Privacy Policy

This Privacy Policy describes how Associazione non riconosciuta WaldorfMinds (“WaldorfMinds”, “we”, “us”, or “our”), with registered seat at Via Gioberti 67, 50121 Firenze, Italy, collects, processes, and protects the personal data of users (“you”) of the WaldorfMinds mobile application (available on iOS and Android) and website at waldorfminds.org (collectively, the “Platform”).

WaldorfMinds is committed to protecting your privacy and processing your personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), Italian Legislative Decree no. 196/2003 (as amended by Legislative Decree no. 101/2018), and any other applicable data protection legislation.

This Policy explains what data we collect, why we collect it, how we use and protect it, how long we retain it, and what rights you have in relation to it. We encourage you to read it carefully before using the Platform. By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

This Policy should be read together with our Terms of Service, Cookie Policy, and Community Guidelines.

The data controller responsible for your personal data is:

Associazione non riconosciuta WaldorfMinds
Via Gioberti 67, 50121 Firenze, Italy
Email: privacy@waldorfminds.org
Website: waldorfminds.org

For all data protection enquiries, requests to exercise your rights, or concerns about how your data is handled, please contact us at the email address above.

We collect personal data in the following ways: data you provide to us directly when using the Platform, data collected automatically through your use of the Platform, and data received from third-party services that power certain Platform features.

3.1 Data you provide directly

When you create an account and use the Platform, you provide us with the following categories of personal data:

Account registration data

• Email address: used as your login identifier and for account-related communications
• Password: stored in encrypted form using industry-standard hashing. We never store your password in plain text and cannot retrieve it.
• Year of birth: used to determine whether you are eligible to register and to apply appropriate age-based safety restrictions
• Account type: the category under which you register (student, parent, teacher, alumni, or organisation), which determines the features and communication permissions available to you

Profile data

• Display name or full name
• Profile photograph (optional)
• Biographical information or personal description (optional)
• School or organisation affiliation (optional)
• Country of residence or location (optional)

Content data

• Text posts, reflections, and other written content you publish on the Platform
• Photographs and images you upload to the Platform
• Any other materials you choose to share within the community spaces of the Platform

Communication data

• The content of private messages you exchange with other users through the in-app chat feature
• Reports and communications you submit to our moderation team

Correspondence data

• Any messages, requests, or enquiries you send to privacy@waldorfminds.org or other contact addresses

3.2 Data collected automatically

When you use the Platform, certain data is collected automatically by our systems or by the third-party services we use:

Technical data

• IP address
• Device type, model, and manufacturer
• Operating system and version
• Mobile application version
• Crash reports and error logs
• Network connection type

Usage data (website only)

• Pages visited and time spent on each page
• Referring website or source
• General geographic location at country level (derived from IP address)
• Browser type and version

Usage data for the website is collected through Google Analytics. This data is anonymised and aggregated. IP addresses are anonymised before storage. We do not use this data to identify individual users.

Push notification tokens (mobile app)

When you install the WaldorfMinds mobile application and enable push notifications, a unique device token is generated by Firebase Cloud Messaging (a service provided by Google LLC). This token is used solely to deliver functional notifications to your device, such as alerts about new messages or activity on your posts. Firebase does not receive the content of your messages or posts.

3.3 Data received from third-party services

Google Maps

The WaldorfMinds community map feature is powered by Google Maps. When you interact with the map, your device communicates with Google’s servers. Google may process your IP address and location data in accordance with its own privacy policy. We do not share your personally identifiable profile data with Google Maps, and we do not receive personal data about you from Google Maps.

We process your personal data only where we have a valid legal basis under the GDPR to do so. The legal basis applicable to each category of processing is set out below.

• Performance of a contract (Art. 6(1)(b) GDPR): We process account registration data, profile data, content data, and communication data to the extent necessary to provide you with the Platform and its features, as described in our Terms of Service. Without this processing, we cannot provide the service.
• Consent (Art. 6(1)(a) GDPR): We process optional profile data (such as profile photographs and biographical information) on the basis of your freely given consent. You may withdraw consent at any time by editing or deleting your profile information.
• Legitimate interests (Art. 6(1)(f) GDPR): We process technical data and certain usage data to maintain Platform security, prevent fraud and abuse, investigate reported content, and improve the performance and reliability of the Platform. We have assessed that our legitimate interests in these purposes are not overridden by your interests or fundamental rights and freedoms.
• Legal obligation (Art. 6(1)(c) GDPR): Where we are required by applicable law to process or retain certain data — for example, in connection with mandatory reporting obligations relating to illegal content — we process data on this legal basis.

4.1 Special provisions for users aged 14 to 15

Where the user is between 14 and 15 years of age, Italian law requires parental or guardian consent for the processing of personal data in connection with information society services. By registering, users in this age group confirm that they have obtained such consent from a parent or legal guardian.

Parents and guardians of users in this age group may contact us at privacy@waldorfminds.org to request information about the data processed in relation to their child’s account, to request correction of that data, or to request deletion of the account. We will respond to such requests within 30 days.

We use the personal data we collect for the following purposes:

• Account creation and management: to create your account, verify your eligibility, and provide you with access to the Platform
• Service delivery: to enable all Platform features, including posting content, browsing community spaces, using the map, accessing events and exchanges, and communicating with other users
• Age-based safety restrictions: to apply appropriate restrictions to users under 18, including limitations on private messaging with users in other account categories
• Push notifications: to send you functional notifications about activity relevant to your account, such as new messages, replies to your posts, or updates from organisations you follow. These notifications are opt-in and can be disabled at any time through your device settings.
• Content moderation: to review reported content and behaviour, enforce our Community Guidelines and Terms of Service, and maintain a safe environment for all users
• Security and fraud prevention: to monitor for unauthorised access, abuse, and violations of our Terms of Service
• Analytics and improvement: to understand how the website is used in aggregate and to improve its performance and usability (website only, via anonymised Google Analytics data)
• Legal compliance: to comply with applicable laws and regulations, including mandatory reporting obligations
• Communication: to respond to your enquiries, requests, and reports

We do not use your personal data for targeted advertising, profiling for commercial purposes, or any purpose incompatible with those described above.

