Privacy Policy

General part

For the purpose of this document, the terms in this document shall have the following meanings:

Educational online platform Prosvita (hereinafter referred to as the Platform) is an automated information and communication system consisting of software services and modules developed by the New Educational Technologies, LLC (hereinafter referred to as the Founder) in order to digitize and increase the efficiency of educational and management processes of educational institutions. User is an individual authorized / identified / registered on the platform.

AI Assistant / MCP Integration means the optional integration that allows an authorised user to reach platform functions through a connected third-party AI service, acting within the permissions that user already holds on the platform.

Other terms are used according to the definition of the Law of Ukraine On Personal Data Protection dated 01.06.2010 № 2297-VI (as amended) (hereinafter referred to as the Law)

Purpose of personal data processing

Personal user data shall be processed in order to provide electronic services to support the educational and management processes of the educational institution. The Prosvita platform is designed to increase the efficiency of processes in an educational institution by introducing modern and optimal forms of interaction for all participants to the educational process and creating a paperless document flow of the institution.

The platform processes the following categories of personal data: identity and account data (name, username, email address, phone number, role and workspace membership); educational and institutional data (subjects, sections and subsections, rosters, grades and grading systems, academic years and terms, assessments, attendance and achievement records); content that users create on the platform; and technical and usage data such as IP address, device and browser information and server logs.

In order to ensure the effective operation of the platform, the founder will carry out the following:

• registration / identification / authorization of platform users;
• fulfillment of its obligations to users, institutions, and educational administrations;
• interaction with and support for platform users;
• enabling the optional AI Assistant / MCP Integration, where a user chooses to connect it;
• assessment and analysis of platform performance, recovery of both individual modules and the entire platform in case of unforeseen situations.

Legal bases for processing

We process personal data on the following legal bases, which correspond to the grounds set out in the Law and, where the General Data Protection Regulation (GDPR) applies, to the grounds set out in Article 6 of that Regulation:

• performance of the agreement concluded with the educational institution and provision of the services the platform exists to deliver;
• consent of the data subject or, in the case of a child, of their parents or legal guardians, obtained by the educational institution;
• compliance with the legal obligations of the founder, including accounting and tax obligations;
• the legitimate interests of the founder in keeping the platform secure, preventing abuse and restoring service after incidents, where those interests are not overridden by the rights of the data subject.

AI Assistant / MCP Integration

The AI Assistant / MCP Integration is optional and remains switched off until a user connects it. It is intended for authorised personnel of the educational institution.

Connecting the integration requires the user to sign in to the platform and to approve an explicit consent screen. The connection is authorised through the OAuth 2.1 Authorization Code flow with PKCE. Access tokens are short-lived and refresh tokens expire after thirty days.

Once connected, the integration acts as the user who connected it and is bounded by that user’s existing permissions and workspace membership. It can read the information that user is already entitled to see, and it can create, change or remove the same records that user is already entitled to change — for example subjects, sections and subsections, rosters, grading systems, academic years and terms, assessments, posts, and achievement or reward records. Depending on the connected AI service, the user may be asked to confirm an action before it is carried out.

Because the integration mirrors the user’s own access rather than a separate, narrower set of permissions, an operator holding wide administrative rights can reach correspondingly wide data through it. We therefore recommend connecting the integration only from accounts whose permissions match the task at hand.

Only the data needed to answer a particular request is sent to or returned from the connected AI service. The user’s conversation history with that service is not sent to the platform and is not stored by us.

A user may end the connection at any time, either by removing it in the connected AI service’s own settings or by revoking the access token in the platform’s connected applications settings. Revocation takes effect immediately, and all tokens issued to a user are deleted when that user’s account is deleted.

International data transfers

The platform is operated from Ukraine. Where a user connects an AI service operated outside Ukraine or the European Economic Area, the data needed for that user’s requests is transferred to that service at the user’s own instruction and under the agreement between that user or their educational institution and the provider of that service. We do not control how that provider processes the data.

For our own infrastructure providers, personal data is transferred only to the extent needed to operate the platform and under contractual terms requiring an adequate level of protection.

An educational institution that does not want data to leave its chosen jurisdiction should not enable the AI Assistant / MCP Integration for its users.

No AI model training

We do not use personal data processed on the platform, including personal data processed through the AI Assistant / MCP Integration, to train or improve any artificial intelligence or machine learning model.

