2. Privacy Policy

2.1 Data Controller

Hawkings Education SL is responsible for the processing of your data. In cases where we act as a Data Processor on behalf of schools or institutions, they will be responsible for informing you of their policies.

2.2 What data do we collect?

• Name and contact info

• Sector and role (e.g., teacher, student, admin)

• Navigation data (IP, preferences, browser, language)

• Data entered in forms, including product demo requests

• Files selected by teachers in Google Drive (with consent)

2.3 Why do we process your data?

We process data to:

• Provide our services and features

• Manage your registration and support queries

• Comply with education laws (FERPA, COPPA, GDPR, CCPA)

• Send communications, when permitted

• Improve content and usability

2.4 K-12 Users & Compliance

We strictly comply with FERPA, COPPA, GDPR, and California AB 1584 for underage users.

K-12 Usage Conditions:

• US residents must be 13+ with guardian consent

• Outside US: 16+ or with parental consent

U.S. K-12 Restrictions

• No public profiles

• No external content embedding

• No email notifications

• No social login

• Restricted content reuse or collaboration

2.5 Legal basis & retention

• Consent: Demo forms, cookies, optional communications

• Contractual: Service provision and account management

• Legal obligation: Tax and compliance documentation

• Legitimate interest: Product improvement, security

Retention:

• Demo/contact data: 1 year

• Contractual data: 5 years (for legal liabilities)

• Inactive accounts: deleted after 12 months

2.6 Exercise of rights

You may request:

• Access, correction, or deletion

• Portability

• Objection to processing

• Restriction of use

Send an email to legal@hawkings.education
or a postal letter to our legal address.
You may be asked to verify your identity.

2.7 Data transfers & security

• We store data in the EEA or countries with equivalent safeguards

• We use SCCs and organizational measures

• Data is encrypted and access is restricted to staff who need it

2.8 Data breach protocol

If we detect unauthorized access, we will:

• Notify affected users

• Disclose the type of breach

• Explain what data was affected and the measures taken

2.9 Changes and control

We may update this policy to reflect legal or product changes.
All changes will be communicated 30 days in advance.
In case of acquisition or merger, you will be notified and may request deletion.