1. Personal data we collect about you

In order to deliver an optimal learning experience through our Services, we collect and process the following personal data about you:

1.1 Mandatory personal data

We collect the following personal data, and the collection of this data is a requirement for the service to function.

• Email
  You must provide a valid Email for login purposes
• Name
  You must provide your full Name is mandatory
• Information about your school, term, etc
  You must provide the name of your school and your term.
• Question statistics and study time
  Your answers to surveys or questions
• Payments
  Billing information, and transaction information

1.2 Voluntary personal data

You may choose to provide additional personal data through our Services, although this is not required to use them. If you choose to share such information, we may use it to enhance our Services and improve your experience — for example, by suggesting adjustments to your study plan or offering recommendations based on the data you provide. This may help you achieve better learning outcomes.

• Content
  Notes, markings, pictures, documents that you add yourself
  
  

1.3 Technical and usage data

When you use our Services, certain technical and usage data may be collected to enable functionality, maintain security, monitor performance, and enforce applicable terms (including our Fair Use Policy governing use of the ECOS feature). This may include information such as:

• Request volume (e.g., number of feature requests or ECOS Stations used)
• IP address
• Concurrent sessions (e.g., simultaneous logins or overlapping sessions)
• Browser type, device identifiers, and timestamps
  
  

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.

2. How your personal data is collected

We collect most of this personal data directly from you. However, we may also collect information:

• From cookies on our website. For more information on our use of cookies, please see our cookie policy.
• From automated technologies or interactions such as server logs and similar tools, which record technical data (for example, IP address, request volume, and session information) to maintain security, monitor performance, and ensure compliance with applicable terms (including our ECOS Fair Use Policy).
• From a third party, for the sole purposes of improving both user experience and personal learning efficiency. We collect the following data:
  • Activity on the screen: mouse clicks, keyboard events
  • If the browser tab is active
  • How you navigate through the system

3. How and why we use your personal data?

Under data protection law, we can only use your personal data if we have a proper reason, e.g.:

• where you have given consent;
• to comply with our legal and regulatory obligations;
• for the performance of a contract with you or to take steps at your request before entering into a contract; or
• for our legitimate interests or those of a third party.
  
  

A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.

The table below explains what we use your personal data for and why.

What we use your personal data for	Our reasons
Establish and administer customer relationships: Provide access to our services (log-in and reset your password) Create a customer account Provide our services Provide support Manage invoicing and accounting Facilitate our customer relationship in other ways	To perform our contract with you or to take steps at your request before entering into a contract
General marketing purposes Sending offers and marketing material related to the service to existing and potential customers. We will transfer your personal data to a third party (ie email address to the email service) for marketing purposes (but only accessible to our collaboration partners which provide access to services through Cortexio), and you have the option to opt-out from receiving marketing communication from us at any time Sending newsletters and/or other marketing communications, such as e.g. « the case of the week », to customers and persons who have signed up to receive such communication from us	For existing customers, our legitimate interest in promoting our services, provided that the marketing concerns products or services similar to those already purchased or used. For prospective customers or newsletter subscribers: consent, which can be withdrawn at any time.
Statistical purposes & further development Statistical analysis Business intelligence, for ourselves and third parties, to further develop our products, services and offerings. This concerns personal data in aggregated and in an anonymous format Points of interest: Content popularity Are the study questions too easy, optimal or too hard? Average study time Behaviour patterns Study patterns	For our legitimate interests, ie to be as efficient as we can so we can deliver the best service to you at the best price
Personal adaption of the content Study analysis, resulting in tailored recommendations as regards rehearsal of certain study questions, modification of study plan etc We may also use nudging by sending you e-mails and/or notifications if you have not been logged on for a long time or if your study time is not optimal Estimate the drop-out risk	To perform our contract with you
Monitor and enforce applicable terms (including the ECOS Fair Use Policy), ensure security, prevent abuse or fraud, and maintain service integrity (e.g., through review of request volume, IP address, and session data)	To perform our contract with you and our legitimate interests in service integrity and fair access
To improve our support services	For our legitimate interests, ie to be as efficient as we can so we can deliver the best service to you at the best price
Research purposes: We make personal data available for research purposes, but only in aggregated and anonymous format. If Personal and non-anonymous Data is shared this is always done with the consent of each user.	For our legitimate interests, ie to be as efficient as we can so we can deliver the best service to you at the best price

Furthermore, we process personal data as required by law (e.g. for accounting purposes).

