Privacy Policy – English

Privacy Policy for Simulabs

Effective Date: 10.03.2025

1. Introduction

Simulabs is committed to protecting the privacy of its users, including students, teachers, and administrators. This Privacy Policy explains how we collect, use, and protect personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws in Germany.

2. Data Controller

Aymelek e.U (Einzelunternehmen)

support@simulabs.de

Lichtensteiner Weg 3, 71229 Leonberg, Germany

If you have any questions about this Privacy Policy, please contact us at support@simulabs.de.

3. What Data We Collect

We collect only the minimum necessary data to provide our services. The following personal data may be processed:

• User Data: User type (e.g., student, teacher, admin), school code.
• Account Data: Account status, timestamps (createdAt, updatedAt).
• Authentication Data: Users log in using their email addresses via AWS Cognito, which securely manages authentication.
• Full Name: Collected and used for the following purposes:
  • Displaying a personalized greeting when users log in.
  • Allowing school administrators to view and manage school-linked accounts, including removing or deactivating the link between the student and the school. Even if the link is deactivated, students can still access the platform independently.

We do not collect personal emails directly, home addresses, or sensitive personal data beyond what is required for school verification, authentication, and administrative purposes.

4. Purpose of Data Collection

We collect and process this data for the following purposes:

• To provide and manage the Simulabs platform.
• To enable school administrators and teachers to monitor student progress.
• To allow students to link their accounts to a school and be verified by an administrator.
• To display a personalized greeting upon login.
• To allow schools to manage their student records effectively by managing links between students and schools.
• To ensure the security and functionality of our services.
• To comply with legal obligations related to data protection and student privacy.

5. Legal Basis for Processing

We process personal data under the following legal bases:

• Legitimate Interest – To operate Simulabs and provide services to educational institutions.
• Contractual Necessity – To fulfill our agreement with schools and users.
• Consent – If required (e.g., parental consent for students under 16). While Simulabs does not actively verify parental consent upon registration, parents may request account removal if they believe their child registered without appropriate approval.

6. Data Storage and Security

• All personal data is stored on AWS Amplify, utilizing AWS Paris Region (eu-west-3), which is fully GDPR-compliant and ensures data remains within the European Union (EU).
• AWS Cognito manages authentication securely, and email addresses are stored within AWS Cognito, not within Simulabs‘ internal database.
• AWS Amplify hosts and manages all application data, including databases and storage.
• Full names are stored securely and are visible only to the student and the school administrators for administrative purposes related to school linking.
• We implement strict access controls to prevent unauthorized access.
• Data is transmitted securely using TLS encryption (HTTPS).
• Hosting Compliance Details – For more information on how Simulabs ensures GDPR compliance with AWS, please see our AWS Hosting Compliance Statement below.

7. Data Retention Policy

• We retain user data only as long as necessary for the educational purpose.
• School linking requests that are not confirmed within 30 days are automatically deleted.
• Users can request data deletion at any time, including the removal of their authentication data from AWS Cognito and related data stored in AWS Amplify.
• Full names are retained as long as the student is linked to a school account but will be deleted upon account deletion. If the school link is deactivated, the student’s account remains active, but the school no longer has access to their data.

8. Data Sharing and Third Parties

1. We do not share personal data with third parties for marketing or advertising purposes.
2. Personal data is shared only with authorized school administrators and teachers for educational and administrative purposes.
3. We may share anonymized or aggregated data for research and platform improvement.
4. We comply with legal requirements and share data only when required by law or necessary to protect our services.

9. User Rights

Users have the following rights under GDPR:

1. Users can request access, corrections, or deletions of their data as required by GDPR.
2. Requests for data removal will be processed within [X] days, except where legal or security obligations require data retention.
3. Users can request limitations on how their data is used.
4. Users can request their data in a structured format where applicable.
5. Simulabs does not engage in automated decision-making affecting users‘ rights.

To exercise these rights, please contact us at support@simulabs.de.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be communicated through our platform or via email. Continued use of Simulabs after changes are made constitutes acceptance of the revised policy.

11. Contact Information

If you have any questions or concerns about this Privacy Policy or how your data is handled, please contact us at:

Aymelek e.U (Einzelunternehmen)

Lichtensteiner Weg 3, 71229 Leonberg, Germany

support@simulabs.de.

By using Simulabs, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and processing of your personal data as described.