Privacy Notice

This Privacy Notice describes how personal data is collected, processed and disclosed.

People registered at VIVISTOP under VIVITA Membership Terms, also called VIVINAUTs, are children, so the processing of personal data is subject to increased attention and care.

The controller(s) of personal data are company(ies) operating VIVISTOP in a specific country/region (hereinafter “Controller” or “VIVITA”). The list of Controllers is available HERE.

1. Why the personal data is processed

The Controller collects personal data from parents or legal guardians (“Guardian”) who register a child as a VIVINAUT. The Controller will not collect personal data from children, except as set out in this Notice.

Each VIVINAUT will receive an ID number (hereinafter “VIVINAUT ID”) that allows VIVITA to identify the VIVINAUT when using applications and online services, such as the cloud service VIVIWARE. The VIVINAUT ID is only used for providing applications, for example, cloud computing or digital entrance keys used at VIVISTOP.

2. Personal data categories

Children:

• name, gender, date of birth, phone number, address, email address;
• information about Guardians;
• school name and grade;
• information about other experiences similar to those provided by VIVISTOP that foster creativity;
• usage of VIVITA’s applications and services; and
• photos and videos.

Guardians:

• name, phone number, address, email address.

Personal data may also be collected and held in any other circumstances noted in this Notice or as permitted by applicable privacy laws. 

3. How personal data is collected

The Controller collects personal data from Guardians:

• during the membership registration process;
• during the sign-up process to participate in onsite or online events organized by VIVITA;
• when filling in questionnaires made available by VIVITA; or
• when they otherwise interact with VIVITA or use VIVITA’s applications or services.

The Controller collects personal data about children:

• in the course of activities conducted in a creative learning environment, including taking photos and videos of the children (with the Guardian’s consent);

while children are using VIVISTOP’s applications and services.

4. The purpose(s) for which personal data is processed

The Controller uses personal data for the following purposes:

• administration of membership
• to conduct its business, which includes providing activities for children;
• to review, analyse and improve its own processes, including by conducting surveys to improve services;
• educational research and co-working with research institutions (universities, government agencies, private sector, etc.);
• advertising and marketing; sending notices by email to promote events and activities (where VIVITA have the Guardian’s consent to send such emails);
• to communicate with Guardians and VIVINAUTs, including responding to any message or inquiry; and
• providing applications and services, including the VIVINAUT ID.

The Controller may use personal data for other purposes as permitted by applicable privacy laws or with a Guardian’s written consent.

5. Legal basis

The Controller processes personal data to establish contractual relations with VIVINAUTs and participants of events and activities.

The Controller will seek consent from Guardians to take children’s photos and videos and share them on social media. The consent is sought during the sign-up process and can be reviewed by Guardians at any time by requesting a change of the preferences at VIVISTOP.

Pursuant to applicable laws, children over a certain age of legal capacity may determine themselves whether to consent to have photos and videos taken of them and shared on social media.

6. Access and transfer of personal data

VIVITA may disclose personal data to a VIVINAUT’s Guardian where required pursuant to VIVITA Membership Terms or this Notice, or where it is requested by the VIVINAUT’s Guardian.

Personal data collected by the Controller (including the VIVINAUT Agreements) are stored locally at VIVITA’s premises or, in the case of digital data, at the information system selected by the Controller.

VIVITA uses a centralized data management system in order to facilitate VIVINAUT’s data globally, including contact details (hereinafter “VIVITA Address Book”). The VIVITA Address Book, including personal data provided by Guardians in the VIVINAUT Agreement, is hosted at Amazon Web Services.  Access to the VIVITA Address Book is allowed for Controller’s employees if the data is required for the performance of their duties.

To facilitate the global expansion and collaboration of activities of VIVINAUTs, the Controller may provide access to the VIVITA Address Book to other Controllers, specified HERE, in order to verify membership status, for example, if a child enters a VIVISTOP outside of the county where that child was initially registered as a VIVINAUT.

VIVITA may transfer data to third party providers, to perform services on its behalf (for example technology providers, business service providers or email distribution providers). Such third parties may be located overseas, however the Controller does not permit the relevant third parties to use the data for its own purposes.

The Guardian consents to VIVITA disclosing personal data to third parties as set out in this Notice, even though those third parties may not be required to protect the data in a way that, overall, provides comparable safeguards to privacy laws of the country the VIVINAUT is located.

Except as set out in this Notice, the Controller shall not give third parties access to personal data unless the processing of personal data is necessary to fulfill the obligations of the Controller.

The VIVINAUT ID is pseudonymized data and does not include any identifiable data (such as name or phone number). The VIVINAUT ID is used in the information system infrastructure that is developed and maintained by VIVITA. VIVINAUTs are not identifiable unless VIVITA decides to link the VIVINAUT ID with the identification data. For example, there may be a technical issue that can be solved only by asking for additional information regarding a child.

The Controller may involve partners such as universities, governmental authorities, and other enterprises that jointly conduct activities with the Controller. In such case, personal data necessary to facilitate processing shall be provided if the third party guarantees and ensures that the required level of protection of personal data is met. The Controller will inform the Guardians regarding such collaboration and request additional consent, if needed.

