Privacy Policy

In this Privacy Policy, we explain how Evulpo AG ("Evulpo", "we", "us") collects, uses, and protects your personal data when you use our online learning platform (website and services at evulpo.com). We are committed to handling your information in compliance with applicable data protection laws, including the Swiss Federal Data Protection Act (FDPA/DSG) and the EU General Data Protection Regulation (GDPR). This policy applies to all users of Evulpo, whether you are using Evulpo as part of a school or for private use.

If you have any questions about data protection at Evulpo, feel free to reach out to us at any time at [email protected]. We’re here to help.

We may update this privacy policy from time to time if, for example, we expand the services. The current version is always available on our website at: https://evulpo.com/en/uk/privacy

1. What is personal data, and what does data processing mean?

Personal data refers to information about an identified or identifiable natural person, such as a student, teacher, or parent. This includes, for example, your name, email address, or usage data generated while using the evulpo platform. In this privacy policy, the term “data” refers to such personal data.

Data processing refers to any action taken with data, whether or not by automated means. This includes, in particular, the collection, storage, use, modification, transmission, restriction, or deletion of data.

2. Who Is Responsible for Your Data?

Evulpo AG is the primary organisation responsible for processing your data when you use the Evulpo platform. In this capacity, Evulpo AG determines the purposes and means of the processing and is your point of contact for privacy questions. Our contact details are:

evulpo AG
Schifflände 26
8001 Zurich
Switzerland

[email protected]

Private Use: If you use Evulpo as a private individual (student or parent), Evulpo AG acts as the data controller for your information.

School Use: If you are using Evulpo as part of a school or educational institution (for example, a teacher creates student accounts or a school provides access to Evulpo), the school or institution may be the data controller for the students’ data, and Evulpo acts as a data processor on its behalf. This means the school determines why student data is collected and used, and Evulpo processes it according to the school’s instructions and our contractual agreement. We offer schools a Data Processing Agreement to ensure compliance with GDPR and Swiss law when handling student data. If you are a teacher or school administrator providing us with personal data about students, you are responsible for having the appropriate authority or consent.

3. What Personal Data We Collect and Why

We collect various types of personal data to provide and improve the learning platform. The specific data we collect depends on how you interact with Evulpo. Below, we describe the categories of data we process and the purposes for which we use them:

• Account and Profile Information: When you register for an Evulpo account, we ask for certain information to create your profile. For students, this may include your name, email address, school level or grade, and the region or school (e.g. canton or district) you attend. Teachers or parents who create accounts may provide similar information (such as name, contact details, school or class affiliation).
  
  Purpose: To identify you on the platform, deliver appropriate educational content (for example, exercises matching your grade level and curriculum), and maintain your account settings.
  
  
• Learning Progress and Usage Data: When you use Evulpo to learn, we collect data about your activities on the platform. This includes the lessons or subjects you view, exercises you complete, your answers and scores on exercises, your progress within a subject, and other study activities. If you are a student in a teacher’s class on Evulpo, we also record which class or teacher is linked to your account.
  
  Purpose: To improve educational outcomes and enable the core learning functionalities, for example, tracking your progress so that we can show you your results and provide feedback or corrections.
  
  
• Contact and Communication Data: If you get in touch with us, we will collect and keep your contact details and the content of the communication. This may include your name, email address, phone number (if you provided it), and any information you share in your message or question.
  
  Purpose: We use your information to respond to inquiries, provide customer support, and send marketing communications. If you are under 16, please get permission from a parent or guardian before subscribing to marketing communications. You can opt out of these communications at any time.
  
  
• Payment and Purchase Data: If you, your parent/guardian or a school decides to purchase a subscription or any paid feature, we will process the data needed for payment. This includes the name and billing information of the payer, payment method details (such as credit card or account number), and transaction information like payment date and amount.
  
  Purpose: To process your order, fulfil our contract by providing paid content access, and manage billing. We use third-party payment processors to handle your payment securely (see Section 5 on Service Providers)
  
  
• Technical and Device Data: When you visit evulpo.com or use the platform, our systems automatically collect certain technical information about your device and how you access our service. This includes your IP address, browser type and version, device type (e.g. laptop or smartphone and operating system), language settings, and the dates/times of your visits and interactions. This technical data by itself does not directly identify you, but it may be linked to your profile if you are logged in.
  
