or complaints. The legal basis is the Company's legitimate interest in properly serving and supporting its users and customers (GDPR Art. 6(1)(f)) or, where the request comes from a prospective customer, steps taken before entering into a contract (GDPR Art. 6(1)(b)).

4. Operating the website, analysing visits and improving the Platform: For the strictly necessary technical cookies and connection data needed to transmit communications and to navigate the website and the Platform, processing is based on the Company's legitimate interest in providing them securely and properly (GDPR Art. 6(1)(f)) and on Article 4(5) of Law 3471/2006. By contrast, Google Analytics is used to analyse visits to the website only if you have given prior explicit consent (GDPR Art. 6(1)(a) and Article 4(5) of Law 3471/2006 — see section 7); the Platform uses no analytics tools. The Company uses aggregated, fully anonymised usage statistics to assess and improve the technical performance of the Platform; producing them is based on its legitimate interest (GDPR Art. 6(1)(f)) and involves no individual profiling of users or students, and no use of the data to train artificial intelligence models.

5. Compliance with legal obligations and establishing, exercising or defending legal claims: We process the strictly necessary data where required to comply with requests from supervisory, judicial, prosecuting or tax authorities, or to meet our obligations under the GDPR, such as handling requests to exercise rights and security incidents (GDPR Art. 6(1)(c)), and to defend our legal rights before courts or authorities (GDPR Art. 6(1)(f)).

C. Specific rules for minors' data, special categories of data and marketing

1. Processing of minor students' data and when GDPR Article 8 and Article 21 of Law 4624/2019 apply: A minor student's enrolment at the institution and the resulting use of the Platform's functions are not based on the minor's consent, but on the contract for educational services that the minor's parents or legal guardians conclude with the institution, or on the institution's legal obligations. It is expressly clarified that the specific age rule of GDPR Article 8(1) and Article 21 of Law 4624/2019 — under which processing of a minor's data on the basis of consent is lawful where the minor is at least 15 years old, while below that age consent must be given or authorised by the minor's legal representative — applies only where an information society service is offered directly to a child and the processing is based on consent (GDPR Art. 6(1)(a)), without affecting general contract law (GDPR Art. 8(3)). The Platform is not offered directly to children: only the educational institution creates user accounts, no one can register on the Platform themselves, and students who are minors do not have their own account. The rule therefore does not apply to the use of the Platform. Regardless of the above, for specific processing operations concerning minor students (such as posting their image under paragraph A.5), the institution may in any case require the consent of those exercising parental responsibility or custody.

2. Special categories of personal data (GDPR Article 9 and Article 22 of Law 4624/2019): As noted in section 2, the Platform gives the institution an optional health-notes field and the ability to keep documents such as medical certificates. Recording such data, and any special-category data included in documents or messages (for example medical certificates justifying absences, information needed to support a student's learning, or information needed to meet employment-law obligations towards staff), is permitted only after a specific assessment by the institution as controller, where one of the exceptions of GDPR Article 9(2) applies, in combination, as the case may be, with Article 22 (or, for employees, Article 27(3)) of Law 4624/2019 (in particular explicit consent under GDPR Art. 9(2)(a); carrying out obligations and exercising rights in employment, social security and social protection law under GDPR Art. 9(2)(b) and Articles 22(1)(a) and 27(3) of Law 4624/2019; or medical diagnosis and the provision of health or social care by a person bound by professional secrecy under GDPR Art. 9(2)(h) and Article 22(1)(b) of Law 4624/2019), and provided that appropriate technical and organisational safeguards are maintained. On the Platform, a student's health notes and documents are visible only to the institution's management, to the teachers of the student's classes and to that student's own guardians.

3. No marketing to students or users of the Platform: The Company does not use the personal data of students, parents/guardians or teachers held on the Platform for direct marketing of products or services or to send advertising messages.

The principles of collection and processing

This Data Protection Policy aims to inform you of the terms on which we collect, process and transfer the personal data we may collect as controller or as processor (on behalf of your educational institution). The Company applies the principles of processing of Article 5 of Regulation (EU) 2016/679 (GDPR): (a) lawfulness, fairness and transparency, (b) purpose limitation, (c) data minimisation, (d) accuracy, (e) storage limitation, (f) integrity and confidentiality, and (g) the accountability of the controller (GDPR Art. 5(1) and (2)).