The Controller processes personal data to establish contractual relations with VIVINAUTs and participants of events and activities.

The Controller will seek consent from Guardians to take children’s photos and videos and share them on social media. The consent is sought during the sign-up process and can be reviewed by Guardians at any time by requesting a change of the preferences at VIVISTOP.

Pursuant to applicable laws, children over a certain age of legal capacity may determine themselves whether to consent to have photos and videos taken of them and shared on social media.

7. Security of personal data

The Controller will take appropriate technical and organizational measures to ensure the security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage.

In the event of a personal data breach that has caused or is likely to cause serious harm, the Controller shall notify them and the relevant authorities of such breach, as required by applicable privacy laws.

The use of third-party applications is subject to the third party’s privacy and security policy governing the processing of personal data.

8. Rights of the data subjects

Guardians have the right to request access to personal data, request correction to data, or object to the processing of personal data. The request can be made at any VIVISTOP or by sending an email to the Controller specified HERE.

Guardians may request the deletion of personal data. The Controller shall inform Guardians of the terms and time limit for the deletion of personal data. The Controller may retain personal data if there is any legal ground for storing it.

Guardians have the right to receive personal data, which they have provided to the Controller in a machine-readable format.

Guardians have the right to withdraw consent to use photos and videos at any time.

Guardians have a right to lodge a complaint to the relevant data protection authority in accordance with the laws and regulations that govern the country and area in which the data subject resides.

9. Retention of personal data

Except as set out in this Notice, personal data gathered shall be retained until a child’s VIVINAUT status is terminated. When the VIVINAUT status expires, the VIVINAUT ID and relevant data (such as log files and metadata) stored in the information system cannot be deleted due to the complexity of such systems. However, personal data collected in physical form (for example, on paper), shall be deleted or destroyed. Also, the VIVINAUT Agreement and any similar data will be deleted permanently. As a result, the VIVINAUT ID will be turned from pseudonymized data into anonymized data.

In the event of a dispute, personal data shall be retained until an agreement is reached or until the time limit for the submission of claims has expired.

10. Direct marketing

Emails and phone numbers will not be disclosed to third parties to use for direct marketing. The Controller may send notifications by email or phone relating to its own services, including to provide notice of VIVISTOP schedule changes and future activities.

11. VIVIBOOM educational tool-specific Privacy Notice

This section describes how personal data is processed while using VIVIBOOM, the educational portal at boom.vivita.co.

VIVIBOOM is a membership based educational online portal managed by VIVITA, which means that no third person can access or see the portal or any data related to its users.

The content of VIVIBOOM is not accessible for non-members or, search engines, tracking, marketing and analytics tools etc. VIVITA will not share the data collected through VIVIBOOM with any third parties. For VIVIBOOM portal optimization and better user experience we use Google Analytics tool with anonymized IP addresses. This means that we analyze the activities on VIVIBOOM portal without specific visitor identification. 

Only VIVITA employees, contractors and staff can access and use VIVIBOOM services.  

In order to use VIVIBOOM, the child has to be a member of VIVITA and the Guardian needs to consent to the sign-up of the account of VIVIBOOM. Consent can be given when the Guardian signs the membership agreement or by face-to-face communication or through e-mail.

If VIVITA requires further data or additional consents relating to personal data processing, this will be communicated through e-mail to the relevant Guardian.

VIVIBOOM portal only requires a VIVINAUT’s full name as personal data. Other data may be provided on a voluntary basis, such as an email address, phone number or photgraphs.

VIVITA may collect the following data through the VIVIBOOM portal: VIVINAUT’s full name (other VIVINAUTs can only see the first name and first letter of family name), account photo and background photo if uploaded, completed projects, on-going projects, earned badges, “Likes” to the projects received from other VIVINAUTs and chats between VIVINAUTS.

The full name of the VIVINAUT is needed for VIVIBOOM in order to minimize the risk of cyberbullying. For this reason, the first name and first letter of the family name is also presented in the chat. Please note that only the counterpart of the chat can see the chat content, it is not made public on the VIVIBOOM portal.

Uploaded photos are not indexed, which means that photos on VIVIBOOM portal are not found by search engines like Google.

VIVITA uses cookies on the VIVIBOOM portal in order to technically provide the website functionalities and to analyse the portal’s user experience. Cookies, related information, and your choices in relation to cookies are presented in VIVITA’s cookie banner. 

Due to the technical structure of VIVIBOOM, the data is stored in cloud-based services of Amazon (AWS) located in Singapore. This data is stored on our behalf, and VIVITA does not permit Amazon to use the data for its own purposes.

If you wish to delete your child’s VIVIBOOM account, please contact us via your responsible VIVISTOP. Please bear in mind that deleting the account will not delete the projects and photos from the portal. The VIVINAUT’s personal data relating to the project will be deleted and no further indication of this VIVINAUT will be stored and presented.

The Guardian has the rights set out in section 8 of this Privacy Notice in relation to the data collected through VIVIBOOM.

If you have any questions, requests, or complaints regarding the processing of personal data, please contact the Controller specified HERE.