Privacy Policy

MindED is a tool designed for mobile devices, tablets, and web browsers that allows elementary school students to independently reinforce their academic knowledge in English, Spanish, and mathematics. The activities will be completed by the students outside of school hours, and student progress will be monitored solely by their parents or legal guardians.

The tool has two user profiles: the student's parent or legal guardian (hereinafter "Parent") and the student (collectively, "Users"). Both will be users of the application. The Parent must register on the tool and activate the student's account. To do so, they will need to provide certain identifying information about the student.

We believe you should always know what data we collect from you and how we use it, so you have control over it. Below is the information you need to make the best decisions about the information you share with us.

That is the basic purpose of this Privacy Policy.

Here we describe the privacy practices for our services, including our websites, apps, cognitive assessments, brain training programs, academic review activities, SMS, APIs, email notifications, buttons, widgets, advertisements, commerce services, and other covered services that link to these Terms (collectively, the "Services").

Specifically:

• Data Controllers

• Information we collect

• How we use information

• How information is shared

• Your rights to access and control your personal data

• Data retention

• Analytics and advertising services provided by others

• Our policies for children

• Information security

• Our international operations and data transfers

• Privacy Disclosure in Europe

• Changes to this policy

• How to contact us

0. Data Controllers

The personal data collected will be processed, as the data controller, by Sanoma Educación, SLU, a Spanish company with registered office at Ronda de Europa 5, 28760 Tres Cantos (Madrid - Spain), with NIF number: B-28119261, registered in the Mercantile Registry of Madrid in volume 9,985, folio 213, sheet M-6,201, entry 59th (hereinafter, Santillana).

This application has been developed jointly with the provider CogniFit Inc. who assumes the management and maintenance of the tool on behalf of Santillana and as the data processor.

Santillana, as a company belonging to the Sanoma Group, has voluntarily appointed a Data Protection Officer through whom users can submit complaints, claims, and suggestions regarding the processing of their personal data, as well as exercise their rights. To do so, users may contact the following email address: dpo.spain@sanoma.com

1. Information we collect

When you use our Services, we collect the following types of information.

1.1. Information that you provide to us

Account information

Full use of the Services requires you to create an account by providing different information depending on your account type. This information may include your name, a valid email address, and a secure password. This is the only information you need to provide to create an account with us. Please note that the name you use is always public, but you can choose your real name or a pseudonym. You can also choose to use the application without registering.

Additional information

To help improve your experience or enable certain features of the Services, you may choose to provide us with additional information.

If you contact us or participate in a survey, contest, or promotion, we collect the information you submit to us, such as your name, contact information, and message.

Payment and Card Information

You may provide us with payment information, including your credit or debit card number, expiration date, CVV code, and billing address, in order to purchase a subscription or other offers provided as part of our Services. Payments are processed exclusively by third-party payment processors.

MindED does not store or have direct access to your payment data .

These processors may retain such information according to their own privacy policies and legal requirements, which are independent of MindED.

MindED partners with the following payment processors:

• Payments on the website are processed by FastSpring with their own privacy policies available at https://fastspring.com/privacy .

• Mobile payments are processed by Apple or Google with their own privacy policies available at https://www.apple.com/privacy/privacy-policy/ and https://policies.google.com/privacy?hl=en&gl=us

  respectively.

MindED uses analytics and marketing tools, including the Meta Pixel (on the web and in the app), to understand how our services are used and to optimize our campaigns. In the Android app, we collect the Google Ad ID solely for statistical and ad personalization purposes, without associating it with sensitive personal data.

1.2. Information we receive from your use of our services

Information about the device and its geolocation

When you visit or leave our Services, we may receive the URL of both the site you came from and the site you will visit next. We may also collect information about your IP address, proxy server, operating system, web browser and plugins, device identifier and features, and/or your ISP or mobile carrier. If you use our Services from a mobile device, that device may send us location data based on your phone's settings. We will ask you to enable this option before using GPS or other tools to pinpoint your exact location.

Usage information

When you access or use our Services, we receive certain information about your network usage or activity. This includes information about your interaction with the Services, such as when you view or search for content, install applications or software, or create or log in to your account.

