Privacy Policy

Last updated: May 28, 2026 · Applies to 8minds.org

1. Introduction & Scope

8Minds ("we", "our", "us") is committed to protecting your personal data. This Privacy Policy describes how we collect, use, store and protect your information when you use 8minds.org and its associated educational portal.

We comply with the EU General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 and, as an operator based in Germany, with the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and the German Telecommunications-Telemedia Data Protection Act (Telekommunikation-Telemedien-Datenschutz-Gesetz, TTDSG).

2. Data Controller

8Minds
[Company / Organisation Name]
[Street and House Number]
[Postcode] [City], Germany
Email: info@8minds.org

Data Protection contact:
No Data Protection Officer (DPO) is required under GDPR Art. 37 for this platform, as we do not process special categories of data on a large scale or engage in systematic large-scale monitoring of individuals.
For all data protection enquiries please contact: info@8minds.org

3. Personal Data We Collect

3.1 Account & Identity Data

Name (first name, last name), username, email address
Password (stored as a bcrypt hash — never in plain text)
Role (student, supervisor, parent)

3.2 Profile Data (voluntarily provided)

Date of birth, gender
Phone number, postal address, city, country
Profile photo, biography
Educational background, school name, GPA
Social media profile links

3.3 Learning & Assessment Data

Course enrolments and progress records
Quiz attempts and scores
Video submission details and competition entries

3.4 Technical & Log Data

IP address and browser/device information (login and activity logs)
Session tokens (essential — used for authentication)
Timestamps of login and page activity

3.5 Payment Data (competition entries)

Payment intent ID and transaction status (handled by Stripe)
Email address used for payment receipt
We do not store card numbers or bank details

4. Legal Basis for Processing (GDPR Art. 6)

Purpose	Legal Basis	Data Categories
Assessment and Grading	Art. 6(1)(b) - Performance of contract	quiz_attempts, scores, grades, assessment_results
Communication	Art. 6(1)(b) - Performance of contract	email, phone, preferences
Course Management	Art. 6(1)(b) - Performance of contract	course_enrollment, progress_data, completion_records
Student Registration	Art. 6(1)(b) - Performance of contract	name, email, date_of_birth, address, educational_background
System Authentication	Art. 6(1)(f) - Legitimate interest	login_logs, ip_address, session_data

5. Cookies & Session Tokens (TTDSG § 25)

We use the following cookies on this website:

Cookie name	Type	Purpose	Duration	Consent required?
`PHPSESSID`	Strictly necessary	User authentication & session security	Session (deleted on browser close)	No — technically essential
`8m_cookie_consent`	Strictly necessary	Stores your cookie preference	1 year	No — technically essential

We do not use analytics, advertising or third-party tracking cookies. Fonts are served from Bunny Fonts, an EU-based CDN that does not log IP addresses or set cookies.

6. Data Retention

Data Category	Retention Period	Legal Basis
Academic records	7 year(s)	UK Education Regulations
Assessment data	5 year(s)	UK Education Regulations
Audit logs	3 year(s)	UK GDPR - Compliance
Financial records	7 year(s)	UK Financial Regulations
Login logs	1 year(s)	UK GDPR - Legitimate Interest
Personal information	3 year(s)	UK GDPR Art. 5(1)(e)

7. Your Rights under GDPR (Arts. 15–22)

Right of access (Art. 15): Obtain a copy of your personal data.
Right to rectification (Art. 16): Correct inaccurate data.
Right to erasure / "right to be forgotten" (Art. 17): Request deletion where no lawful basis for continued processing exists.
Right to restriction of processing (Art. 18): Pause processing while a dispute is resolved.
Right to data portability (Art. 20): Receive your data in a machine-readable format.
Right to object (Art. 21): Object to processing based on legitimate interest or for direct marketing.
Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.
Automated decision-making (Art. 22): We do not make decisions based solely on automated processing that produce significant effects.

To exercise any of these rights, please visit the Data Rights portal or email info@8minds.org. We will respond within 30 days in accordance with GDPR Art. 12.

8. Data Sharing & Third Parties

We do not sell your personal data. We may share data with:

Recipient	Purpose	Safeguard
Stripe Inc.	Payment processing for competition entries	EU Standard Contractual Clauses; Stripe Privacy Policy
Bunny.net	Font delivery (Bunny Fonts)	EU-based CDN; no IP logging; Bunny Privacy Policy
Authorised staff	Educational administration and support	Staff confidentiality agreements
Public authorities	Legal obligation (e.g., law enforcement request)	Only when legally required

9. International Data Transfers

Our servers are located within the European Economic Area (EEA). If any transfer to a third country is necessary (e.g., via Stripe for payment processing), we ensure appropriate safeguards are in place pursuant to GDPR Art. 46, including Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Data Security (GDPR Art. 32)

Passwords are stored using bcrypt hashing — never in plain text.
All connections are encrypted via HTTPS/TLS.
Session cookies are set with HttpOnly, Secure and SameSite=Strict flags.
Access to personal data is restricted to authorised staff on a need-to-know basis.
Activity and security logs are maintained for anomaly detection.

11. Data Breaches (GDPR Arts. 33–34)

In the event of a personal data breach we will:

Notify the competent supervisory authority within 72 hours of becoming aware (Art. 33).
Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms (Art. 34).
Document all breaches in our internal breach register.

12. Children's Privacy (GDPR Art. 8)

Our platform is intended for use by students, some of whom may be under 16. Under GDPR Art. 8 and German law, children under 16 years of age require parental or guardian consent before we can process their data. By registering, users aged under 16 confirm that a parent or guardian has authorised the registration.

Parents or guardians who believe their child's data has been collected without their consent should contact us at info@8minds.org to request deletion.

13. Right to Lodge a Complaint (GDPR Art. 77)

You have the right to lodge a complaint with the competent data protection supervisory authority. As an operator based in Germany, our lead supervisory authority is:

The Federal Commissioner for Data Protection and Freedom of Information (BfDI)
Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Graurheindorfer Str. 153, 53117 Bonn, Germany
Website: www.bfdi.bund.de
Email: poststelle@bfdi.bund.de

Depending on your place of residence, the supervisory authority of your German federal state (Landesbehörde) may also be competent.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via the platform or by email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the platform after changes constitutes acceptance of the updated policy.

15. Contact

For any questions or concerns about this Privacy Policy or our data practices:

8Minds — Data Protection
Email: info@8minds.org
Postal: [Company Address], Germany

To exercise your data rights, please use the dedicated Data Rights portal.