  Purpose: To ensure the website and platform function properly and securely. Technical data helps us deliver pages correctly, adapt the interface to your device, and maintain the security of our service (for example, by logging access and troubleshooting bugs).
  
  
• Behavioural and Analytics Data: We use cookies and similar tracking technologies to collect data about how you use Evulpo and how you arrived at our site. This may include information about the website or advertisement that brought you to Evulpo, which content or links you click on, the time you spend on certain lessons, and other interaction patterns. We may receive some of this data from third-party analytics tools (described in Section 7 below) that track usage on our behalf.
  
  Purpose: By analysing behavioural data, we can enhance the user experience. This data also helps us personalise your experience (for example, suggesting content you might find interesting).
  
  
• Other Data: We may process additional personal data in other contexts, consistent with the purposes described in this Policy. For example, we might collect information if you participate in a user survey, enter a promotion or contest, or provide feedback.

4. Legal Bases for Processing Personal Data

We process different types of personal data depending on how you use Evulpo, whether as a learner, teacher, visitor, applicant, or business contact. Below is an overview of the key categories.

• Performance of a Contract: Most of our data processing is necessary to deliver Evulpo’s services under our Terms of Service. For example, we process account details, progress data, and class information to provide access to the learning platform, whether you sign up directly or are registered by your school.


• Your Consent: In some cases, such as for optional cookies, we ask for your consent. You can always choose whether to give consent, and you can withdraw it anytime with future effect (e.g., via an unsubscribe link or cookie settings).


• Legitimate Interests: We may process data to improve and secure our services, prevent misuse, support business growth, or contribute to education research, provided this doesn’t override your fundamental rights. For example, we analyze usage patterns to improve features, send relevant updates to active users, and may share anonymised data with universities in Switzerland, the EU, or EEA for non-personal scientific research purposes. You can always object to processing based on legitimate interests.


• Legal Obligation: In certain cases, we must process data to comply with legal requirements, such as keeping transaction records for tax purposes or responding to lawful requests from authorities.


• Public or Vital Interests: Rarely, we may process data in the public interest or to protect someone’s vital interests, such as in an emergency. Currently, these bases are not actively used by Evulpo.

How does this apply to school use? When Evulpo is used by students via a school, teacher, or other educational institution, the primary legal basis for processing student data typically lies with the school. This may include the school’s legitimate interest in delivering education, its public task or legal mandate under applicable education laws, or performance of a contract between the school and Evulpo.

In such cases, the school or institution acts as the data controller and is responsible for ensuring an appropriate legal basis. Evulpo acts as a data processor on behalf of the school and processes data strictly according to the school’s instructions and under the school’s chosen legal basis.

Where Evulpo processes personal data as an independent controller, for example, to comply with legal obligations, improve platform performance, or prevent misuse, we rely on one of the legal bases described above, such as legitimate interest or legal obligation.

5. How We Share Your Personal Data

We do not sell your personal data to third parties. However, we do share your data with others in certain situations as necessary to run our business and provide our services. Whenever we share data, we ensure there is a proper safeguard or contract in place to protect your information. The main categories of recipients of personal data are:

• Service Providers (Processors): We work with third-party companies to help us operate Evulpo and process data on our behalf. These include, for example, hosting providers, IT infrastructure and software tools, email and notification services, analytics services, customer support tools, payment processors, and other technology providers. These third parties act under our instructions and are "data processors" under data protection law. This means they may only use your data for the specific tasks we’ve hired them to do, and they must protect your data to the same standards we do. You can find a regularly updated list of service providers here.


• Teachers and Schools (for School Accounts): If your Evulpo account was created as part of a school program or by a teacher, we share your relevant personal data with the person or institution organizing it. For example, if a teacher registers a class of students on Evulpo, that teacher (and possibly other authorized school staff) will be able to see certain information about the student accounts they manage. This typically includes the student’s name, class/grade level, and learning progress or scores on the platform. We provide this access to support the educational purpose of Evulpo in the classroom.
  