The Company respects and safeguards your rights as a data subject, as set out in Chapter III (Articles 12 to 22) of the GDPR and specified in Articles 31 to 35 of Law 4624/2019:

• the right to transparent information (GDPR Articles 12, 13 and 14),
• the right of access to your data and to obtain a copy of it (GDPR Article 15),
• the right to have inaccurate data corrected or incomplete data completed (GDPR Article 16),
• the right to erasure (the "right to be forgotten"), under the conditions of the law (GDPR Article 17),
• the right to restriction of processing (GDPR Article 18),
• the right to data portability, where processing is based on consent or on a contract and is carried out by automated means (GDPR Article 20),
• the right to object to processing based on legitimate interest (GDPR Article 21),
• the right to withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing based on it before its withdrawal (GDPR Art. 7(3)), and
• the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (GDPR Article 22). The Company makes no such decisions.

The above apply without any distinction to all the processing we carry out and to all the services we provide through the Platform.

How to exercise your rights

• Who to address (by role): For processing where the Company acts as independent controller (see section 3.B), you can send your request directly to the Company at the contact details in section 13. By contrast, for data held on the Platform as part of the educational institution's operations (such as enrolment details, attendance, activities, daily reports, health notes, payments, photos and messages with teachers), where the controller is the private school, tutoring centre or educational institution concerned and the Company acts as processor (see section 3.A), requests must be made directly to your educational institution. If you send such a request to the Company, we will forward it without delay to the institution concerned and assist it technically in handling it, in accordance with GDPR Art. 28(3)(e) and its written instructions.
• Rights of minor students: Rights concerning minor students are exercised by their parents or those exercising parental responsibility / legal guardians, or by the minors themselves where the law recognises their own capacity (in particular from the age of 15, for processing based on their own consent under Article 21 of Law 4624/2019).
• Response time and identity checks: The controller answers your requests free of charge, without undue delay and in any event within one (1) month of receipt. That period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests, in which case you will be informed of the extension and the reasons for it within the first month (GDPR Art. 12(3)). If we have reasonable doubts about the identity of the person making the request or about the relationship of representation of a minor, we may ask for additional information necessary and proportionate to confirm identity (GDPR Art. 12(6)). The rights are subject to the legal limitations of GDPR Articles 17(3) and 23 and of Articles 31 to 35 of Law 4624/2019 (such as compliance with legal obligations, protection of the rights of others, or the establishment, exercise or defence of legal claims).
• Right to complain and to judicial remedy: If you consider that the processing of your personal data infringes the GDPR or national law, or if you are not satisfied with the answer to your request, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) (1-3 Kifisias Ave., 115 23 Athens, Greece, tel. +30 210 6475600, website: www.dpa.gr, email: contact@dpa.gr), under GDPR Article 77, and the right to an effective judicial remedy before the competent courts under GDPR Articles 78 and 79.

How your personal data is collected

Personal data is collected in the operation of the Platform and our website in the following ways, depending on your role and the role of the Company:

• Through the educational institution we work with (school, tutoring centre or other educational body): When the institution you attend, work for, or where you are a student's guardian enters or imports into the Platform (including from Excel files during the initial setup) the enrolment, class, role and access-rights details needed to create and manage user accounts, or when its authorised staff record attendance, activities, daily reports, payments, health notes, announcements, documents, photos and videos.
• Directly from you when you use your account on the Platform: When you activate your account from the link emailed to you, sign in, turn on notifications and exchange messages with teachers or the institution's management through the Platform.
• When contracting with educational institutions and contacting support: When representatives of educational institutions or users contact the Company by email or through the website's contact and demo-booking forms to activate the service, to obtain invoices (for the institutions we work with), to resolve technical issues, or to send questions, suggestions and complaints.
• When you visit and browse our website and the Platform (technical usage data and cookies): When you visit our web pages or sign in to the Platform, the strictly necessary technical connection and security metadata is collected automatically from your device, such as your Internet Protocol (IP) address, the date and time of connection (log files), your operating system and browser type/version, and — only if you have given prior explicit consent — information through non-essential cookies on the website (see section 7).
• Verification of age or of parental responsibility/representation: The Company carries out no age checks, because only the educational institution creates accounts and minor students do not have their own account (see section 3.C.1). A guardian's relationship with a student is stated and checked by the educational institution, as controller, when it records the details.
• From public and supervisory authorities: When we receive documents, requests, orders, court documents or warrants from public bodies, such as supervisory, prosecuting, judicial or tax authorities, acting within their legal powers to investigate criminal offences, prevent fraud or protect legal interests (such as the security of information systems and intellectual property rights in the software).

