Privacy Policy

1. Data Controller

The data controller under GDPR is:

• Company name: ATINA 468 EOOD (АТИНА 468 ЕООД)
• Company ID (EIK): 207922011
• Registered address: Sofia, 18 Hristaki Pavlovich St., Bulgaria
• Email: hello@edubgsense.com
• Website: edubgsense.com

2. What Data We Collect

2.1 Registration Data

2.2 Usage Data

• Game results and learning activity
• Created games (teachers only)
• Registration date and last login

2.3 Technical Data

• IP address (for security and GDPR audit log)
• Browser type and device
• Cookies — see our Cookie Policy

2.4 Payment Data

Payments are processed by Revolut Ltd. We do not store payment card data. When requesting access, we only collect your email and selected subjects.

3. Legal Bases for Processing

• Contract performance (Art. 6(1)(b) GDPR) — registration, login and service provision
• Legitimate interests (Art. 6(1)(f) GDPR) — security and fraud prevention
• Consent (Art. 6(1)(a) GDPR) — marketing emails (only with explicit consent)
• Legal obligation (Art. 6(1)(c) GDPR) — GDPR audit log

4. Retention Periods

5. Data Sharing

We do not sell personal data. Data may be shared only with:

• Jethost — hosting provider (servers in the EU)
• Revolut Ltd — payment processing
• Google Fonts — fonts (IP address)

All processors are in the EU or operate under Standard Contractual Clauses.

6. Your Rights Under GDPR

• Right of access (Art. 15) — you can request a copy of your data
• Right to rectification (Art. 16) — you can correct inaccurate data
• Right to erasure (Art. 17) — the "right to be forgotten"
• Right to restriction (Art. 18) — you can restrict processing
• Right to data portability (Art. 20) — you can receive your data in machine-readable format
• Right to object (Art. 21) — you can object to processing
• Right to withdraw consent — at any time, without consequences

To exercise your rights, contact us at: hello@edubgsense.com

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): www.cpdp.bg

7. Children and Minors

The service is aimed at students. Under GDPR Art. 8, children under 16 must register with explicit parental or guardian consent. Parents can register their child through a parent account.

We do not knowingly collect personal data from children under 13 without parental consent.

8. Data Security

• Passwords stored encrypted with bcrypt (cost 12)
• SSL/TLS encryption on all connections
• Restricted database access
• Regular backups
• GDPR audit log for all critical operations

9. Cookies

We only use technically necessary cookies for sessions. We do not use tracking or advertising cookies. See the full Cookie Policy.

10. Changes to This Policy

For material changes, we will notify registered users by email at least 30 days in advance. The current version is always available on this page.