Bomberbot is a tradename of Studio Krok B.V. (“Bomberbot”).
We believe that your and your child’s/student’s personal data should be treated with the utmost care.
We also comply with the Dutch Convenant Digital Teaching Aids and Privacy 2.0 (Convenant Digitale Onderwijsmiddelen en Privacy 2.0)
Who is Data Controller and who is Data Processor?
We do not determine the purposes and means of the processing of personal data. That is either the parent or legal guardian, or the school. Taking this into account, the school will act as “Data Controller” within the meaning of the DDPA and the GDPR. This implies that the school is responsible for the processing of personal data. We, Bomberbot, solely act as Data Processor. This means that we do not process the personal data in any other way than as agreed upon by the School or the parent or legal guardian.
Explicit (parental) consent
Bomberbot will not collect, use or disclose personal data without “parental consent”. Because the Website is designed for use by students younger than sixteen, the students cannot give explicit consent themselves. We will always need permission from the student’s parent or legal guardian (parental consent) to use our Website.
Are you sixteen years or younger?
If you are sixteen years or younger, you have to obtain permission from your parents or legal guardian to use our Website. As listed above, we only collect personal data from persons under sixteen in case parents or legal guardians have given their explicit consent by registering their child for use of the Website, or when the school and/or teacher of the child have received consent from a parent or legal guardian. If we learn we have collected personal data from a student under sixteen without parental consent, or if we learn a student under sixteen has provided us personal data beyond what is requested, we will delete the data as fast as possible. Please notify us via firstname.lastname@example.org.
Which personal data do we process?
Before your child or student can use our Website, we will ask you to create two accounts. This will always be a combination of either a parent- or a teacher account, together with a student account or multiple student/children accounts.
Parent- or teacher account
In this respect, we ask you to provide us with your first- and last name, email address and a password. Teachers will be asked to give the name and place of the school where they are employed. We will process these data.
The parent, legal guardian, school or teacher (hereinafter: “Adult”) will afterwards create an account for a student. Please note that schools and teachers always need permission from the parents to do so. When creating an account, we ask the Adult to provide us with the first- and last name of the student, a username, a password, of the student. We will process these data.
The student will log on to the Website with the username and password as registered by the Adult. The student will also need an access code or classroom ID (provided by the school, district or teacher): this will identify him or her within the user group(s).
When a student starts using our Website, we will process all data concerning activity of and content from student accounts, such as the results of different missions in order to support the teacher/parent to help their children develop through the Bomberbot program.
Other contact information, school affiliation, school name and place
After creating the necessary accounts, you and the student can give or upload other contact information (address, zip code, place of residence and phone number and school affiliation). This data will also be processed by us to give you a more personalised experience.
IP address, browser language, non-personal data
In addition, we will process your IP address and browser language. We may also process non-personal data whenever you interact with our Website. This data may include your browser name, the type of your computer and technical information about your means to connect to our Website (such as the operating system and the utilized internet service providers).
Please note that we apply data minimization. This means that we do not ask or process more personal data than reasonably necessary for use and access of our Website.
How do we use you and your child’s/student’s personal data?
We use the personal data with for the purposes described below.
We use e-mail addresses, an encrypted version of passwords and (user)names (all together “Login ID”) to verify your and your child’s/student’s identity to access the accounts you have created. We further use (user)names, to personalize the interface of accounts and to address you when we are contacting you through your parent- or teacher account.
Personal data from students
The (user)name of the student, as well as his or her password, will only be used for creating his or her individual account and for sending notifications to either the parent or the teacher. Data concerning activity of and content from student accounts, such as the results of different missions, shall be used to track the progress of a student with regard to their development through the Bomberbot program.
We use your email address to:
- keep you informed on new activities regarding your account or student account. You can unsubscribe from these services at any time.
- keep you informed on campaigns and (special) offers that might be interesting for you. You can unsubscribe from these services at any time.
- contact you in case of any problems which you might have with regard to (the use of) the Website.
Other contact information, school affiliation, school name and place
We will use data about the name and place of the school where a teacher is employed, to contact teachers and keep them informed on campaigns and (special) offers that might be interesting for them. You can unsubscribe from these services at any time. The same applies to other contact information with regard to parents.
