01Controller
The operator of the Smart City Explorer app and website and the controller of personal data is Brand Institute, o. z. (civic association), Reg. No. (IČO) 42174180, registered office Havelkova 2795/30, 841 03 Bratislava, Slovak Republic.
The app was created in cooperation with the Faculty of Social Sciences, University of Ss. Cyril and Methodius in Trnava (FSV UCM), within the project KEGA 004UCM-4/2023. FSV UCM is not a controller of the personal data of app users.
Contact for data protection matters and for exercising your rights: info@smartcityexplorer.sk.
02What data we process
Depending on how you use the app we process:
- Registration data — name, e-mail, school or town, target group (primary/secondary/university/adults).
- Activity data — progress in modules, quiz results, score and coins earned, participation in challenges.
- Technical data — device type, language and basic diagnostics needed to run the service.
- Date of birth — only for the age check, i.e. to determine whether consent of a legal guardian is needed.
- Reward delivery data — when coins are exchanged for physical rewards: name, surname and delivery address, optionally a phone number, and order data.
- Parent account data — first name, surname, verified e-mail and a password stored only as a hash.
03Purpose and legal basis
We process personal data for these purposes:
- Providing the service — account, educational content, coins and rewards (performance of a contract, or consent).
- Leaderboards and challenges — showing rankings by location and school.
- Educational research — evaluating and improving the educational content in research cooperation with FSV UCM (project KEGA 004UCM-4/2023), exclusively in pseudonymised or aggregated form (legitimate interest of the controller).
- Age check and consent of a legal guardian — determining whether consent of a legal guardian is needed to exchange coins for physical rewards, and keeping evidence of that consent (Section 15(1) of Slovak Act No. 18/2018 Coll. and Art. 8 GDPR).
04Retention
We keep the data while the account exists and for as long as required by law. Research data is kept after evaluation only in anonymised form, from which no individual can be identified.
05Sharing with third parties
We do not sell personal data and do not provide it for third-party marketing. Only processors necessary to run the service handle the data:
- Apple App Store and Google Play (app distribution),
- the hosting provider — a server in the EU operated for Brand Institute, o. z., which runs the app, the administration, the database and the newsletter mailing system (Acelle),
- an SMTP provider (sending e-mails, e.g. account verification, parental consent requests and newsletters).
Research cooperation with FSV UCM — researchers of the Faculty of Social Sciences, UCM in Trnava (project KEGA 004UCM-4/2023) only receive learning data without names, e-mail addresses, postal addresses or other contact details, labelled with a random code (pseudonymised), or aggregate statistics. Only Brand Institute, o. z. holds the key to these codes. Research results are published only in aggregate form that does not allow any individual to be identified.
07Your rights
As a data subject you have the right:
- to access and rectify your data,
- to erasure (“right to be forgotten”) and restriction of processing,
- to object to processing and to data portability,
- to lodge a complaint with a supervisory authority.
A child's legal guardian has the right to access, export, rectify, erase and restrict the processing of the child's data, to withdraw consent at any time and to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR). Consent, data export and deletion of the child's account can be handled directly in the parent account.
You can exercise your rights at info@smartcityexplorer.sk.
08Deleting your account
You can delete your account and its data at any time in the app, or write to us. The steps and the list of what is deleted are on the Account deletion page.
09Children under 16 and consent of a legal guardian
The app is also used by primary and secondary school pupils. Pupils under 16 can use the educational app normally (modules, lessons, quizzes, polls) without the consent of a legal guardian.
- When consent is needed — we require consent of a legal guardian under Section 15(1) of Slovak Act No. 18/2018 Coll. and Art. 8 GDPR only for exchanging collected coins for physical rewards, because we then process the child's name, surname and delivery address (optionally a phone number and order data). Without consent the account is not deleted; only coin redemption and entering a delivery address are blocked.
- Date of birth — at registration we ask for the date of birth solely to determine whether consent of a legal guardian is needed (age check). Age is calculated in the Europe/Bratislava time zone.
- Verification via the guardian's e-mail — a child under 16 may enter a parent's e-mail address, which must differ from the child's own. We send the parent an e-mail with a single-use link valid for 14 days (with one reminder after 7 days). The parent confirms that they are the child's legal guardian and grants or refuses consent. Consent can also be granted in a parent account.
- Consent log — every step is recorded as evidence (time, IP address, browser identifier – user agent, text version and method). The log is kept as evidence even after the account is deleted, with no link to the deleted account.
- Links in e-mails — tokens in links are stored only as hashes; expired tokens are deleted daily.
- School and municipality — the school sees the pupil's username or name, grade and learning progress. The municipality sees only aggregated results; groups of fewer than 5 pupils are hidden. Neither the school nor the municipality sees the delivery address.
- No marketing — we never send marketing e-mails to pupils.
10Parent account
A legal guardian can create a parent account in the app (option “I am a parent”) or on the portal admin.smartcityexplorer.sk/rodic.
- Data processed — first name, surname, e-mail (verified) and a password stored only as a hash.
- Linking with a child — automatically, if the child entered the parent's e-mail and the parent verified that e-mail, or with a pairing code: the child generates a one-time 8-character code in the app (Profile → Link with parent), valid for 48 hours, and the parent enters it under “Add child”. Only a hash of the code is stored.
- What the parent sees — only linked children: name, school, grade, completed modules, lessons and quizzes, points, coin balance, last activity and consent status.
- What the parent can do — grant or withdraw consent at any time (withdrawal does not affect the lawfulness of processing before it), download the child's data (JSON export), unlink the child, and permanently delete the child's account as well as their own account.
- Marketing — parents receive no marketing e-mails unless they subscribe themselves.