We do not sell personal data, we do not use student data for targeted advertising, and we do not build advertising or commercial profiles of students. Student data is used to deliver the educational service and for the purposes described in this Policy. These commitments reflect the requirements of the Student Online Personal Information Protection Act (SOPIPA) and comparable student privacy laws.

Data transmitted to a connected AI service is additionally subject to that service’s own privacy policy and terms, including any choices that service offers regarding the use of data for model training.

The platform does not make any decision that produces legal effects concerning a person, or similarly significantly affects a person, solely by automated means. Output produced by a connected AI service is a suggestion that a human user reviews and decides whether to act on; grades, enrolment and other records are changed only by an authorised user.

User Rights and Obligations

The user has the right to receive information about the processing of his/her personal data, as well as other rights defined in part 2 of Article 8 of the Law, in particular:

• the right to access, amend and update his/her personal data;
• the right to be aware of the location of his/her personal data, the purpose, content and mechanism of its processing, the location of the holder or manager of the personal data;
• the right to revoke consent to data processing and / or in some cases delete it (right to be "forgotten");
• the right to make a reasoned request to change or destroy personal data if this data is processed illegally or is inaccurate;
• the right to send complaints about their processing in certain cases or apply remedies.
• the right to data portability and the right to object to or restrict certain processing, where applicable law provides for them;
• the right to disconnect the AI Assistant / MCP Integration at any time.

Where the General Data Protection Regulation or another applicable data protection law grants a data subject broader rights than the Law, those rights also apply to the extent that law is applicable.

To exercise these rights, please write to info@prosvita.net. Requests to delete an account are handled as described on the Account Deletion page, and other requests are answered within one month of receipt; this period may be extended by up to two further months for complex or numerous requests, in which case we will tell you why. Where the records concerned are controlled by an educational institution, we act on that institution’s instructions and under the agreement concluded with it.

The User is obligated, including but not limited to:

• not to cause actions aimed at deceiving or limiting the rights and opportunities of other users
• not to share your personal information with third parties, as well as your login, password, and other confidential information;
• not to collect, organize, store, process or distribute personal information of other Users;
• not to try to gain access to the personal data of other Users in any way, including, but not limited to, by fraud, breach of trust, trial and error selection of authentication and identification data;
• update information in case of changes.

Data controller and processor

For data that an educational institution places on the platform about its students, staff and their parents or legal guardians, the educational institution is generally the controller of that data — the owner of personal data in the terms of the Law — and the founder acts as processor, that is, as the administrator of personal data, following the instructions of the institution and the agreement concluded with it.

For account, billing, support and security data, the purposes of which are determined by the founder, the founder acts as controller, that is, as the owner of personal data.

Which role applies depends on the specific processing activity and on the agreement in force with the educational institution.

Recipients of personal data

We do not sell personal data. It is disclosed only where necessary, and only to:

• hosting and infrastructure providers that operate the servers on which the platform runs;
• payment service providers, where a payment is made through the platform;
• email and messaging delivery providers used to send platform notifications;
• error monitoring and diagnostics providers used to detect and correct faults;
• a third-party AI service that a user chooses to connect, at that user’s instruction, limited to the data needed for the requested action, and subject to that service’s own privacy practices, which we do not control;
• the educational institution to which the user belongs;
• public authorities, where disclosure is required by law;
• a successor entity, in the event of a merger, acquisition or reorganisation.

Our service providers process personal data only on our instructions and under written terms that require appropriate safeguards. The current list of providers that process personal data on our behalf is available to educational institutions on request and through the agreement concluded with them.

Data retention

Personal data is retained while the account and the relationship with the educational institution remain active.

Following a verified deletion request, profile data is deleted as described on the Account Deletion page. Primary accounting and financial records are retained for the periods required by law. Security logs are retained for up to twelve months and are then deleted or anonymised.

Logs of the AI Assistant / MCP Integration record only failures, and record the name of the operation without its content. Access tokens are deleted when they are revoked or when the account is deleted.

Children’s and student data

The platform processes personal data of minors as part of the educational relationship between an educational institution and its students.

Consent for the processing of a child’s data is obtained by the educational institution from the child’s parents or legal guardians before that data is placed on the platform. Where the Children’s Online Privacy Protection Act (COPPA) applies, the founder relies on the educational institution to provide that consent on behalf of the parents for use in the school context, and the institution may review a child’s data or request its deletion at any time.