Minimisation, storage and deletion of your data

The Company applies the principle of data minimisation (GDPR Art. 5(1)(c)) and collects or processes only the personal data strictly necessary for signing in to and securely using the Platform, providing its functions and communication between teachers, management and guardians, and managing the contractual relationship with the educational institutions we work with.

Personal data is kept in a form that permits identification of data subjects only for as long as necessary for the purpose of the processing, in line with contractual obligations and the law (GDPR Art. 5(1)(e)); after that it is securely deleted or fully and irreversibly anonymised. In particular, retention periods differ according to the Company's role:

A. Data held on behalf of the educational institution (the Company as processor)

For the data of students, parents/guardians and teachers processed as part of the educational institution's operations (such as user accounts, enrolment details, attendance, activities, daily reports, payments, health notes, documents, photos and messages on the Platform), the retention period is set by the institution as controller, on the basis of the educational contract, the length of the school or teaching year and any obligation under education law to keep school records. The Company keeps this data on the Platform only for as long as the service contract with the institution is in force and in accordance with its documented instructions. The Platform does not purge data automatically at the end of the school or teaching year; the institution deletes what it no longer needs. Whatever the institution deletes stays in the Platform's Trash for thirty (30) days, so that it can be restored, and is then permanently deleted.

The institution can export its data at any time while the contract is in force; on request, the Company provides a full export within ten (10) working days. When the contract expires or is terminated, access to the Platform closes and the data is kept for 30 days, during which the institution can resume its subscription or ask for its data to be returned. After 30 days the Company, in accordance with the contract under GDPR Art. 28(3)(g), permanently deletes all the data from its production systems, and the last backup copies are deleted within 7 days of that deletion, unless Union or Greek law requires the data to be stored. If the institution does not continue after its trial period, its space on the Platform is placed in maintenance mode for one week, during which nobody can sign in, and is then permanently deleted, with backup copies deleted within 7 days; on request, the Company sends the institution its data before deletion. Earlier, on the institution's instruction, the details of a particular student or teacher who leaves are deleted or anonymised.

B. Data held by the Company as independent controller

For processing where the Company acts as independent controller, the following retention periods apply:

• Contract and billing details of educational institutions: kept for the duration of the contractual relationship and, after it ends, for the periods required by tax law and the rules on limitation of claims.
• Security logs and technical connection metadata (log files, IP addresses): kept for up to thirty (30) days, unless a security incident or attempted breach is detected, in which case the necessary data is kept until the investigation is complete and any legal claims have been exercised.
• Requests sent through the website's contact and demo-booking forms: the messages, together with the IP address they were sent from, are kept for three (3) months from submission and then deleted automatically; the website's backup copies are deleted within twenty-eight (28) days. The notification our team receives for each new request contains no personal data. Messages sent directly to our email addresses are kept for as long as needed to handle the request.
• Data collected through cookies: kept for the lifetime of each cookie, as set out in section 7.

You can at any time ask (your educational institution or the Company, as set out in section 4 above) what data is held about you and ask for it to be corrected or deleted, unless further retention is required by law for tax, educational/archival, evidential or judicial purposes, for the establishment, exercise or defence of legal claims, or for the prosecution of unlawful acts (GDPR Art. 17(3)).

Cookie policy

Under Article 4(5) of Law 3471/2006 (which transposed into Greek law Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC and Article 170 of Law 4070/2012), together with Regulation (EU) 2016/679 (GDPR) and the recommendations and guidelines of the Hellenic Data Protection Authority (HDPA) on cookies and similar technologies (including the HDPA's recommendations of 25 February 2020), our website and the Platform use cookies and, where applicable, similar local storage technologies. Cookies are small text files stored on your device (computer, mobile phone, tablet) while you browse, to ensure that the Platform works properly, securely and without interruption, to authenticate signed-in users and, if you have given your consent, to measure visits to our website.