The private messaging feature of WaldorfMinds allows users to communicate directly with one another. The content of your private messages is stored on our servers in Zurich, Switzerland, and is accessible only to the sender and recipient of each message.

WaldorfMinds does not read the content of private messages except in the following limited circumstances:

• Where a message has been reported by one of its recipients as potentially harmful, abusive, or in violation of our Community Guidelines or Terms of Service, our moderation team may review its content for the purpose of investigating the report
• Where we are required by law or court order to disclose the content of communications to public authorities

We do not share the content of private messages with third-party service providers, advertisers, or any other parties beyond those described above.

7.1 Storage location

Your personal data is stored on servers operated by Supabase Inc., located in Zurich, Switzerland. Switzerland is a country recognised by the European Commission as providing an adequate level of protection for personal data, pursuant to an adequacy decision issued under Art. 45 GDPR. No additional transfer safeguards are required for data stored in Switzerland.

7.2 International transfers to the United States

Some of the third-party services we use — in particular Google LLC (Firebase Cloud Messaging, Google Analytics, Google Maps) — are operated by entities based in the United States. Transfers of data to Google LLC are subject to the EU-US Data Privacy Framework, under which Google has certified its compliance, and/or to Standard Contractual Clauses approved by the European Commission. We have assessed these transfer mechanisms as providing an adequate level of protection for your data.

7.3 Retention periods

We retain your personal data for as long as your account remains active and for a reasonable period thereafter to allow you to reactivate your account if you wish.

• Account and profile data: retained for the duration of your account and deleted within 30 days of account deletion
• Content data (posts, photographs): deleted within 30 days of account deletion, unless individual pieces of content have been reported and are subject to an ongoing moderation review
• Private messages: deleted within 30 days of account deletion. Messages may be retained for longer where they have been reported and are subject to a moderation review or legal hold.
• Technical and security logs: retained for up to 12 months for security purposes
• Data subject to legal retention obligations: retained for the period required by applicable law

We do not sell, rent, or trade your personal data to any third party. We share personal data only in the following circumstances:

8.1 Service providers (data processors)

We share personal data with the following service providers who process data on our behalf under data processing agreements:

• Supabase Inc. (Zurich, Switzerland): database hosting, authentication, and storage infrastructure
• Google LLC — Firebase Cloud Messaging: delivery of functional push notifications to mobile devices
• Google LLC — Google Analytics: anonymised website usage analytics
• Google LLC — Google Maps: community map feature within the mobile application and website

Each of these providers processes only the data necessary for the specific service they provide and is contractually prohibited from using your data for their own purposes.

8.2 Legal disclosure

We may disclose personal data to law enforcement authorities, courts, or other public bodies where we are required to do so by applicable law, court order, or legal process, or where we have a good-faith belief that disclosure is necessary to prevent or address a serious and imminent threat to the safety of any person.

8.3 Moderation-related disclosure

In the event that reported content or conduct is referred to law enforcement authorities, relevant data (including account information, content, and communications) may be shared with those authorities as part of that referral.

As a data subject under the GDPR, you have the following rights in relation to your personal data. These rights may be subject to certain limitations and conditions under applicable law.

• Right of access (Art. 15 GDPR): You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data and information about how it is processed.
• Right to rectification (Art. 16 GDPR): You have the right to request correction of inaccurate personal data and completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to legal retention obligations and legitimate interests in retaining certain data.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request that we restrict the processing of your data in certain circumstances, for example while a dispute about accuracy is resolved.
• Right to data portability (Art. 20 GDPR): You have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to object (Art. 21 GDPR): You have the right to object to processing of your personal data carried out on the basis of our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making: We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

To exercise any of the above rights, please contact us at privacy@waldorfminds.org. We will respond to your request within 30 days. If your request is complex or numerous, we may extend this period by a further two months, in which case we will notify you.

You also have the right to lodge a complaint with the Italian Data Protection Authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, Italy, www.garanteprivacy.it.

WaldorfMinds implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encrypted storage of passwords using industry-standard hashing algorithms
• HTTPS encryption for all data transmitted between your device and our servers
• Access controls limiting which members of our team can access personal data, on a need-to-know basis
• Regular review of security practices as the Platform develops

We note that no method of electronic transmission or storage is completely secure. While we take data security seriously and strive to implement appropriate protections, we cannot guarantee the absolute security of your data. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

Our website uses cookies and similar technologies. Our Cookie Policy, available at waldorfminds.org, provides full details of the cookies we use, their purposes, and how you can manage your cookie preferences. The WaldorfMinds mobile application does not use browser cookies.

WaldorfMinds is designed for users aged 14 and above. We do not knowingly collect personal data from children under the age of 14. If we become aware that a user is under 14, we will promptly delete their account and associated data.

For users between 14 and 15 years of age, heightened protections apply, as described in Section 4.1 above. Our full approach to the protection of younger users is set out in our Child Safety Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. Where changes are significant, we will notify you through the Platform or by email to the address associated with your account, with reasonable advance notice. The date of the most recent revision appears at the top of this document. We encourage you to review this Policy periodically.

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data, please contact us at:

privacy@waldorfminds.org
Associazione non riconosciuta WaldorfMinds
Via Gioberti 67, 50121 Firenze, Italy