The AI Assistant / MCP Integration is intended for authorised personnel of the educational institution and is not offered to students. Data about students is processed through the integration only as far as an authorised request requires, and in accordance with the permissions and instructions of the educational institution.

Where the educational institution is located in the United States, we act as a school official with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA): we use education records only for the purposes authorised by the institution, remain under the institution’s direct control in respect of those records, and do not disclose them to anyone else except as the institution instructs or the law requires.

A parent or legal guardian may withdraw consent to the processing of a child’s data at any time through the educational institution or by writing to us. Withdrawal ends the child’s use of the platform, and the child’s data is then deleted as described on the Account Deletion page, except for data we must retain by law.

Parents and legal guardians may contact the educational institution, or write to us at info@prosvita.net, regarding a child’s data.

Data security

We apply organisational, technical and administrative safeguards to protect personal data, including access control based on the user’s role and workspace, encryption of data in transit, restricted administrative access, and monitoring for faults and abuse. These safeguards also cover data exchanged through the AI Assistant / MCP Integration.

The information protection system of the platform is built in accordance with the requirements of the legislation of Ukraine on the protection of information in information and communication systems, and holds a certificate of compliance for its comprehensive information protection system (KSZI).

No method of transmission or storage can be guaranteed to be completely secure. Users are responsible for keeping their own authentication data confidential, and for connecting the AI Assistant / MCP Integration only from accounts and services they trust.

If we become aware of a personal data breach, we will notify the affected educational institution without undue delay after confirming it, give the institution the information it needs to meet its own notification duties towards data subjects and supervisory authorities, and cooperate in the response. Where we act as controller, we will notify the competent supervisory authority and, where required, the affected persons ourselves within the time limits set by applicable law.

Cookies and similar technologies

The website and the platform use cookies and similar technologies. Strictly necessary cookies keep you signed in, remember your language and protect forms against abuse; they cannot be switched off without breaking the service and do not require consent.

Our public website also uses Google advertising and analytics tags, which set cookies to measure the effectiveness of our advertising and to understand how visitors use the website, and a Zoho Desk support-chat widget, which sets cookies needed to run the chat. These are operated by third parties, who process the resulting data under their own privacy policies. Where the law of your country requires consent for such cookies, they are used only with your consent, and you can withdraw it at any time through your browser settings or the cookie controls offered on the website.

Advertising and analytics tags are used on the public marketing website only. They are not used inside the platform where students’ educational records are processed, and we do not use student data for advertising.

Right to lodge a complaint

A data subject who considers that their personal data is processed in breach of the law may lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, who supervises compliance with personal data protection legislation in Ukraine.

Where the General Data Protection Regulation applies, a data subject may also lodge a complaint with the supervisory authority of the European Union Member State of their habitual residence or place of work.

We ask that you first write to us at info@prosvita.net so that we can try to resolve the matter directly.

Platform usage

The use of the platform is voluntary and shall be governed by this Privacy Policy and the Law.

The educational institution, based on the request of parents or other guardians, shall conclude a corresponding contract in writing with the Company and provide the Founder with the necessary data for use.

The Founder shall inform the educational institution, as the owner of personal data, of the need to inform parents of students, pupils and teachers about the processing of their personal data while using the platform, as well as to obtain their Consent to the processing of personal data while using the platform. The educational institution shall independently regulate these relations with the participants to the educational process and the Founder shall not be responsible for these relations and their documentation as part of the subscription and use of the platform.

The educational institution shall provide a mobile phone number / email address and username for the user to gain authorized access to the platform.

Taxes and refund

The User shall be responsible for determining the taxes, if any, that apply to transactions made via the Platform Prosvita.

The User shall be responsible for reporting and transferring the applicable tax to the appropriate tax authority, and all his/her actual and potential tax obligations under his/her liability.

The User agrees that the Platform Prosvita shall in no event and under no circumstances be responsible for determining whether taxes apply to its transactions or services, or for collecting, reporting, withholding or transferring any taxes that arise from any transactions or services.

User also agrees that the Platform Prosvita shall in no event and under no circumstances be obligated to compensate him/her for his/her tax liability or to give him/her any tax-related advice.

The User can request a refund by sending an e-mail to info@prosvita.net