A. Strictly necessary and optional cookies — consent mechanism

Under Article 4(5) of Law 3471/2006, storing information, or gaining access to information already stored, on a user's or subscriber's device is treated as follows:

• Strictly necessary (functional/technical) cookies: Only technical storage or access whose sole purpose is to carry out the transmission of a communication over an electronic communications network, or which is strictly necessary to provide an information society service you have explicitly requested as a user, is allowed without your prior consent (such as identifying you and signing you in to your account on the Platform, keeping your session active, securing the connection and storing your cookie choices).
• Non-essential (optional) cookies (statistics/visit analysis): Any other category of cookies or similar trackers that is not technically necessary to provide the service is activated only if you have given prior, free, specific and explicit consent (opt-in) after clear and comprehensive information. You give that consent through the cookie management tool (cookie banner/settings panel) when you arrive on the website, with no pre-ticked boxes, with accepting and rejecting offered equally at the same level, and with a choice per purpose. You can withdraw your consent or change your choices at any time, as easily as you gave it, through the permanent "Cookie settings" link at the bottom of every page of our website, without retroactive effect; withdrawing deletes the Google Analytics cookies.

Note on the Platform: The Platform, which guardians, teachers, institutions' management and adult learners sign in to, uses only strictly necessary technical session and security cookies. It contains no third-party cookies or other trackers for advertising targeting, commercial profiling or behavioural tracking, no analytics tools and no social media plug-ins. If the Company considers enabling any non-essential measuring tool on the Platform, a prior specific assessment of lawfulness and proportionality, and an update of this policy, are required.

B. List of cookies used

Website tetradio.com

• klaro — Provider: the Company · Category: strictly necessary · Purpose: stores your cookie choices · Duration: six (6) months.
• A note in your browser's local storage (localStorage) — Provider: the Company · Category: strictly necessary · Purpose: stops the suggestion to read the website in English from appearing again once you have dismissed it · Duration: until you clear it in your browser. It is not sent to anyone.
• _ga, _ga_… — Provider: Google Ireland Limited (Google Analytics) · Category: statistics · Purpose: counting visits, the pages read and completed submissions of the contact and demo-booking forms, without any of the details entered · Duration: up to thirteen (13) months · Only with your consent.

Platform (each educational institution's address under the tetrad.io domain)

• SSESS… — Provider: the Company · Category: strictly necessary · Purpose: keeps you signed in and secures the session · Duration: up to twenty-three (23) days or until you sign out.
• PL… — Provider: the Company · Category: strictly necessary · Purpose: "Remember me", only if you choose it when signing in · Duration: thirty (30) days.
• A note in local storage (localStorage) — Provider: the Company · Category: functionality · Purpose: stores your choice of light or dark appearance and whether the side menu is open or closed · Duration: until you clear it in your browser. It is not sent to anyone.

C. Third-party tools, responsibility and browser settings

Our website includes — only with your prior consent — the Google Analytics visit-analysis tool of Google Ireland Limited. Until you consent, its code does not load and nothing is sent to Google. Once enabled, technical data about your browsing is collected and sent to Google (such as your IP address, which Google uses to estimate your country and, by its own account, does not store, and cookie identifiers). Advertising features and Google signals are off, and Google keeps the event data for two (2) months. Under the case law of the Court of Justice of the European Union (in particular C-40/17, Fashion ID, and C-210/16, Wirtschaftsakademie) and EDPB Guidelines 07/2020, for the collection and transmission of that data through the tool embedded in our website, the Company and Google may act as joint controllers (GDPR Article 26), or the Company may use Google as processor (GDPR Article 28), while Google alone is responsible for any further processing it carries out for its own purposes after the transmission, under Google's privacy policy. Where use of the tool involves a transfer of data outside the European Economic Area (EEA), the safeguards of Chapter V of the GDPR described in section 8 below apply.

Browser settings: In addition to our website's consent management tool (which is the main way to give and withdraw your consent to non-essential cookies), you can at any time change the settings of the browser on your computer or device to delete stored cookies, refuse cookies, or be asked to confirm each one. The Company does not treat a browser's default setting to accept cookies automatically as consent to non-essential cookies. Be aware, however, that if you use your browser settings to block even the Platform's strictly necessary technical cookies, you may not be able to sign in to your account.

