1. Identity and Address of the Data Controller

The processing of your personal data is the responsibility of Technology Box, Inc. (hereinafter “TBox”), with its principal place of business in Panama City.

However, to ensure your right to accessibility and compliance with local regulations, in countries where TBox has a branch, subsidiary, or permanent establishment, such local entity will act as a Joint Data Controller and primary point of contact for the exercise of your rights.

2. What Is TBox’s Role in Processing Your Data?

For transparency purposes, TBox informs you that its role varies depending on the data collected and the purpose of its processing. Accordingly, TBox may act in two different capacities:

• Data Processor (on behalf of the educational institution): For academic, behavioral, and identification data of children and adolescents, the Data Controller is the educational institution. TBox acts as a technology provider following the institution’s instructions. Consequently, for most of your child’s data, the primary Data Controller is your child’s school. They determine what academic, behavioral, and identification data is recorded in our platform for the proper functioning of digital textbooks and included tools. In this scenario, TBox acts as a technology provider, a Data Processor that securely stores and processes this information following the educational institution’s instructions.
• Data Controller (acting on our own behalf): TBox acts as a Data Controller for specific purposes over which we make decisions. We are responsible for:
  
  • Managing your user account and contact information for billing purposes, if you contract services directly from us.
  • Responding to your technical support requests or general inquiries.
  • Using images of your child or yourself for documentary or commercial purposes (e.g., brochures or social media), only if you have provided your explicit consent. 

For any inquiries, you may contact our Data Protection Officer at privacidad@tboxplanet.com.

3. What Personal Data Do We Process?

As part of our educational services, we process various categories of personal data under the principles of data minimization and security:

If you are a parent, guardian, or educator: we process information provided by you, your child, or the educational institution:

• Identification Data: full name, date of birth, gender, photographs.
• Contact Information: email address and phone number of children, adolescents, and their legal guardians.
• Academic Data: information about student performance, such as grades, attendance, behavior, and pedagogical progress on our platforms.
• Sensitive Data (with explicit consent): the educational institution may record sensitive information on the platform, such as health-related data (allergies or relevant medical conditions) or scanned identification documents. TBox acts exclusively as a Processor (custodian) of this information, applying high-level security measures under the premise that the educational institution has obtained explicit consent from the guardians.
• Billing Data: when purchasing our digital textbooks directly, we collect your name, identification document, and contact information (email or phone), as well as data needed to process your purchase and comply with electronic invoicing regulations.
• Images: photographs and videos of children and adolescents (subject to prior consent) during their participation in events and activities organized by TBox.

If you contact us through our website:

• Business Contact Data: name, email, phone number, and the name of the institution you represent, in order to respond to your inquiry.

For all users of our online services:

• Technical Data: IP address, device and web browser identifiers, activity logs to ensure cybersecurity and optimal platform performance.

4. How Do We Use Your Personal Data?

We process the personal data you provide as a parent, guardian, legal representative, or educator, as well as the data of children and adolescents under your care, for the following purposes:

A. Provision of Educational Services

• Account Operations: creation and management of user profiles on our platforms.
• Academic and Pedagogical Management: recording of grades, attendance, assignment portfolios, and progress by the educational institution’s teaching and administrative staff.
• Resource Access: provision of textbooks, digital licenses, and learning tools.
• Institutional Communication: official channel between the educational institution, legal guardians, educators, and students for relevant academic information and institutional announcements.
• Educational Activities and Events Management: registration, evaluation, and issuance of certificates, diplomas, or recognitions for workshops, institutional fairs, certifications, competitions, and educational webinars organized by TBox or in collaboration with your educational institution.
• Documentation and Institutional Records: capturing general photographs and videos at events for internal reports or communications directed to the school community. Note: This processing is carried out under the principle of the best interests of children and adolescents, ensuring exclusively educational purposes.

We process your child’s data under the guiding principle of their best interests, ensuring that their information is used only for educational purposes and the proper functioning of the platform, in accordance with international data protection standards.

B. Management of Our Business and Legal Relationship

• Customer Service: handling inquiries and information requests.
• Electronic Invoicing: payment processing and issuance of electronic tax documents in compliance with applicable tax regulations.