Third-party service information

Santillana will not transfer users' personal data to any third party without a legal basis that legitimizes such processing. To fulfill the purposes indicated in this Policy, it may be necessary for us to grant access to your personal data to third parties such as: fraud detection and prevention entities, technology and analytics service providers, customer service providers, and marketing and advertising service providers and collaborators, such as advertising agencies, advertising partners, or social networks, which, in certain cases, may act as joint controllers or public authorities.

Some of these third parties are located in territories outside the European Economic Area that do not provide a level of data protection equivalent to that of the European Union. In such cases, we inform you that we transfer your data with appropriate safeguards and always maintain the security of your data, as we use the most appropriate tools for international data transfers, such as Standard Contractual Clauses or any other relevant supplementary measures. You can consult the content of the Standard Contractual Clauses at the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transferpersonal-data-third-countries_en

If you choose to connect your account on our Services to your account on another service, we may receive information from that other service. For example, if you connect through Google, we may receive information such as your name, profile picture, age range, gender, language, and email address. You can also choose to give us access to your activity from another service. You can stop sharing information from the other service with us by removing our access to that other service.

We may partner with third parties, such as educational institutions or research centers, that offer MindED services to their students or participants. In such cases, these organizations may provide us with your name, email address, or similar information (such as a phone number or subscriber ID) so that we can invite you to participate or determine your eligibility for particular benefits, such as discounts or free services.

Links

In order to operate our services, we may track how you interact with links through our services. This includes links in emails we send you and links to MindED that appear on other websites or mobile applications.

If you click on an external link or advertisement on our Services, that advertiser or website operator may discover that you came from MindED, along with other information associated with the advertisement you clicked on, such as the characteristics of the audience it was trying to reach. They may also collect other personal data from you, such as cookie identifiers or your IP address.

Messages

We collect information about you when you send, receive, or participate in messages related to our Services. For example, if you receive a notification to complete a training session, we track whether you have acted upon it and send you reminders.

Partners

We receive personal data about you when you use the services of our clients and partners.

2. How we use the information

We use the information we collect for the following purposes.

Purposes and legal basis for processing users' personal data

The user data provided by the Controller will be processed solely for the following purposes:

• To activate the subscription to the services provided through this mobile application;

• Ensure the functionality, security and access to the application;

• To send the Santillana newsletter or commercial communications related to the education sector to the Data Controller who has so consented; and

• Manage incidents and application maintenance.

For all of the above, Santillana will process the following personal data:

• identifying data of the Responsible Party (i.e., name, surname and email address);

• Student identification data (i.e., name, academic year, center):

• information about the student's use of the tool (i.e., exercises performed, errors and successes);

• connection and browsing data (e.g., location data, device identification number or IP address);

Remember that your data of an economic and transactional nature (for example, your payment or credit card details) will be processed by the chosen app store.

The legal basis that legitimizes the processing of data may vary depending on the purpose of the processing:

• Contract execution: To make effective the service provision contract signed between the parties.

• Consent: Sending commercial communications provided that the Data Controller has consented.

• Legitimate interest:

  • To respond to any of your requests or issues.

  • Ensure the functionality, accessibility, and maintenance of the application.

Provide and maintain services

Using the information we collect, we can provide you with the Services and honor our Terms and Conditions agreement with you. For example, we need to use your information to provide you with a dashboard that tracks your cognitive performance, activity, and other trends; to enable the Services' community features; and to provide customer support.

For the Services' community features, we may use your information to help you find and connect with other users and to allow other users to find and connect with you. For example, your account contact information allows other users to add you as a friend. When another user has your email address in their contact list or friends network on a connected service, we show them that you are a user of the Services.

Improve, Customize and Develop Services

We use the information we collect to improve and personalize the Services and to develop new ones. For example, we use information to troubleshoot and protect against errors; perform data analysis and testing; conduct research and surveys; and develop new features and services.

When you allow us to collect information about your location, we use it to provide and improve the features of the Services, such as comparing your results to the average score of people in the same location.

We also use your information to make inferences and show you more relevant content. Here are some examples:

• Information such as age and sex allows us to improve the accuracy of your cognitive needs and goals, as well as select exercises for the user and adjust the level of difficulty based on your performance.

• Using the results of the cognitive assessment, we can provide you with personalized ideas to help maintain or improve cognition.

