Privacy Policy

The data controller for personal data collected on CodiCAT is SEBA (hereinafter "SEBA" or "we"), based in Catalonia, Spain. You may contact us for any privacy-related matter at: [email protected] CodiCAT operates as an educational platform for Year 9 students and teachers at educational centres in Catalonia. Data processing is carried out in strict compliance with the General Data Protection Regulation (GDPR, EU 2016/679), the Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD), and the UK General Data Protection Regulation (UK GDPR) for users in the United Kingdom.

CodiCAT is a platform designed specifically for secondary school students, including minors. We apply the strictest protection measures: • Users under 14 years of age (minimum age of consent in Spain): registration requires verifiable consent from a parent or legal guardian, in accordance with Article 8 of the GDPR and Article 7 of the LOPDGDD. • Users aged 14–18: may register independently, but educational centres act as guarantors of consent within the educational relationship. • We do not collect data from minors beyond what is strictly necessary for the operation of the educational platform (username, learning progress, code submissions). • Minors' data is never shared with third parties for commercial purposes. • Parents and legal guardians may request access, rectification, or deletion of their child's data at any time by contacting [email protected].

We collect only the data necessary for the provision of the educational service: • Identification data: username, email address (provided via Manus OAuth). • Educational usage data: submitted code, selected scaffolding level, score achieved, submission history, experience points (XP), badges. • Class data: class code, class name, teacher identifier. • Technical data: IP address (anonymised), browser type, operating system (for technical diagnostics only). • Preference data: selected language, cookie preferences (stored locally). We do NOT collect: precise geolocation data, sensitive biographical data, financial data, or special category data (Article 9 GDPR).

The processing of your data is based on the following legal grounds (Article 6 GDPR): • Performance of a contract (Art. 6.1.b): processing necessary for the provision of the educational service contracted by the school or the user. • Legitimate interests (Art. 6.1.f): platform improvement, fraud detection, and system security. • Consent (Art. 6.1.a): for non-essential cookies and marketing communications (where applicable). • Legal obligation (Art. 6.1.c): retention of records for compliance with applicable tax and educational regulations.

We retain your data for only as long as necessary for the purposes for which it was collected: • Active account data: for the duration of the user account. • Submission and progress data: up to 3 years from the last active access, to allow educational continuity. • Technical and diagnostic data: maximum 90 days. • Minors' data: automatically deleted when the user turns 18, unless they expressly request continuation of the service. You may request deletion of your data at any time (see User Rights).

We do not sell or transfer your personal data to third parties for commercial purposes. Data may be shared only in the following cases: • Educational centres: the teacher responsible for the class may access their students' progress and submissions within the platform. • Technical service providers: hosting and database servers (with data processing agreements compliant with GDPR). • Competent authorities: when required by law or a court order. No international transfers of data outside the European Economic Area (EEA) are made without appropriate safeguards.

Under the GDPR and LOPDGDD, you have the following rights: • Right of access: obtain confirmation of whether we process your data and access it. • Right to rectification: correct inaccurate or incomplete data. • Right to erasure ("right to be forgotten"): request deletion of your data. • Right to restriction of processing: request that we limit the processing of your data. • Right to data portability: receive your data in a structured, machine-readable format. • Right to object: object to processing based on legitimate interests. • Right not to be subject to automated decisions: we do not apply automated decisions with significant legal effects. To exercise any of these rights, contact us at [email protected]. We will respond within a maximum of 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with the Information Commissioner's Office (ICO) in the UK at www.ico.org.uk.