Privacy Policy

Last updated: 9 September 2026

1. Who we are

Nivo is operated by Rascals [legal entity name, registration number and registered address — placeholder]. We are the data controller for the personal data described below. For any privacy question, contact [privacy/support email — placeholder].

2. Data we collect

• Account holder (adult): name, email address, date of birth, password (stored hashed, never in plain text).
• Child profiles: a first name and date of birth, entered by the account holder — a child never provides this themselves and never has their own login.
• Learning progress: which exercises were completed, scores, and time spent, tied to a profile so progress can be resumed and shown to the parent.
• Technical data: standard server logs (IP address, browser type, timestamps) kept for security and abuse prevention.

3. Why we collect it

To create and secure your account, to run the learning platform and track progress across sessions, to send you account-related email (verification, password reset, service notices), and to meet our legal obligations. We do not use child profile data for advertising, and we do not sell personal data to third parties.

4. Legal basis

Processing the account holder's data is necessary to perform our contract with you (providing the service you signed up for). Processing a child's profile data is based on the parent or guardian's consent, given when the profile is created, in line with Article 8 GDPR and the Belgian age of digital consent.

5. Who we share data with

We use third-party infrastructure providers (hosting, email delivery) strictly to operate the platform, under data processing agreements. [Named subprocessors — placeholder, to be filled in once hosting/email providers are chosen.] We do not share data with advertisers.

6. How long we keep it

We keep account and profile data for as long as the account is active. If you close your account, we delete personal data within [retention period — placeholder, e.g. 30 days], except where we are required to keep records longer for legal reasons (e.g. billing records).

7. Your rights

As the account holder, you can access, correct, export, or delete the data held for you and for the child profiles under your account at any time from your account settings, or by contacting [privacy/support email — placeholder]. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, gegevensbeschermingsautoriteit.be).

8. Children's data

We do not knowingly allow children to create their own accounts. Every child profile is created and managed by an adult account holder, who can review, edit, or delete it at any time.

9. Changes to this policy

If we make a material change to this policy, we will notify you by email before it takes effect.