Disclosure of your data to third parties

As a rule, the Company does not disclose your personal data to third parties, except to the extent necessary to provide, operate and technically support the Platform, perform the contract with your educational institution, and carry out the functions or requests relating to the services we provide. We do not sell personal data. In particular, the following categories of recipients may, as the case may be and only to the extent necessary for the relevant purpose, have access to or receive your personal data:

• Your educational institution (school, tutoring centre or other educational body): When you use the Platform as a guardian, adult learner, teacher or member of staff, or when details about you as a student are held, the data is held on behalf of the educational institution you belong to, which acts as controller and has access to it through its authorised management. Each institution's data is kept separate from every other institution's and is not shared between institutions.
• Authorised users of the Platform, according to their role and access rights:
  • The institution's management has access to the details of all the institution's students, guardians and staff. Teachers have access to the details of the students in the classes they teach (name, attendance, activities, daily reports, health notes) and to the messages they exchange with the guardians of those classes.
  • Parents/guardians have access only to their own child's record, attendance, activities, daily reports and payments, to the albums of their child's classes, and to their own communication with teachers and the institution. They cannot exchange messages with other guardians.
  • Minor students have no account. Adult learners see only their own details and communicate only with the teachers of their classes. No student or learner has access to another student's details. The photos and videos in an album are visible to the guardians and learners of the classes to which the institution has made it available.
• Providers of technical services and infrastructure (processors or sub-processors acting on behalf of the Company): To host and operate the Platform and the website securely, the Company works with the providers below, which act as processors (for the Company's own processing as controller) or as sub-processors (for processing on behalf of educational institutions, with each institution's prior specific or general written authorisation under GDPR Art. 28(2)):
  • Hosting of the Platform: top.host, in a data centre in Alblasserdam, the Netherlands (EU).
  • Hosting of the website and of our email mailboxes: top.host (Greece), with backups through Acronis in a data centre in France (EU).
  • Sending the Platform's emails (account activation, notifications): Scaleway (France, EU).
  • Sending the website's emails: SMTP2GO (New Zealand).
  • Notifications (push notifications): where a user turns them on, the notice passes through the push service of their browser (Google, Apple, Mozilla or Microsoft, depending on the browser). The notice is encrypted and contains no personal data, such as names or the content of messages.
  • The Company's accounting and tax adviser, only for the billing and contract details of the Company's contracts with educational institutions.
  • Google Ireland Limited (Google Analytics), for the website only and only with your consent (see section 7).
• Official state, judicial and supervisory bodies: Public authorities (such as prosecuting, judicial and law-enforcement authorities, the Cybercrime Division, the Hellenic Data Protection Authority (HDPA), the Ministry of Education, Religious Affairs and Sports, or the tax authorities), only when and to the extent that the Company or the educational institution has a legal obligation to comply with the law or with a binding judicial or administrative decision or order, and to prevent and investigate unlawful acts against the Platform and its users (for example unlawful access to information systems, or offences against personality or against minors).

Contractual safeguards with processors and sub-processors: We choose reliable providers that give sufficient guarantees of appropriate technical and organisational measures. Every processor or sub-processor that has access to personal data on our behalf is bound by a written contract under GDPR Art. 28(3) and (4), requiring it to process the data only on our documented instructions, to keep it strictly confidential, to take the security measures required by GDPR Article 32, and not to use or disclose the data for its own purposes. Where the website or the Platform lets you go, of your own choice, to independent websites or services of third parties outside our control, we recommend that you read their data protection policies carefully (see also section 12 below).

Where data is stored, and transfers outside the European Economic Area (EEA)

The Platform's data is hosted and stored only within the European Union, in a data centre in the Netherlands. The website's data is hosted in Greece and its backups in France.

The Company does not transfer the Platform's data to third countries outside the EEA. A transfer outside the EEA can occur only for the following, and takes place only in compliance with Chapter V (Articles 44 et seq.) of the GDPR, on the basis of an adequacy decision of the European Commission (GDPR Article 45):

• the emails the website sends through SMTP2GO, to New Zealand, for which the European Commission has adopted an adequacy decision, and
• with your consent, Google Analytics data, which may be transferred to Google LLC in the United States of America; Google LLC is certified under the EU-US Data Privacy Framework in accordance with Commission Implementing Decision (EU) 2023/1795 of 10 July 2023.

