1. Controller
The controller for data processing on this website and within the OhayoSchool infrastructure is:
OhayoEducation UG (haftungsbeschränkt) i. G., Waghäuslerstr. 7, 68753 Waghäusel, Germany
Represented by: Nicolas Richter
Email: info@ohayoschool.com
2. Data protection contact
For all questions about data protection and to exercise your rights as a data subject, you can reach us at datenschutz@ohayoschool.com.
As soon as a data protection officer has been appointed, their contact details will be added here.
3. What data we process
3.1 Student data
- First and last name, class, date of birth
- Cognitive assessment results (pseudonymized, opt-in only)
- Learning progress data from practice apps (task type, result, time taken)
- Attendance and absence data (class register)
3.2 Teacher data
- First and last name, email address
- Qualifications, teaching load, availability
- Lesson content and planning data
3.3 Parent data
- First and last name, email address, phone number
- Communication history via the parent portal
- Absence excuses and sick notes
3.4 Technical data
- IP address (anonymized after 7 days)
- Browser type, operating system
- Session data (login time, session duration)
3.5 Inquiries via the website (demo and information pack forms)
When you request a demo or the information pack via our website, we process the data you provide (name, email address, phone number if applicable, school, type of school, role, and your message) to handle your inquiry, send you the requested information, and contact you. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). The data is stored in our customer management system and deleted as soon as it is no longer needed to handle your inquiry and no statutory retention obligations apply, or earlier at any time at your request (an email to datenschutz@ohayoschool.com is sufficient).
4. Legal bases for processing
- Art. 6(1)(b) GDPR (performance of a contract): Processing is necessary to perform the user agreement with the school.
- Art. 6(1)(a) GDPR (consent): Cognitive assessments are only carried out with the express consent of parents or legal guardians.
- Art. 6(1)(f) GDPR (legitimate interest): Technical data is processed to keep operations running and to fix errors.
- Art. 6(1)(c) GDPR (legal obligation): Billing data is retained in accordance with tax regulations.
5. Recipients of data
Personal data is only disclosed to the following categories of recipients:
- Hosting provider (servers located in Germany)
- The respective school as the client (under the data processing agreement)
Data is not disclosed to third parties for advertising or marketing purposes. Data is not transferred to third countries outside the EU/EEA.
6. Retention and deletion
- Student data: Deleted at the end of the school year unless a statutory retention obligation applies. Cognitive profiles are deleted immediately if consent is withdrawn.
- Teacher data: Deleted when the employment relationship ends, at the latest 3 months after the end of the contract.
- Parent data: Deleted when the child leaves the school.
- Technical data: IP addresses are anonymized after 7 days. Session data is deleted after 90 days.
- On termination of the contract: Full data export on request. Irrevocable deletion of all data after 90 days.
7. Your rights
As a data subject, you have the following rights:
- Access (Art. 15 GDPR): You can request information about the personal data we hold about you at any time.
- Rectification (Art. 16 GDPR): You have the right to have inaccurate data corrected.
- Erasure (Art. 17 GDPR): You can request the deletion of your data unless statutory retention obligations prevent it.
- Restriction (Art. 18 GDPR): You can request that processing be restricted.
- Data portability (Art. 20 GDPR): You have the right to receive your data in a structured, machine-readable format.
- Objection (Art. 21 GDPR): You can object to the processing of your data on grounds relating to your particular situation.
- Withdrawal of consent (Art. 7(3) GDPR): You can withdraw any consent you have given at any time with effect for the future.
- Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.
8. Cookies and web analytics
In the OhayoSchool application (after login), we only use technically necessary cookies (a session cookie for authentication); no web analytics takes place there.
We run the reach and usage analysis of our public website entirely ourselves, on our own servers in Germany. No third-party analytics or advertising services are used: no web analytics service from an outside provider, no social media trackers, no advertising cookies. Data is neither transferred to third countries nor disclosed to third parties. The analysis consists of two separate levels.
8.1 Anonymous basic statistics (no cookies, no consent)
When you visit our public pages, we record events such as page views, button clicks, submitted forms, downloads, and outbound links, each with the page path, referrer (domain only), campaign parameters (utm_*), a rough device class, and the approximate origin (country, region, city). We also record the time spent on a page and the scroll depth reached, technical measurements of loading speed, and shortened error messages when a script on our site fails. This information is generated only during the page view in your browser's memory; it is used to measure page quality and detect technical faults.
