Schools act as controller; Wisflux as processor

When a School runs an Olympiad with ECO, the School typically acts as the data controller for student data related to the event. Wisflux acts as the School’s data processor and processes data under the School’s instructions and our data processing terms.

Wisflux as independent controller (limited data)

Wisflux may act as an independent controller for limited data such as ECO account/billing contacts, product analytics, security logs, and compliance records needed to operate and protect the Service.

Exercising rights for School‑managed data

Parents/guardians and students seeking to exercise rights for School‑managed data should contact the School; we will support the School in fulfilling requests.

2.1 Information you or your School provide

Account & profile: name, display name, email, phone number, password (hashed), role (student/parent/teacher/organizer), school/class/section, avatar (optional), preferences (language, notifications). Olympiad participation: events joined, attempts/submissions, scores, ranks, time spent, badges/certificates generated by ECO, proctoring status, disqualifications/appeals (if any), and timestamps. Parent/guardian info: name and contact (email/phone) and links to the child’s account, where enabled. Organizer/School data: organizer admin names, contact emails/phones, institution details, event settings and rules configured for Olympiads. Support & feedback: messages to support, survey responses, issue descriptions.

2.2 Information collected automatically (Usage Data)

Device & log data: IP address, device identifiers, OS, browser/app version, pages/screens viewed, timestamps, referrer, session duration, crash logs, diagnostics. Cookies & similar tech: session/auth cookies, preference cookies, and analytics tags to keep you signed in, remember settings, and measure usage. Integrity/anti‑cheat and proctoring signals: technical signals (e.g., attempt timing, window focus changes, device/app metadata). For proctored events, we may process webcam and/or microphone captures, screen‑focus telemetry, and related device metadata to uphold fairness and integrity.

2.3 Integrations and other sources

Single Sign‑On (optional): if you choose Google SSO, we receive basic profile info (e.g., name, email) from Google per your settings. Schools/organizers: rosters or participant information supplied by the School to run Olympiads. We do not intentionally collect special categories of personal data (e.g., health, biometrics) beyond optional proctoring captures. Schools should avoid collecting sensitive data unless necessary and lawful. SSO scope minimization: When you use Google SSO, we request only basic profile and email to create or sign you in. We do not maintain ongoing access to your Google account or request additional scopes without your explicit action and consent.

Leaderboards

Display names appear as entered by users/parents and may be pseudonymous (e.g., initials). By default, leaderboards are restricted to event participants and the School/organizer. Public visibility occurs only for events explicitly marked public and is indicated before you join.

Certificates

ECO may issue certificates indicating your full name by default, event name, date, and performance (e.g., score, rank). Schools/organizers may require full names for identity and verification. Where allowed by event rules, you may choose a display name/initials for the certificate.

Proctoring and recordings (if enabled)

Some Olympiads may require access to camera and/or microphone or other device sensors or proctoring checks. By using such events, you consent to their operation, which may include recording during attempts for integrity and forensics. Recordings (if captured) may be retained for up to 180 days and longer if subject to investigation or legal holds.

Public winners lists

For events explicitly marked public, winners lists may be announced. For minors, publication requires parent/guardian consent via event rules or School authorization.

Automated scoring

Automated scoring and placements do not produce legal or similarly significant effects.

Overview

ECO is designed for students. Parents/guardians are responsible for guiding and monitoring usage, managing consents, and helping children make safe choices online. Parents/guardians can request access to and deletion of their child’s personal information, subject to legal or safety exceptions. If we learn child data was provided without appropriate authorization, we will delete it.

How parental consent works

1) Direct sign‑up with parent contact: We collect a parent/guardian email or phone number and send a consent notice with a verification link/OTP; the child account becomes active only after verification. 2) Parent‑initiated account/linking: A parent can create or link a child account from a parent dashboard with an explicit consent step. 3) School‑provisioned accounts: The School is responsible for obtaining required consents under applicable law; ECO acts as the processor. 4) Withdraw/update consent: Parents/guardians can withdraw or modify consent via in‑product settings (where available) or by contacting [email protected] or [email protected]; we may request verification.

No targeted ads to children

We do not track, behaviorally monitor, or show targeted advertising to children.

Security

We implement safeguards including encryption in transit/at rest (where applicable), role‑based access, logging/audit, backups, and vulnerability management. If a data incident occurs, we will investigate and mitigate, notify affected institutions/users and authorities without undue delay after reasonable investigation where required by law, and take remedial steps.

AI/ML use

We do not use your personal data to train external AI models. If we introduce AI features that process personal data, we will disclose the purposes, data involved, and providers, and offer appropriate choices.

EEA/UK

We are preparing dedicated EEA/UK notices. When we begin offering services in these regions, we will implement appropriate data transfer mechanisms (e.g., EU Standard Contractual Clauses and the UK IDTA/Addendum) and a regional cookie consent banner.

California (CPRA/CCPA)

We do not “sell” or “share” personal information for cross‑context behavioral advertising. California residents may have rights to know/access, correct, and delete certain personal information, and to limit use of sensitive personal information, subject to exceptions. To exercise these rights, contact [email protected] or [email protected]. We do not discriminate against you for exercising your rights.