Privacy Policy

Who is responsible for the data

• Your institution is the controller of the records it keeps in Growio: students, guardians, lessons, developmental objectives, session media and payment tracking. It decides what is entered and why.
• Talivio Technology OÜ is the processor. We host and operate the platform on the institution's instructions and do not use its records for our own purposes.
• For the institution's own account and subscription data, Talivio is the controller.

What data is processed

• Account — Name, e-mail address, role, password hash, and — if you link one — your Talivio Accounts identifier.
• Student records — Name, date of birth, gender, national identifier, address, application details, attendance, and developmental objective records with the teacher's observation notes.
• Health-related data — Diagnosis and anamnesis notes. Under GDPR Article 9 this is special category data and is processed only with explicit consent obtained by the institution.
• Session media — Photos and video recorded during lessons. Each item is released to a guardian only if the institution marks it visible; hidden items are never sent to the app.
• Messages — Conversations between a teacher and a guardian about a specific student.
• Technical — Device push notification tokens and an activity log of changes made inside the panel.

Legal bases

• Performance of the contract with the institution (Article 6(1)(b)) — operating the panel and the apps.
• Explicit consent (Article 9(2)(a)) — diagnosis, anamnesis and session media of a child.
• Legal obligation (Article 6(1)(c)) — accounting records of the subscription.
• Legitimate interests (Article 6(1)(f)) — keeping the service secure and diagnosing faults.

Who can see the data

• Only the institution the child is registered with, the teachers assigned to that child, and the guardian.
• We do not sell personal data and we do not share it with advertisers.
• Sub-processors: our hosting provider inside the EU, our e-mail provider, and — for the optional AI summary feature — the Talivio AI gateway.

AI-assisted summaries

If the institution uses the optional term summary feature, objective records are sent to the Talivio AI gateway to draft a text. The child's name, surname and diagnosis are never included in that request. The gateway is configured to route Growio's requests to EU providers only, and prompts are not stored.

International transfers

Data is stored inside the European Union. AI requests are restricted to EU providers. If this ever changes, the institution will be informed in advance.

How long data is kept

Records are kept while the institution's subscription is active. When an account is deleted from the app, it is removed from our systems; educational records the institution must retain by law are kept for that period and then deleted.

Automated decisions and profiling

Growio makes no automated decisions about you or your child that produce legal effects or similarly significant effects, and does no profiling. The optional AI summary only drafts text from the objective records a teacher has written; the teacher reads, edits and approves that draft. Assessment is always made by a human.

Where the data comes from

We receive your account data directly from you. A child's records are entered by the institution: the information the institution collected from you at enrolment, together with the observations, attendance and objective records teachers keep during lessons. So some data about your child reaches us from the institution rather than from you.

Do you have to provide data

The core details in account and student records are necessary for the institution to deliver its educational service; without them it cannot run the service. Health-related data such as diagnosis and anamnesis, and lesson media, rest on EXPLICIT CONSENT: you are not obliged to provide them, and withholding or withdrawing consent does not stop you using the service — only the related features become unavailable.

Your rights

Requests about a child's records are handled by the institution as controller. Write to them first; we support them in answering you.

• Access a copy of your data
• Have inaccurate data corrected
• Have data erased
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting processing already carried out
• Lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon)

Contact

Talivio Technology OÜ · Ahtri tn 12, 15551 Tallinn, Harju maakond, Estonia · [email protected]