Oiler Board Privacy Notice
In short. Oiler Board can be used without an Account; for the OILER Account we need your email. Your work and your images stay on your devices: those you send to a board pass through our server only encrypted, with a key we do not have, and we delete them as soon as the board receives them, after 10 minutes at the latest. We use only technical cookies and storage. You receive news and offers by email only if you ask for them.
1. Controller
The controller is Luigi Bernardi, whom you can contact at info@oiler.education. This notice covers Oiler Board (www.oiler.education/oiler-board and its pages) and the OILER Account; for the rest of the website, the general privacy notice at www.oiler.education/privacy applies.
2. What data we process, why and for how long
| Data | Why | Legal basis | How long |
|---|---|---|---|
| a. Account data: email, language, date and time of creation and of confirmation, day of last use, status of the Account, choice about news | Creating and managing the Account, sending you access codes and service emails, replying to you; counting the Accounts used in the last 7 and 30 days | Contract (art. 6(1)(b) GDPR); for the count, legitimate interest in knowing how much the Service is used (art. 6(1)(f) GDPR) | Until the Account is deleted. An Account whose code has never been used is deleted 30 days after the last code was sent |
| b. Access data: the access codes, stored only as a keyed hash (HMAC); for each browser signed in to the Account, its type (personal or shared), the hash of a random identifier, and the date and time of its first and last use | Letting you sign in on your devices | Contract (art. 6(1)(b) GDPR) | Codes: until they are replaced or the Account is deleted; the readable code exists only encrypted, until the email that carries it is sent, 24 hours at most. Browsers: until you sign out or they are replaced; personal ones 90 days after their last use at the latest, shared ones after 2 hours without use |
| c. Acceptance and consent: the text of the Terms of Use accepted and of the box, with date and time; if you give it, your consent to news, with the text of its box | Proving that you accepted the Terms of Use and, if you gave it, your consent | Legitimate interest in proving the contract (art. 6(1)(f) GDPR); for consent, the obligation to be able to demonstrate it (arts. 6(1)(c) and 7(1) GDPR) | Until the Account is deleted |
| d. Emails sent to the Account: for each one, type, recipient, dates, attempts and, if sending fails, the type of error | Delivering the emails and solving delivery problems | Contract (art. 6(1)(b) GDPR) | 90 days, or until the Account is deleted if that happens first |
| e. News: the email and the choice in point a | Sending you OILER news and offers by email (new tools, materials, initiatives and offers, including of paid plans and of other OILER products), only after you have confirmed your email with the first use of the code | Consent (art. 6(1)(a) GDPR; art. 130 Italian Privacy Code), which you can withdraw at any time | Until consent is withdrawn or the Account is deleted |
| f. Pictures sent to a board: the picture, encrypted with a key we do not have; for each picture, a delivery record (who sends it, size and times); the channel opened by the board (Account, device type, the board's public key, expiry and hashes of its address and of the codes that link the board and the phone) | Bringing the pictures to the board and letting whoever sends them know that they have arrived | Contract (art. 6(1)(b) GDPR) | Picture: deleted as soon as the board receives it, after 10 minutes at the latest. Delivery record: 10 minutes. Channel: while it is open, at the latest until 60 minutes pass without pictures |
| g. Technical and security data: IP address and user agent in the session; server logs, with the IP address, including that of the phone that sends pictures; hashes of the IP address and of the email in the counters that limit sign-ins and requests | Making the Service work and protecting it from abuse | Legitimate interest (art. 6(1)(f) GDPR) | Session: for as long as it lasts. Logs: 30 days. Counters: one day at most |
| h. Communications: what you write to us | Replying to you and handling your requests | Contract or legitimate interest (art. 6(1)(b) or (f) GDPR); for requests about your rights, legal obligation (art. 6(1)(c) GDPR) | 24 months from the last message |
| i. Only the data needed | Complying with legal obligations and requests from authorities, defending our rights, transferring the Service (Terms of Use, art. 10) | Legal obligation (art. 6(1)(c) GDPR); legitimate interest (art. 6(1)(f) GDPR) | For as long as necessary |
The email is needed for the Account: without it, we cannot send you the code. The Terms of Use box is not consent to processing; consent to news is optional and, if you do not give it, the Account works in the same way.
If someone typed your email in the form, we received it from them: until the code is used, we process it only to send you that email and to prevent abuse (legitimate interest, art. 6(1)(f) GDPR), and we delete it as in point a.
When the Account is deleted, we delete the data linked to the Account. Server logs and communications remain until the end of their periods and, if a dispute or a request from an authority is under way, so does the data needed for it. Backup copies of the database, on another server in the European Union, are kept for 6 months.
We do not receive your work or your images, except the encrypted ones in point f, and we do not ask pupils for any data.
3. Cookies and storage on the device
We use only technical cookies and storage, our own and necessary for the Service, which do not require your consent (art. 122(1) Italian Privacy Code). We use no profiling cookies and no third-party tools.
| Name | Type | What it is for | Duration |
|---|---|---|---|
| oiler_education_session | Cookie | Session and language, also on the phone that sends pictures; after you sign in, the link to the Account | 120 minutes of inactivity; after you sign in on a shared device, usually until the browser is closed |
| XSRF-TOKEN | Cookie | Protection against forged requests | Same as the session |
| oiler_board_device | Encrypted cookie | Remembering a personal device signed in to the Account | 90 days from the last use |
| oiler-board-visions | Browser local storage (IndexedDB) | The pictures you add or receive on a personal device, which stay there | Until you delete them |
| oiler-board-send:<channel> | Browser session storage (sessionStorage) | On the phone that sends pictures, the code that links it to the board | Until the tab is closed |
You can delete them in your browser settings: without the technical cookies you cannot sign in to the Account, and by clearing the storage you delete the pictures saved on that device.
4. Who receives the data
- Providers that process data on our behalf (art. 28 GDPR): the website hosting, with servers in the European Union, and Brevo (France), which sends the emails from its servers in the European Union and records their delivery.
- People we authorise, bound to confidentiality, who manage the server and support (art. 29 GDPR).
- Authorities, when the law requires it, and any successor to whom we transfer the Service.
The data stays in the European Union. If a sub-processor of one of our providers accesses it from outside the European Economic Area, the transfer is based on an adequacy decision or on standard contractual clauses (arts. 45 and 46 GDPR), a copy of which you can ask us for.
5. Minors
The Account is for people aged at least 16. For anyone younger, it is created and held by a parent or guardian, with their own email: the Account data is theirs. We do not ask pupils who use the board in class for any data.
6. Your rights
You can ask for access to your data, rectification, erasure, restriction of processing and portability (arts. 15-20 GDPR), and withdraw your consent to news at any time, without affecting processing already carried out.
Objection. You can object at any time to processing based on legitimate interest, on grounds relating to your situation, and to news without giving reasons, with the link in the emails or by writing to us (art. 21 GDPR).
Write to info@oiler.education. If the request concerns an Account, send it from the Account email: it is the only data with which we can verify that the Account is yours. Erasing the email means deleting the Account.
You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
7. Automated decisions and changes
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR): the automatic limits on sign-in attempts and code requests are temporary, and the suspension of an Account is decided by a person.
We may update this notice: the text in force is always on this page, and we tell the Accounts about important changes by email.