• 
  

Contacting you

We use your information when necessary to send you Service notifications and respond to your inquiries. We also use your information to promote new features or products that we believe may interest you. You can control marketing communications and most Service notifications using your notification preferences in your account settings or by clicking the "Unsubscribe" link in the email.

Commercial communications

We would like to inform you that the tool used to send the email newsletter will include tiny, transparent links and images associated with your email address. This means that when you download one of these images or click on the links in the email, Santillana can determine, for statistical purposes, whether the email has been opened or if any links within it have been clicked. You can prevent this by configuring your email client or program to block the automatic download of images and by not clicking on the links included in the emails you receive.

In each communication, you can opt out of receiving this type of information through the contact method indicated for processing your unsubscription.

At any time you may exercise your rights of access, rectification, erasure, objection, limitation, portability or revoke your consent as indicated in section 4. Your rights of access and control of your personal data .

Customer service

We use the data (which may include your communications) to investigate, respond to, and resolve complaints and problems with the Service (e.g., errors).

Promote safety and security

We use the information we collect to promote the security of the Services, our users, and other parties. For example, we may use information to authenticate users, facilitate secure payments, protect against fraud and abuse, respond to a legal request or claim, conduct audits, and enforce our terms and policies.

Aggregate Perspectives

We use your data to produce and share aggregated information that does not identify you. For example, we may use your data to generate statistics about our users to publish cognitive demographic insights.

3. How information is shared

We never sell our users' personal information. We do not share your personal information except in the limited circumstances described below.

Profile

By default, only your name is visible to other users of the Services. You can ask us to share more information with others, such as when your account is linked to your parents (see the next paragraph) or when you use our community features like challenges and other social tools. For certain information, we provide privacy preferences in your account settings and other tools to control how your information is visible to other users of the Services.

Business and family accounts

Parents can grant access to the Services and access their personal data, such as their cognitive activity, academic performance, and results.

Third-party services

Subject to your account settings, other services may search your profile. When you choose to link your account with other services, your personal data will be available to them. The sharing and use of this personal data will be described in, or linked to, a consent screen when you choose to link the accounts. For example, you can link your Facebook account to share content from our Services with these other services. You can revoke the link to those accounts.

Service providers

We transfer information to our corporate affiliates, service providers, and other partners who process it on our behalf, based on our instructions and in accordance with this policy and any other appropriate confidentiality and security measures. These partners provide us with services worldwide, including development, maintenance, customer support, information technology, payments, sales, marketing, data analysis, research, and surveys. They will have access to your information as reasonably necessary to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

The law, the harm, and the public interest

We may preserve or disclose information about you to comply with a law, regulation, legal process, or governmental request; to enforce legal rights or defend against legal claims; or to prevent, detect, or investigate illegal activity, fraud, abuse, violations of our terms, or threats to the security of the Services or the physical safety of any person.

Our policy is to notify you of legal proceedings seeking access to your information, such as court orders or subpoenas, unless prohibited by law. In cases where a court order specifies a nondisclosure period, we provide delayed notice after the nondisclosure period has expired. Exceptions to our notification policy include compelling or counterproductive circumstances, such as an emergency involving a risk of death or serious physical injury to a person.

Affiliates and change of ownership

If we are involved in a merger, acquisition, or sale of assets, we will continue to take steps to protect the confidentiality of personal information and notify affected users before transferring any personal information to a new entity.

Non-Personal Information

We may share aggregated or de-identified non-personal information so that it cannot reasonably be used to identify an individual. We may disclose such information publicly and to third parties, for example, in public reports on performance and activity, to partners under agreement with us, or as part of community benchmarking information that we provide to users of our subscription services.

4. Your rights to access and control your personal data

Regarding the processing of this data, you may exercise your rights of access, rectification, erasure, objection, portability, and restriction of processing by contacting Santillana by mail at Santillana's address, providing proof of identity with a scanned copy of your national identity document or equivalent, and specifying the right you wish to exercise. The User has the right to lodge a complaint with the Spanish Data Protection Agency ( www.aepd.es ) and with the Data Protection Officer of Sanoma Educación SLU ( dpo.spain@sanoma.com ).