4. Marketing

We may use your personal data to send you updates (by email, text message, telephone, or post) about our Services – for example, information about new features, promotions, or other news that we think may be of interest to you.

For existing customers, we rely on our legitimate interest in promoting our Services, provided that the marketing relates to products or services similar to those you have already purchased or used.

For prospective customers and newsletter subscribers, we rely on your consent, which we collect at the time you provide your contact details. You can withdraw your consent or opt out of receiving marketing communications at any time by:

• Contacting us at info@hypocampus.fr; or
• Using the “unsubscribe” link included in the footer of our emails.
  
  

If you ask us to provide additional Services in the future, or if there are changes in the law or in our business structure, we may ask you to confirm or update your marketing preferences.

We will always treat your personal data with respect and will never sell or share it with other organisations for their own marketing purposes.

5. Who we share your personal data with

We may share your personal data with trusted third-party service providers who help us operate, improve, and secure our services. For example, we may share information for the following purposes:

• IT, hosting and cloud storage, such as Amazon Web Services (AWS), where our data is stored on servers located in the EU (Frankfurt, Germany);
• Marketing and communications, such as Mailchimp;
• Analytics and customer engagement, such as Google Analytics, Mixpanel, Posthog, and HubSpot;
• Payment processing, such as Stripe.
  
  

We only allow these organisations to handle your personal data if we are satisfied that they take appropriate technical and organisational measures to protect it, and that they only use your data to provide services to us and to you.

We or our service providers may also occasionally share personal data with:

• our external auditors and professional advisors (such as lawyers and accountants), under strict confidentiality obligations;
• law enforcement agencies, courts, or regulatory authorities, where required by applicable law; and
• other parties involved in a significant corporate transaction or restructuring (such as a merger, acquisition, or asset sale), in which case personal data will usually be anonymised where possible.
  
  

Where any of these service providers or partners are located outside the European Economic Area (EEA), please see “Transfers outside the EEA” below for more information on how we protect your data in those cases.

If you would like more information about who we share data with and why, please contact us (see ‘How to contact us’ below).

We use PostHog as our product analytics platform. When you arrive at our Services after clicking an advertisement on Meta platforms (Facebook or Instagram), PostHog sends a conversion event to Meta to confirm that the ad click led to a visit. As part of this event, your email address is cryptographically hashed (using SHA-256) before it is transmitted to Meta, so that Meta never receives your email in plain text. Meta uses the hashed identifier solely to measure ad performance and attribute the conversion to the relevant campaign.

No additional personal data beyond the hashed email and the fact that a conversion occurred is shared with Meta through this integration. You can opt out of personalised advertising through your Meta ad preferences at facebook.com/adpreferences.

The legal basis for this processing is our legitimate interest in measuring the effectiveness of our advertising (Art. 6(1)(f) GDPR).

6. For how long do we store the Personal Data we Collect?

We will not keep your personal data for longer than necessary for the purposes for which it was collected.

• Students: We store personal data for as long as you are an active student user and two years thereafter, unless you request deletion of your personal data before that time.
• Newsletter and marketing subscribers: We store your email address and related data for as long as your subscription remains active. If you opt out of receiving newsletters or other marketing communications, we retain information about your opt-out solely to ensure that we do not send you unwanted communications.
• Legal and accounting records: Certain personal data (such as transaction and invoicing information) may be retained for a longer period where required by law, in accordance with applicable tax and accounting regulations.
  
  

After the end of the relevant retention period, we will delete or anonymise your personal data in a secure manner.

7. Transferring your Data outside of the EEA

It may be necessary for us to transfer your personal data to countries outside the European Economic Area (EEA) in order to provide our services. This may occur, for example, when we use service providers located outside the EEA or when you access our services from outside the EEA.

