NOTICE OF PERSONAL DATA PROCESSING
This Notice applies to the following UPSTRIVE web and mobile applications (“App”, “Apps”):
We are required to provide this Notice under the EU General Data Protection Regulation (GDPR). Please read it carefully and do feel free to contact us for any clarifications you may require.
Once your school signs the contract with UPSTRIVE (also as “We”, “Us”, and “Our”) you as the user receive an account that you can use as a part of the School account pool. By using the account as a student or a member of the school staff (“You”, “Data Subject”) you will provide data related to you – personal data. We will process (e.g. collect, use, store, analyze) this data.
We as the Data Processor have a detailed Data Processing Agreement signed with the School as Controller of the data. As the Data Processor, UPSTRIVE processes personal data on behalf of the school, which acts as the Data Controller. The school remains responsible for obtaining necessary consent from students or guardians in compliance with applicable laws.
This Notice explains how we process your personal data while you are using the UPSTRIVE.
We are committed to handling all personal data with respect and to complying with GDPR when processing your personal data.
The company responsible for processing your personal data and which has the capacity of the data Processor with regard to such processing is:
Upstrive GmbH – Techno-Z Urstein, Wissenpark Urstein, Urstein Sued 15, 5412 Puch bei Hallein, Austria, email: info@upstrivesystem.com.
Our data protection officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, E-Mail: datenschutz@heydata.eu.
We get your Personal Data from you directly, when you use the App.
We also get data related to You from the School (first name, last name, employee position, class, teacher, year, gender, etc.)
All the data we collect is used to measure and manage the wellbeing of the users and to monitor and improve the UPSTRIVE apps themselves (e.g. error logs and network data).
In order to use the App we need to process your data.
We process data based on the consent obtained by the school from students or their legal guardians. This consent allows us to collect, store, and use data for the purpose of providing the service. Schools are responsible for ensuring that all necessary permissions are in place.
We also process data based on legitimate interest to prevent any fraudulent activity as provided for by the Terms and Conditions, as well as to enable the security of the App and your undisturbed use of the App.
We may also use data for secondary purposes such as analysis of overall users’ activities. Please note that in such cases we tend to process aggregated data, thus anonymized data.
We may share data with data processors we have contractual relationships.
Should we need to transfer your Personal Data out of the country of your residence, including to countries outside the European Economic Area (EEA), we shall do so in accordance with the rules set by the GDPR (adequacy decisions of the EU Commissioner, or on the bases of the Standard Contractual Clauses adopted for the purposes of data transfer).
We keep personal data for as long as necessary to fulfill the purposes outlined in this policy, or as required by applicable laws. Data retention periods are determined based on operational needs, contractual agreements with the school, and legal requirements.
For example, should you wish to terminate your account the data are deleted once you confirm that you are aware of the consequence of losing data processed on the App.
Data we process for our legitimate interests are kept for the period required by the law in Austria.
We implement appropriate technical and organizational measures, such as encryption (e.g., AES-256) and access controls, to ensure the security and confidentiality of personal data. These measures are designed to prevent unauthorized access, disclosure, alteration, or destruction of data. We regularly review and update our security protocols to respond to emerging threats and to maintain the highest standards of data protection.
You have the following rights:
You may first contact your school, as they are the primary Data Controller, to exercise your data protection rights. The school is responsible for managing data-related requests, including access to personal data, corrections, or deletion requests.
However, if you require assistance with specific data-related issues or are unable to get a response from the school, you can also contact us directly. We are available to support you in exercising your rights under GDPR. For any inquiries or assistance, you can also contact us directly at Upstrive GmbH – Techno-Z Urstein, Wissenpark Urstein, Urstein Sued 15, 5412 Puch bei Hallein, Austria, email: info@upstrivesystem.com .
You can submit a complaint regarding how we process your personal data to our Data Protection Officer. Our Data Protection Officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, E-Mail: datenschutz@heydata.eu.
Additionally, you may file a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, for more information see: https://www.data-protection-authority.gv.at/), or seek protection of your rights before the competent courts.
Please note that under applicable law, there may be limits on these rights depending on the specific circumstances of the processing activity (e.g., legal obligations, legitimate interests, etc.). Contact us as described above with any questions or requests relating to your rights. We will respond to all inquiries in a timely manner.
