Privacy policy

Who is responsible

The ELMYOLU initiative is responsible for your data. The operator’s name and address are shown at the top of this page. For any question about your data: elmyolu@gmx.de.

We process data in line with the EU General Data Protection Regulation (GDPR) and the Law of the Republic of Azerbaijan “On Personal Data”.

What we store

• Account: name, e-mail, a one-way hash of your password, interface language, the type of second sign-in step; optionally country, city and phone.
• Teacher profile: subjects, grades, languages, format, weekly free times, what you write about your education and experience, and documents you upload.
• Lesson request: only the child’s first name and age group, subject, grade, language, suitable times, notes, the date of the parent’s consent and the version of the consent text.
• Lessons and group classes: lesson times, topics, homework, the teacher’s notes, homework answers and files, quiz results and attendance.
• Messages between a parent and a teacher, and notifications on the site.
• Support portal: listings and contact requests.
• Expert applications: profession, organisation, licence or registry number, uploaded document.
• Safety: reports, blocks, private feedback about lessons, a log of staff actions, and a one-way hash of the IP address.

Why, and on what legal basis

• To run your account, lessons, classes, messages and listings: providing the service you asked for (GDPR Art. 6(1)(b)).
• Information about a child: with the explicit consent of a parent or legal guardian (GDPR Art. 6(1)(a) and Art. 8). You can withdraw consent at any time; this means closing the request or class enrolment.
• Safety, investigating complaints and preventing misuse: our legitimate interest in protecting children (GDPR Art. 6(1)(f)).
• Showing an expert’s name on the public list: only with the expert’s consent.
• We do not sell data, use it for advertising, build profiles or make automated decisions.

Children’s data

• Only people aged 18 or over can open an account. A parent or legal guardian sends requests for a child.
• We never ask for a child’s surname, school, address or photo, and never show a child’s name publicly.
• In a group video lesson children see each other’s faces and first names. Parents’ contact details are not shown to other families.

Who sees what

• A teacher’s public profile: name, subjects, grades, languages and what they write about themselves. Their e-mail and phone are not public.
• Lesson requests, lessons, homework and reports: the parent, the assigned teacher and coordinators.
• Group classes: the teacher sees the child’s first name and age group; other parents do not.
• Contact details: shown to the other side only when both agree.
• Teacher and expert documents: only coordinators and the administrator. Every opening is logged.
• Reports and complaints: only coordinators and moderators.

Messages: only when there is a complaint

A conversation between a parent and a teacher is seen only by them. Nobody on the ELMYOLU team reads conversations as a matter of course.

The rule is this: a conversation can be opened only when a complaint has been made about it or about that lesson, only to investigate the complaint, and only from the complaint’s page. There is no other way in. Every opening is written to the log and to the complaint’s notes, with who opened it and when. There are no exceptions to this rule.

Video lessons

Video lessons run on ELMYOLU’s own video server. They are not recorded, and the server does not store video, audio or chat. Only the participants of that lesson can enter the room, using a temporary key.

E-mails and notifications

We send only service e-mails (confirmation, sign-in codes, lesson reminders, the status of a request), in the language you use. We never send advertising.

Cookies

The site uses one session cookie that is needed for signing in and security. There are no analytics, tracking or advertising cookies, so there is no cookie banner.

Service providers

• Server: IONOS SE (Germany). Data is stored in the European Union.
• E-mail delivery: IONOS SE or GMX (1&1 Mail & Media GmbH), both in Germany.
• Video: ELMYOLU’s own server; no data goes to an outside video service.

How long we keep data

• Account, profile, lesson, class, message and listing data: until you delete your account. When you do, this data is deleted at once.
• Notifications on the site and the security log: 12 months.
• Sign-in codes sent by e-mail: 1 day.
• Closed complaints: 2 years after they are closed.
• The document of a rejected expert application: 6 months.
• Backups: 14 days. Deleted data disappears from backups within 14 days.

Security

• All connections are encrypted with HTTPS. Passwords are stored only as one-way hashes.
• Anyone can turn on a second sign-in step (an authenticator app or an e-mail code); it is required for staff.
• Each staff member sees only their own area. The admin session ends after 60 idle minutes or after 8 hours.
• Uploaded files are never public and are scanned for viruses where possible.

Your rights

• See and download your data: “Download my data” in your account.
• Delete your account and data: “Delete account” in your account.
• Correction, restriction, objection or withdrawing consent: write to elmyolu@gmx.de. We reply within one month.
• Complaints: you can contact the data protection authority in the country where you live.

Changes

If we change this policy, we publish the new version here and update the date. We tell registered users about important changes by e-mail.