Some of these countries may not provide the same level of data protection as countries within the EEA. Where this is the case, we take all necessary steps to ensure that your personal data continues to receive an adequate level of protection and that such transfers comply with applicable data protection laws.

Where we transfer your personal data outside the EEA, we do so on the basis of:

• an adequacy decision issued by the European Commission in accordance with Article 45 of the GDPR, confirming that the destination country provides an adequate level of protection for personal data; or
• appropriate safeguards under Article 46 of the GDPR, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission, which impose legally binding obligations on the recipient to protect personal data in line with EU standards.
  
  

These safeguards ensure that data subjects continue to have enforceable rights and effective legal remedies with respect to their personal data.

In cases where neither an adequacy decision nor appropriate safeguards are available, we will only transfer your personal data outside the EEA where a specific exception applies under Article 49 of the GDPR (for example, where the transfer is necessary for the performance of a contract with you, or where you have explicitly consented to the transfer after being informed of the possible risks).

We continually review the countries and entities to which we transfer personal data to ensure that the level of protection provided is consistent with EU data protection requirements.

Further information on international data transfers and the safeguards we apply can be obtained by contacting us (see ‘How to contact us’ below).

8. Cookies

Our platform uses cookies to provide certain functionality, to gather data to improve our platform and to help us with marketing.

When you use our website we place some cookies on your device. We use cookies and similar technologies to: measure activity on our website, offer certain functionality provided by third-party tools, and to help with marketing.

By continuing to use our website with your browser settings set to accept cookies, you are giving us your consent to place non-essential cookies on your computer or device.

More details of which cookies are stored can be found in our Cookie policy

9. Your Rights

Under the GDPR, you have several important rights in relation to your personal data. An overview of these rights is set out below:

• Access the personal data we hold about you and receive a copy of it.
• Correct any inaccurate or incomplete information.
• Request deletion of your personal data in certain cases, for example when it is no longer needed for the purpose for which it was collected.
• Restrict or object to processing of your personal data, for example if you believe it is inaccurate or if you object to processing based on our legitimate interests.
• Receive your data in a portable format and, where technically feasible, ask us to transfer it to another service provider (the “right to data portability”).
• Withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
  
  

You also have the right to object at any time to the use of your personal data for direct marketing purposes, including any related profiling.

For more information about these rights and the circumstances in which they apply, you can visit the website of the European Data Protection Board (EDPB) at https://www.edpb.europa.eu/edpb_en.

If you wish to exercise any of your rights, please contact us and provide sufficient information for us to verify your identity and process your request.

10. Keeping your personal data secure

We have implemented appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way. We limit access to your personal data to those who have a legitimate business need to know it. Anyone processing your personal data does so only in an authorised manner and is subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any competent supervisory authority of a personal data breach where we are legally required to do so.

11. How to complain

We hope that we can resolve any questions or concerns you may have about our use of your personal data. If you have any queries or issues, please contact us first (see ‘How to contact us’ below).

Under the General Data Protection Regulation (GDPR), you also have the right to lodge a complaint with a supervisory authority or to seek a remedy through the national courts, in particular in the European Union (EU) or European Economic Area (EEA) state where you normally live, work, or where an alleged infringement of data protection laws has taken place.

Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY), which you can contact using the following details:

Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm, Sweden
Telephone: +46 8 657 61 00
Website: www.imy.se

If you are based in France or another EEA country, you may also contact your local data protection authority — for example, the Commission nationale de l’informatique et des libertés (CNIL) in France (www.cnil.fr) — or identify your national authority by consulting the list available on the European Data Protection Board (EDPB) website: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

12. Changes to this privacy policy

This privacy policy was published on 2023/03/08 and last updated on the date on top of this document.

We may change this privacy policy from time to time. We encourage users to check this notice regularly.

13. How to contact us

Please contact us if you have any questions about this privacy policy by sending an email to privacy@cortexio.se.

If you would like to contact us for any other reason or write to us regarding the information we hold about you, please write to us at: privacy@cortexio.se.