We offer you account settings and tools to access and control your personal data, as described below. If you live in certain jurisdictions, you may have legal rights regarding your information, which your account settings and tools allow you to exercise, as described below.

Data access and export

By logging into your account, you can access much of your personal information, including cognitive activity statistics.

Editing and deleting data

Personal data will be actively processed to fulfill your request and provide the requested service until you withdraw your consent or while you remain a user; that is, until you exercise your right to erasure.

Once the purpose of the processing has been fulfilled, the personal data will be duly blocked for the period necessary to comply with the legal obligations arising from the processing; after this period, the data will be deleted.

Your account settings allow you to change and delete your personal information. For example, you can edit or delete your profile data and your account if you wish.

If you decide to delete your account, please note that all data, scores, and information will be permanently deleted, except as noted below.

We retain your personal data even after you close your account if reasonably necessary to comply with our legal obligations (including law enforcement requests), meet regulatory requirements, resolve disputes, maintain security, prevent fraud and abuse, enforce our Terms of Use, or fulfill your request to "unsubscribe" from further messages from us. We will retain non-personal information after your account has been closed.

Information you have shared with others (for example, with a parent) will remain visible after you close your account or delete the information from your profile or inbox, and we do not control data that other users copy from our Services. Community feature content associated with closed accounts will show an anonymous user as the source.

Please note that although most of your information will be deleted within 30 days, it may take up to 90 days to delete all of your information, such as data stored on our backup systems.

Objection to the use of data

You have access to account settings and tools to control the use of your data. For example, through your privacy settings, you can limit the visibility of your information to other users of the Services; using your notification settings, you can limit the notifications you receive from us; and in your account settings, you can revoke access to third-party applications that you have previously connected to your MindED account.

5. Data retention

We retain your account information, such as your name, email address, and password, for as long as your account exists because we need it to operate it. In some cases, when you provide us with information for a feature of the Services, we delete the data after it is no longer needed for that feature. For example, when you provide us with your contact list to find friends on the Services, we delete it after it has been used to add contacts as friends. We retain other information, such as your exercise or activity data, until you use the account settings or tools to delete the data or your account, as we use this data to provide you with personal statistics and other aspects of the Services. We also retain information about you and your use of the Services for as long as necessary for our legitimate business interests, for legal reasons, and to prevent harm, including as described in the sections How We Use Information and How Information Is Shared.

6. Analytics and advertising services provided by others

We work with partners who provide us with analytics and advertising services. This includes helping us understand how users interact with the Services, serving ads on our behalf across the internet, and measuring the performance of those ads. These companies may use cookies and similar technologies to collect information about your interactions with the Services and other websites and applications.

7. Our policies for children

The Data Controller declares that they have all the legally required permits to authorize the processing of the student's personal data. Minors may not use the application without the consent of their parents or guardians.

The term "children" refers to individuals under the age of 16. Some features of our Services are age-restricted and therefore unavailable to children, and we do not intentionally collect personal information from children in connection with those features.

When we intend to collect personal information from children, we take additional steps to protect children's privacy, including:

• Notify parents - that is, a parent or legal guardian - about our information practices regarding children, including the types of personal information we may collect from children, the uses to which we may put that information, and with whom we may share that information;

• In accordance with applicable law and our practices, we obtain the consent of parents or legal guardians for the collection of personal information from their children, or to send information about our Services directly to their children;

• Limit our collection of children's personal information to what is strictly necessary for them to participate in an online activity; and

• To give parents or legal guardians access, or the ability to request access, to the personal information we have collected from their children and the ability to request that the personal information be changed or deleted.

Parents who believe their child has sent us personal information and wish to have it removed can contact us at support@minded.es .

8. Information Security

We implement security measures designed to protect your data, such as HTTPS. We regularly monitor our systems for potential vulnerabilities and attacks. However, we cannot guarantee the security of the information you send us. There is no guarantee that data cannot be accessed, disclosed, altered, or destroyed due to a breach of any of our physical, technical, or managerial safeguards.

If you have any security concerns, please contact customer support at support@minded.es .

9. Our international operations and data transfers

We operate internationally and may transfer your personal information to our family of companies or to third parties in locations around the world for the purposes described in this privacy policy.