  Important: The personal data of students and teachers processed as part of school-based access is stored exclusively on servers operated by Hetzner Online GmbH, located in Germany. We will not, for example, send marketing emails directly to students in a school-organised class, nor share their data with any third party except as needed to provide the Evulpo service.
  


• Advertising Partners: We might work with an advertising partner or marketing platform (such as Google, Facebook, or other advertising networks) to reach people who might be interested in Evulpo. In doing so, we might provide a partner with limited data like your email address in an encrypted form or device identifiers so that they can check if you are also a user on their platform and then show you Evulpo advertisements or relevant content. We only engage in this kind of data sharing with your consent, where required. Online advertising through cookies or custom audiences will only involve your data if you have accepted advertising cookies or similar tracking (see Section 7). We do not share information like your learning progress or contact details with advertisers in a way that would identify you personally to them.


• Payment Providers and Financial Institutions: When you buy a subscription as an individual and make a payment to Evulpo, your payment details are handled by third-party payment processors Stripe or PayPal. We share with the payment processor data like email, billing address, and the amount to charge, and they will inform us if the payment was successful. Additionally, in some cases, we must share information with banks or credit card companies to process refunds or resolve disputes (for instance, if you request a chargeback or refund, we may need to provide proof of your transaction). These recipients process your data under their own legal obligations (e.g., anti-fraud and accounting laws), and we share only what is necessary for the transaction.


• Legal and Regulatory Authorities: We may disclose your personal data to government authorities, regulators, courts, or law enforcement agencies if we are required to do so by law or if such disclosure is reasonably necessary to (i) comply with a legal obligation, process, or request (for example, a subpoena, court order, or formal request from a data protection authority); (ii) enforce our Terms of Service or other agreements; or (iii) protect the rights, property, or safety of Evulpo, our users, or the public. If we receive a request for your data, we will carefully review it to ensure it has a valid legal basis and only provide the minimum data necessary. Where permitted, we may inform you of such requests.


• Corporate Transactions: If Evulpo AG is involved in a merger or an acquisition, your data may be transferred as part of that transaction. We would only do this as necessary to continue providing services to you, and any receiving party will be required to respect your personal data in a manner consistent with this Privacy Policy (we will ensure appropriate safeguards through the transaction agreements). If a transfer of your data is to occur, we will notify you and give you any choices that might be available at that time (for example, the opportunity to delete your data before transfer, if applicable under law).

Aside from the parties described above, your data is accessible to our in-house teams at Evulpo on a need-to-know basis (for example, our customer support team can view your profile data when assisting you, our technical team can access necessary data for maintenance, etc.). All Evulpo staff are bound by confidentiality and data protection obligations.

No Public Disclosure: We do not publicly publish your personal information. Other users of Evulpo cannot see your data except in the specific context of school use (as explained, a teacher can see their own students’ data). We do not make any data searchable or visible to the general public (Evulpo is not a social network).

6. Cookies and Online Tracking Technologies

Like most online platforms, Evulpo uses cookies and similar tracking technologies to make our website function, to understand how you use our services, and to assist with our marketing. This section explains what these technologies are and how we use them.

What are cookies? Cookies are small text files placed on your device when you visit a website. They serve different purposes, for example, keeping you logged in, remembering preferences, analysing usage, or supporting marketing. These can be set by us (first-party) or by partners (third-party, e.g., analytics or ad providers).

Types of cookies and tracking on Evulpo:

• Essential Cookies: These are necessary for the operation of our platform. For example, when you log in, we use a cookie to keep you logged in as you navigate through different pages, so you don’t have to re-enter your credentials on every click. Essential cookies also help with security (for instance, to keep your session secure or to help us detect malicious activity). Without these cookies, key features of Evulpo would not function correctly. Because they are necessary, these cookies are typically active by default, and you cannot opt out of them if you wish to use the core services (but they are also the least privacy-intrusive, as they usually do not collect any information beyond what is needed for the service).


• Preference and Functional Cookies: These cookies remember your choices and preferences to provide a more personalized experience. For example, we might use a cookie to save your language selection or the region/curriculum you last used, so that the site can present content relevant to your location without asking each time. They might also enable certain non-essential but helpful features on the site.