Browser language and IP address
We use the data about your browser language in order to address you in a language you speak, and your IP address helps us to determine which campaigns and (special) offers might be interesting for you.
If you contact us, we save your correspondence with our customer service to optimize our service to you.
For what period will we retain personal data?
As a rule, we will delete the personal data collected through the use of the Website and processed by us, after you delete your personal- or a student account. If the personal data are no longer necessary for the fulfilment of the purposes mentioned above, the data will also be deleted. In no event will the personal data be kept longer than 5 years after the date on which the data have been updated for the last time. We will only retain your personal data for a longer period in case we are legally obliged to do so. Before deleting personal data, we may irreversibly anonymize personal data and retain these as generic aggregated data for further improvement of our services.
Who do we share your personal data with?
Besides the (technical) exemptions described below, we do not share your or your child’s/student’s personal data with third parties – unless we are legally obliged to do so.
Only relevant teacher or parent can track student progress
Data concerning activity of and content from student accounts, such as the results of different missions, shall only be shared with the relevant parent and/or teacher. This means that only teachers and/or parents connected to a student are able to track the progress of that student with regard to its coding abilities.
Data that other users of Bomberbot can see
We do not share any information to other users. Each user access to its unique account and that information is not shared with anyone.
With regard to datastorage, we may use third-party service providers for datastorage. These service providers will solely act as “Data Sub Processors” within the meaning of the DDPA, the EU Data Protection Directive and the GDPR. This means that these parties will only process data on our behalf and strictly according to our instructions. As required by the relevant legislation, we enter into Data Processing Agreements with aforementioned Data Sub Processors. In these agreements, we inter alia oblige our Data Sub Processors to make use of redundant data storage, to comply with NEN-ISO/IEC 27002:2007 NL and to apply two step verification for administrators with respect to access to personal data.
Generic aggregated (non-personal) data
We may convert personal data into non-personal data and aggregate it with information collected from other users. In such case the data will be fully and irreversibly anonymized: they will not contain your or your child’s or student’s personal data. We may share such generic aggregated data with our business partners, trusted affiliates, advertisers and other third parties for industry analysis, demographic profiling, improvement of our services and other purposes.
How do we protect your personal data?
We work hard to protect your personal data from unauthorized or unlawful access, alteration, disclosure, use or destruction. We encrypt our services using SSL/AES-256, the data are only accessible through a secret password and our employees only have access to your data on a need-to-know basis.
We may use the following types of cookies on our Website:
Technical cookies: these are cookies that are essential for the operation of our Website: they enable you to move around our Website and use our features.
Analytical/statistical cookies: we use these cookies to track visitor statistics. We use these statistics to continuously improve the Website and mailings, and thus offer you relevant content. These cookies also allow us to recognize and count the number of visitors and to see how visitors navigate when they’re using our Website. This helps us to improve user navigation and ensure users to find what they need more easily.
Tracking cookies: these cookies monitor clicking behaviour and surfing habits. By means of these cookies we can see whether and when you view your account, and whether you click through to our Website.
(No) Export of data outside the European Union
As a rule, your and your child’s or student’s personal data will not be exported outside the European Union. We will only transfer data outside of the European Union, if the country where the data is being transferred to provides a sufficient level of privacy protection that meets the minimal standards of European privacy protection.
Notification with the Dutch Privacy Authority
We have filed a notification of the personal data we process with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), such in compliance with the DDPA and the EU Data Protection Directive. The Dutch Data Protection Authority keeps a public register of all notifications done by organisations that process personal data.
Your rights and who to contact
You have the right to tell us if you:
- would like a copy of the personal information which we have processed about you and/or your child;
- would like us to correct, update, shield or delete your or your child’s personal information in our records;
- wish to report any misuse of your or your child’s personal information.
If you have any questions, comments or concerns about how we handle personal data, or if you would like to request that data regarding a child or student be updated or deleted by us, please contact us at email@example.com. We will respond to such a request within 30 days of receipt by us.
Please note that you can also view, edit or delete your personal data or a child’s/student’s personal data at any time by logging in to your parent- or teacher account.
Studio Krok B.V.
1013 BC Amsterdam
Chamber of Commerce (“Kamer van Koophandel”) number: 60431016
VAT number: NL853907663B01