Whenever your personal information is transferred, stored, or processed by us, we will take reasonable steps to safeguard its privacy. Furthermore, when we use or disclose personal information transferred from the European Union, we use standard contractual clauses approved by the European Commission, implement other measures in accordance with European Union law to ensure appropriate safeguards, or obtain your consent.

Please note that the countries in which we operate may have privacy and data protection laws that differ from, and are potentially less protective than, the laws of your country. You accept this risk when you create a MindED account, regardless of the country in which you live. If you later wish to withdraw your consent, you can delete your MindED account as described in the section "Your rights to access and control your personal data."

10. Privacy Disclosure in Europe

If you live in the European Economic Area (EEA), the United Kingdom (UK) or Switzerland, please review these additional privacy disclosures under the European Union's General Data Protection Regulation (GDPR).

Health and other special categories of personal data

Because the information we collect is health-related data or another special category of personal data subject to the GDPR, we require your explicit consent to process it. We obtain this consent separately when you take actions that lead to us obtaining your data, such as linking your device to your account, granting access to your exercise or activity data from another service, or using the female health tracking feature. You can use your account settings and tools to withdraw your consent at any time, including by stopping the use of a feature, removing our access to a third-party service, unlinking your device, or deleting your data or your account.

Our legal basis for processing personal data

For personal data subject to the GDPR, we rely on several legal bases for processing the data, including:

• Once you have given your consent, which you can withdraw at any time using your account settings and other tools;

• When processing is necessary to perform a contract with you, such as the Terms of Service ; and

• Our legitimate business interests, such as improving, customizing and developing the Services, marketing new features or products that may be of interest to you, and promoting safety and security, as described in the How We Use Information section.

How to exercise your legal rights

Review the section Your rights to access and control your personal data to see how your account settings and tools allow you to exercise your rights under the GDPR to access and control your personal data.

In addition to the various controls we offer, in certain circumstances you can try to restrict our processing of your data, or object to our processing of your data based on our legitimate interests, including as described in the How We Use Your Information section. Under the GDPR, you have the general right to object to the use of your information for direct marketing purposes. Please refer to your notification settings to control our marketing communications with you about MindED products.

If you need further assistance regarding your rights, please contact our Data Protection Officer at You can contact us at support@minded.es , and we will consider your request in accordance with applicable laws. You also have the right to lodge a complaint with your local data protection authority.

Compliance with the Data Privacy Framework (DPF)

MindED complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), as established by the U.S. Department of Commerce. We adhere to the Principles of the EU-U.S. Data Privacy Framework (EU-U.S. DPF Principles) regarding the processing of personal data received from the European Union under the DPF program. In the event of any conflict between the terms of this privacy policy and the EU-U.S. DPF Principles, the Principles shall prevail.

If you have any questions or complaints about our handling of your personal information under the Data Privacy Framework, or about our privacy practices in general, please contact us at support@minded.es . We will respond to your inquiry promptly.

As described in this Privacy Policy, we sometimes provide personal information to third parties to perform services on our behalf. If we transfer personal information received under the Data Privacy Framework to a third party, the third party's access, use, and disclosure of the personal information must also comply with our obligations under the Data Privacy Framework, and we will remain liable under the Data Privacy Framework for any breach by the third party unless we can demonstrate that we are not responsible for the event giving rise to the harm.

MindED is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). We may be required to disclose personal information we handle under the Data Privacy Framework in response to lawful requests from public authorities, including to comply with national security or law enforcement requirements.

11. Changes to this policy

From time to time, we may change this Privacy Policy to accommodate new technologies, industry practices, regulatory requirements, or for other purposes. We will notify you if these changes are material and, where required by applicable law, obtain your consent. Notification may be by email to the last email address you provided to us, by posting the notice of such changes on our Services, or by other means, as permitted by applicable law.

By continuing to access or use the Services after such changes take effect, you agree to be bound by the revised Privacy Policy.

12. How to contact us

If you have any questions about this policy or need help exercising your right to privacy, please contact our data protection officer at support@minded.es .

You can also contact us by email at:

Sanoma Educacion SLU: Ronda de Europa, 5, 28760 Tres Cantos (Madrid), Spain

CogniFit Inc: 600 California Street, 11th Floor, San Francisco, CA 94108 USA

Effective from December 24, 2024