• Analytics Cookies and Tracking: We use analytics tools to collect information about how users interact with Evulpo. For this purpose, we and our analytics partners place cookies or similar trackers that collect data such as which pages of Evulpo you visit, how long you stay, how you move through our content, and what features you use. This helps us understand usage patterns and user behavior in aggregate. For example, we can see which subjects are most popular or whether a new feature is being used. The data collected via analytics cookies is typically aggregated and anonymized (e.g., statistics about total usage) so it does not directly identify individual users. However, if you are logged in, some analytics data might be associated with your account for our internal analysis, but we do not profile individual learners without consent beyond what is necessary for service improvement.


• Advertising and Marketing Cookies: Evulpo and our advertising partners may use cookies or pixels to deliver and track advertising content. Advertising cookies record information about your visit to Evulpo and your interests (such as which subjects you viewed) so that we or our partners can show you relevant ads on other websites or social media platforms. For example, we might use a Facebook Pixel on our site to notify Facebook that a certain user (anonymously identified) visited a page, which could later allow us to show an Evulpo advertisement to that user on Facebook. Likewise, if we run ads on Google or other networks, cookies help ensure that you don’t see our ads too many times and that they are displayed to the right audience. We may also use a method called “custom audiences” where we provide a hashed version of your email or user ID to an ad platform (like Facebook or Google); if you are a user of that platform, they can match the hash and include you in a group to receive a specific advertisement. This process does not reveal your actual email to the platform in plain text, and if you’re not a user of that platform, the data is ignored.
  
  Important: We will only use advertising cookies or share data for tailored advertising with your consent. When you first visit our site, our cookie banner will ask if you accept advertising cookies. If you decline, we will not use these cookies and you’ll simply see generic (non-targeted) ads or fewer Evulpo promotions. Even if you accept, you can change your mind later by adjusting your cookie settings or clearing cookies. Rejecting these cookies does not mean you will see no ads, just that ads will not be personalized using your data. Also, note that even when enabled, we do not share personally identifiable information to advertisers beyond what’s described (and often this sharing is in an encrypted or pseudonymous form). We do not allow third-party advertisers to independently track you on Evulpo for their own purposes; any advertising use of data is orchestrated by Evulpo with approved partners as described.
  


• Cookie Consent and Management: On your first visit to Evulpo, we display a cookie consent banner to inform you about our use of cookies. You can choose to allow all cookies or only essential ones. Your selection will be saved in a cookie so that we can remember your preferences for future visits. If you wish to change your preferences later, you can usually do so by clearing your browser cookies to trigger the consent prompt again. You can also manage cookie settings directly in your browser. Please note that blocking all cookies may limit the functionality of Evulpo; for example, you might not be able to log in or retain your settings.

7. Social Media and External Links

Evulpo’s website and communications may contain links to third-party websites, including social media platforms such as Facebook, Instagram, TikTok, LinkedIn, or YouTube (where we might have official pages or communities). We may also include simple links or icons that let you visit our profiles on these platforms or share content.

If you choose to click on those links or icons, you will be redirected to the respective third-party site. Please note: once you leave Evulpo’s site or interact with a social media plugin, the processing of your data is governed by that third party’s privacy policy, not Evulpo’s.

Social Media Logins: In the event of account creation or login via social media accounts (such as “Log in with Google” ), we will receive information from that provider as needed to authenticate you (for example, your email address and name). That information will be treated according to this Privacy Policy. Any data that the social media platform collects about your login is subject to their policy.

8. International Data Transfers

As a rule, we process your data within the EU. However, in some cases, such as when using specific service providers or software applications your data may be transferred abroad. These transfers primarily involve the European Free Trade Association (EFTA), but may also include countries worldwide, such as the United States (particularly in connection with cookies, social media plugins, and other third-party tools).

If personal data is transferred to a country that does not provide an adequate level of data protection under Swiss or EU law, we ensure appropriate safeguards are in place, typically through the use of standard contractual clauses approved by the European Commission, and where necessary, supplemented by additional security measures. In specific cases, we may rely on legal exceptions, such as your explicit consent, the necessity of the transfer for the performance of a contract, the establishment, exercise or defense of legal claims, overriding public interests, data made public by the data subject, or the need to protect the vital interests of individuals.