You can ask for information about the safeguards applied by contacting us at the details in section 13.

Security of your personal data

In all cases we take appropriate technical and organisational measures under GDPR Article 32 to ensure a level of security appropriate to the risk (especially given the nature of the data and the processing of minor students' data) and to protect the confidentiality, integrity, availability and reliability of the systems and of your data. Our aim is to ensure that your personal information is transmitted, stored and processed securely, so as to prevent its accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

To that end, the Company applies the following security measures:

• The Company's own access to data: Only the Company's authorised person, who is bound by a duty of confidentiality, has access to educational institutions' data, and only to the minimum necessary for technical support and the operation of the Platform.
• Technical and organisational security measures: encryption of data in transit (TLS); separate keeping of each educational institution's data, tested automatically before every new release of the Platform; role-based access control, so that each user has access only to the data strictly necessary; passwords stored only in hashed form; limits on failed sign-in attempts and checks against automated attempts at sign-in and password reset; a firewall and an intrusion-prevention system on the servers; files and photos served only after checking the user's access rights; and regular backups.
• Specific measures for minor students' data: Given the particular sensitivity of the minors' data held on the Platform, additional safeguards apply: minor students do not have their own account; the Platform has no public areas; each student's details are visible only to the management, the teachers of the student's classes and the student's guardians; albums are visible only to the classes the institution chooses; guardians cannot exchange messages with one another; and notifications contain no children's names or message content.
• Handling of personal data breaches: The Company has an internal procedure for detecting, recording and handling personal data breaches, so that, if an incident is detected that may put users' rights and freedoms at risk, it: (a) where it acts as independent controller, notifies the Hellenic Data Protection Authority (HDPA) without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of it, under GDPR Article 33, and informs the data subjects affected where the incident is likely to result in a high risk to their rights and freedoms, under GDPR Article 34; and (b) where it acts as processor on behalf of an educational institution, informs that institution without undue delay after becoming aware of the incident, so that the institution as controller can meet its own legal notification obligations, under the specific terms of the processing contract under GDPR Article 28 (see the important note in the introduction to this policy).

Advertising and marketing communications

The Company does not use the personal data of students, parents/guardians or teachers held as part of the operation of the Platform to show targeted advertising, to build consumer or behavioural profiles, or to send them commercial offers. The Platform contains no third-party advertising targeting tools. The Company sends no newsletters or advertising messages, and does not use the details it receives through the website's contact forms for that purpose.

Unsolicited communication and safe use of the Platform

The Company does not allow the Platform or its website to be used to send bulk or unsolicited email (spam), to harvest the email addresses or other contact details of students, guardians, teachers or other users by unauthorised means, or for any action that could harm, obstruct or overload the operation of the Platform or other users' secure access to it. In particular, no user may use the Platform to send other users messages with misleading, offensive or unlawful content, or for any form of harassment or bullying. If unauthorised, inappropriate or unlawful use of any function of the Platform is found, the Company may, after informing the educational institution concerned where its role as controller requires it, take the necessary and proportionate technical measures to protect the integrity of the Platform and of other users, including restricting or suspending access to a particular account, always in line with the principles of proportionality and transparency.

Links to third-party websites

Our website or the Platform may contain links to websites or services of independent third parties, which are operated and maintained solely by those third parties and are not controlled by us. The Company is not responsible for the content, practices or data protection policies of those third-party websites or services, to the extent that they operate independently and outside our control, and we recommend that you read their data protection policies carefully before giving them any of your information, as they may differ substantially from this Policy.

Contact for questions or comments

If you have questions, comments or requests about this Privacy and Data Protection Policy, or if you believe we have not followed the principles it sets out, please contact us:

• By email: privacy@tetradio.com
• By post: N. MICHALAKIS SINGLE-MEMBER P.C., Manou Chatzidaki 9, Agios Myronas, 700 13 Heraklion, Crete, Greece

Validity of this Policy

This Policy was published by the Company on 23 October 2026 and is subject to periodic improvement and review. The version and the date of the last update are shown at the top of the page.