We derive the origin from your IP address by resolving it briefly against a geo database stored locally on our server; no external service is queried for this, and only the rough location is stored, never the IP address or a precise position. Nothing is stored on or read from your device for this (no cookies, no local storage); Section 25 TDDDG is not affected.
To distinguish repeat visits within one day, we generate a short hash from your IP address, the user agent, and a random value that changes daily and is then discarded. The IP address itself is only used briefly in memory and is never stored. This short hash allows us to trace the sequence of page views within a day in order to understand typical paths through our website. Once the random value has been discarded each day, the hash can no longer be attributed to any person and cannot be linked across days; at this level, there is no link to you as a person or to an inquiry. We keep raw events for a maximum of 14 months; after that, only aggregated daily figures without any personal reference remain.
The legal basis is our legitimate interest in measuring and improving our offering (Art. 6(1)(f) GDPR). If your browser sends a Global Privacy Control or Do Not Track signal, we treat this as an objection (Art. 21(5) GDPR) and do not record these basic statistics either. In addition, you can object to the processing informally at any time (datenschutz@ohayoschool.com).
8.2 Extended statistics with recognition (only with your consent)
Only if you select “Accept” in the notice banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) do we additionally process:
- Recognition: A first-party cookie (oa_vid, random identifier, lifetime 13 months) links your visits across sessions; a session identifier in the session storage of the browser tab holds the current session together. Another cookie (oa_consent) only stores your decision (13 months if you consent, 6 months if you decline).
- Usage profile: Sessions with the pages you visited, time on page and actual reading time, scroll depth, which sections of a page you looked at and for how long, and click positions (heatmaps). For each click, we also record which element you clicked: its technical identifier and its visible label. We also detect signs of usability problems (repeated clicks on the same spot, clicks on elements that do not respond), signs that you intend to leave the page, the copying of text passages (only the length, never the content), switching to another tab, and the window size, screen resolution, and language setting of your browser. In addition, we record your source and campaign history (first and last contact).
- Form behavior without content: We record which form fields you select, how long you spend in them, how many fields you fill in, and at which field you may abandon an entry. The content of your entries is never recorded or transmitted, neither the text nor selected values nor any part of them.
- Link to your inquiry: If you send us a demo or information pack form, we link the history collected under this consent (including visits before submission) to your contact record in our internal sales system. Our sales staff then see your website activity on the record and receive notifications, for example when you visit our pricing page again. The purpose is to prepare and personalize your consultation (Art. 6(1)(a) GDPR, and additionally point (b) where a contract is being initiated).
Your screen session is not recorded. The location information from section 8.1 is not used at this level. We store individual events at this level for a maximum of 24 months; after that, they are automatically deleted or aggregated.
Withdrawal: at any time with effect for the future at ohayoschool.com/about/legal/cookie-settings (also via “Cookie settings” in the footer), if you wish including immediate deletion of your entire visit history. After withdrawal, recording at this level stops on the server side; the cookie is deleted.
8.3 Campaign parameters in form inquiries
Regardless of your consent, when you submit a form, we add the campaign parameters contained in the address bar (utm_source, utm_medium, utm_campaign) to your inquiry so that we can attribute its origin. The legal basis is the initiation of a contract (Art. 6(1)(b) GDPR).
9. Special category: cognitive assessments
Cognitive assessment results are treated as particularly sensitive data:
- Processing only with the express, informed consent of parents or legal guardians
- Pseudonymization at database level: real names cannot be inferred
- Access only by the teacher of the class concerned and the child themselves
- No disclosure to third parties
- Immediate deletion if consent is withdrawn
- AI models are trained with anonymized, aggregated data, never with individual data
10. Commissioned processing
Schools use OhayoSchool on the basis of commissioned processing in accordance with Art. 28 GDPR. A data processing agreement (DPA) is part of every user agreement. The school remains the controller within the meaning of the GDPR; OhayoSchool is the processor.
11. Technical and organizational measures
- Encryption of all data in transit (TLS 1.3) and at rest (AES-256)
- Servers located exclusively in Germany
- Microservice architecture: each service only has access to the data required for its function
- Regular security audits and penetration tests
- Automated encrypted backups
- Role-based access control (RBAC)
12. Changes to this privacy statement
We reserve the right to update this privacy statement to adapt it to changes in the law or in our service. You will always find the current version on this page. In the event of material changes, we will notify registered users by email.