Privacy policy

1. Introduction

ANCHA AidUTeach is a digital education platform that supports teachers in creating, administering and assessing educational activities. This policy explains how personal data may be collected, used, stored, disclosed and protected.

It applies to teachers, students, parents or legal representatives, webinar participants and others who interact with the Platform. Data is processed under the GDPR and applicable Romanian law.

2. Identity and contact details

The Platform is operated by GAMPAV S.R.L., Romanian company number 55710633, Trade Register J2026058050002, registered at 3 Mircea cel Bătrân Blvd., A1 building, D entrance, 7th floor, apt. 82, Târgoviște, Dâmbovița, Romania. Website: anchateach.com. Privacy contact: contact@anchateach.com.

GAMPAV S.R.L. acts as controller where it determines the essential purposes and means of processing and may act as a processor for educational data handled on behalf of a teacher, institution or other controller under applicable requirements and agreements.

3. Who uses the Platform

Teachers may prepare materials, organise classes, administer assessments and assignments, monitor progress and manage educational records. Students may create accounts, usually at a teacher's direction, and access content, assignments, assessments, feedback and results associated with teacher-led activities.

The Platform is also used by children under 13. The Student Area is not currently an independent learning service unrelated to a teacher.

4. Categories of data

• Teachers: name, email, account and authentication identifiers, permissions, classes, materials, activities and communications;
• Students: name, email, account identifiers and data needed to associate them with educational activities;
• Educational data: classes, tests, exercises, assignments, answers, scores, grades, feedback, progress, attempts, games and session participation;
• Technical and security data: technical identifiers, access events, connection data and logs needed for authentication, security and troubleshooting;
• Subscriptions and payments: plan, status, transaction identifier, billing and accounting records;
• Webinars and communications: registration and contact data, attendance, communication preferences and certificate information.

ANCHA AidUTeach does not store raw card details. They are collected and processed directly in the payment processor's secure interface.

5. Purposes and legal bases

• creating and administering accounts and delivering requested features – contract performance or steps requested by the user;
• managing educational activities and results – under the instructions and legal basis determined by the relevant controller;
• security, authentication, fraud prevention and incident handling – legitimate interests, legal obligation or processing for a controller, as applicable;
• payments, billing and required documents – contract performance and fiscal, accounting and legal obligations;
• webinars, support and service messages – delivery of the requested service or legitimate interests, as applicable;
• optional marketing communications – consent or another legal basis permitted by law.

6. Teachers, schools and student data

An individual teacher account or subscription does not automatically create an institutional contract or authorise the teacher to appoint a provider on behalf of a school. For independent activities, the teacher may be the controller of associated data; for official school activities, the institution may be the controller and the teacher may act under its authority. Roles depend on the facts and applicable law.

Teachers should access only the activities and student records they are authorised to manage and limit children's data to what is necessary.

7. Protection of children

Children's data requires special safeguards. Where processing relies on consent and Article 8 GDPR applies to a service offered directly to a child, the relevant age in Romania is 16 and parental authorisation may be required below that age. This does not mean parental consent is required for every school assessment, and a teacher's direction to create an account is not automatically parental authorisation.

8. Providers and recipients

The Platform uses service providers needed for its operation, including Supabase for authentication, backend and storage, Netlify for application hosting and Resend for certain transactional emails. Webinar, support, accounting and payment providers may also be involved where necessary.

Data may be disclosed to authorities or other recipients where required or permitted by law. Where processing involves transfers outside the European Economic Area, the mechanisms and safeguards required by the GDPR will be used.

9. Retention

Data is kept only for as long as necessary for the purpose for which it was collected, service delivery, compliance with legal obligations, dispute resolution and protection of rights. The period depends on the data category, educational relationship, instructions of the relevant controller and fiscal, accounting or security obligations.

Closing an account does not automatically delete every associated record, but any further retention must have a legal basis.

10. Your rights

Subject to GDPR conditions, individuals may request information and access, correction, deletion, restriction, portability, object to processing, withdraw consent and exercise rights applicable to decisions based solely on automated processing.

Requests may be sent to contact@anchateach.com and are handled within GDPR time limits, generally one month, subject to permitted extensions. Where GAMPAV processes data for another controller, it will forward or assist with the request under the applicable agreement.

Individuals may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing.

11. Automated assessment and artificial intelligence

The Platform may use rule-based automated correction and generate educational feedback. Teachers remain responsible for reviewing results and making assessment decisions. Under the current functionality, students' personal data is not intentionally sent to an external artificial-intelligence system.

12. Cookies and browser storage

The Platform currently places no first-party cookies, but uses local browser storage for authentication, language and certain educational activities. Details are available in the Cookie and similar technologies policy.

13. Security and incidents

GAMPAV applies technical and organisational measures appropriate to the risks, including access controls, authentication and incident-handling procedures. No transmission or storage method can guarantee absolute security. Personal-data incidents are assessed and documented, and notifications are made to controllers, authorities or individuals where required by the GDPR.

14. Changes and contact

This policy may be updated to reflect changes to the Platform, providers, processing or law. The version and update date will be published here. For questions or rights requests, contact contact@anchateach.com.