9. Data Retention and Deletion

We will retain your data only for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements.

Data Deletion Requests: You have the right to request the deletion of your data at any time (see Section 11, Your Rights). Upon such a request, we will evaluate which data we can delete. We will honor your request to the fullest extent possible, while also complying with any retention obligations.

10. Data Security

Evulpo takes the security of your data very seriously. We implement a variety of technical and organizational measures to protect your information from unauthorized access, loss, alteration, or disclosure. These measures include:

• Encryption: We use encryption protocols (such as HTTPS/TLS) to secure data in transit between your device and our servers. This means that when you enter personal information on evulpo.com, it is encrypted before being sent over the internet. We also employ encryption or hashing for certain sensitive data at rest (for example, passwords are stored in hashed form, which means they are not saved in plain text and cannot be easily recovered or read by anyone, including us).


• Access Controls: Personal data stored on our servers is accessible only to authorized personnel who need access to perform their job duties. We restrict access based on roles, and use authentication measures (like strong passwords, two-factor authentication, and monitoring of access logs) to prevent unauthorised internal access. Our staff and any collaborators are trained on data protection and bound by confidentiality obligations.


• Secure Infrastructure: We host data on servers operated by Hetzner Online GmbH in Germany. Hetzner is certified under ISO/IEC 27001, an internationally recognised standard for information security management, and implements robust technical and organisational measures to protect data. These include firewalls, DDoS protection, access controls, and regular security updates. Evulpo also performs encrypted backups to safeguard against data loss. All data is transmitted and stored securely, and access is restricted to authorised personnel only.


• Data Minimization: Wherever possible, we minimize the amount of personal data we collect and store. By limiting what we have, we reduce the risk associated with a potential security issue. For example, as noted, we do not store sensitive payment information on our systems; that is handled by specialized payment providers.

11. Your Rights as a Data Subject

As an Evulpo user, you have several rights regarding your personal data under applicable data protection laws like the Swiss FDPA and EU GDPR. While specific rights may vary slightly depending on where you live, we aim to uphold these rights for all users where possible:

• Access: You can access your data and receive a copy of it.
• Correction: If your data is incorrect or incomplete, you can ask us to update or correct it. In some cases, you can edit information directly in your account settings.
• Deletion: You can ask us to delete your data either entirely or in part unless we’re legally required to retain it.
• Objection: You can object to data processing in certain situations, especially for direct marketing. If we rely on “legitimate interests,” you can object for reasons specific to your situation.
• Withdraw Consent: If we process your data based on consent (e.g. cookies or marketing), you can withdraw that consent at any time.

To exercise any of these rights, contact us at [email protected].

12. Children’s Privacy and Special Considerations for School Use

Evulpo is an education platform that may be used by children (students) as well as adults (teachers, parents). Protecting children’s personal data is especially important to us.

Private Use: If you are under the age of 16, please use Evulpo only with the involvement of a parent or guardian. We require that children under 16 have permission from a parent or legal guardian to create an account for private use. In practice, this means a parent should supervise the sign-up process. We do not knowingly allow a child under 16 to sign up or buy a paid subscription without parental consent. If we learn that we have collected personal data from a child without proper consent, we will take steps to delete that data.

School or Teacher Use: In some cases, especially in educational settings, a teacher or school may act in place of parents to provide consent for the use of Evulpo in an educational context. If you are a teacher or school staff creating accounts for your students, you confirm that you have the authority to do so.

Limited Use of Children’s Data: We ensure that any personal data about students/children is used strictly for educational and support purposes. Any analytics data we collect regarding how a student uses Evulpo is used to improve educational outcomes and user experience. We do not share a child’s personal details with third-party advertisers, and any necessary communications about the account (like password resets) will be done in a privacy-conscious manner (often via the teacher or parent responsible).

13. Updates to this Privacy Policy

We may revise or update this Privacy Policy from time to time. Law, regulations, and our services can evolve, and we want our privacy practices to remain up-to-date and transparent. When we make changes, we will post the updated Policy on our website and change the “last updated” date below. If there are significant changes, we may also notify you directly through a prominent notice on our site or via email, especially if required by applicable law.

Last updated: April 24, 2025