C. Support and Cybersecurity

• Technical Assistance: troubleshooting and user support.
• Information Security: monitoring and protecting the platform to prevent unauthorized access, cyber attacks, and ensure the integrity of children’s and adolescents’ data.

D. Secondary Purposes (Optional, with Your Consent)

• Service Improvement: analyzing usage data (anonymized or de-identified) to improve functionality and user experience on our platforms.
• Marketing and Web Analytics: through cookies and similar technologies, understanding how you interact with our website to improve your browsing experience. You may accept or reject these technologies at any time.
• Use of Images for Commercial and Advertising Purposes: occasionally, we would like to use photographs or videos featuring your child in our promotional materials, website, social media, or other campaigns to showcase our work. This use is completely voluntary.
• Your Right to Object, Refuse, and Withdraw: you may refuse or withdraw your consent at any time by sending an email to privacidad@tboxplanet.com, without this affecting the educational service.
• How Can You Object? You have control over the use of your image and that of the children under your care. You may refuse non-essential uses by checking the corresponding box on the authorization form that will be presented to you (opt-in system). If you wish to withdraw your consent in the future, you may do so by sending an email to: privacidad@tboxplanet.com. Once we receive your request, we will stop using the images of children and adolescents in future advertising materials and will proceed to delete the files from digital media controlled by TBox, in accordance with the right to erasure. 

5. What Is the Legal Basis for Processing Your Data?

We process your personal data based on:

• Performance of a contract and pre-contractual measures, to operate your user account, manage your academic information, provide access to your digital textbooks, and respond to your support inquiries.
• Compliance with a legal obligation, for billing management and compliance with applicable tax regulations.
• Our legitimate interest in documenting academic activities and events in records, reports, and institutional communications directed to the school community, as well as ensuring the security and proper functioning of our platform.
• Provision of appropriate cybersecurity measures, to ensure the security, integrity, and availability of the platform, protecting children’s and adolescents’ data against cyber threats.
• Your explicit consent, for processing sensitive data (health/identification), use of images of children and adolescents for commercial/advertising purposes, and installation of analytics and marketing cookies. TBox maintains verifiable records of all consents granted and their withdrawals through electronic systems that ensure attribution, integrity, and traceability of the act, in compliance with the principle of accountability.

These legal bases align with internationally recognized principles such as lawfulness, transparency, and data minimization, as well as the corresponding legislation and international standards and best practices required in the countries where we operate.

6. With Whom Do We Share Your Data?

For the effective provision of our educational services, we transfer relevant data to the following technology providers. These act as our Data Processors and have been selected through a due diligence process that ensures the implementation of robust security measures:

Transfer Safeguards: since most of these providers are located in jurisdictions outside some of the countries where we operate, TBox ensures that these transfers are made under Standard Contractual Clauses (SCCs) or current adequacy decisions. This ensures that children’s and adolescents’ data receive a level of protection consistent with the laws that regulate us.

Educational Platform Integration: for access to complementary educational platforms such as Jasperactive and XperienceED, operated by CCI Learning, or Certiport, we only share the minimum necessary data (name, email, and educational institution) through secure API integrations or, when applicable, manual registration. These transfers are made solely to fulfill the contracted educational program and to allow access to corresponding content, activities, or certification processes. These transfers are made solely to fulfill the associated educational purpose and under strict contractual and security measures.

Document Issuance: for activities requiring the issuance of certificates, diplomas, or credentials, we will share minimum identification data with external providers responsible for printing or distribution logistics of such documents. Additionally, these third parties are subject to strict confidentiality agreements and are prohibited from using children’s and adolescents’ information for purposes other than those agreed upon.

We do not share your personal data with third parties other than our duly authorized service providers, who act in the legal capacity of Data Processors and are bound by contracts that ensure confidentiality, technical security, and legitimate use of information exclusively for the educational and operational purposes described in this notice, maintaining levels of protection consistent with internationally recognized standards and best practices in the technology industry.

As part of our commitment to accountability, we ensure that these third parties maintain levels of protection consistent with internationally recognized standards, such as GDPR and ISO/IEC 27001, as well as cybersecurity best practices required by regulatory entities in each country where we operate.

This oversight is especially rigorous in the processing of information belonging to children and adolescents, ensuring that their data is not used for purposes unrelated to the best interests of children and adolescents.

7. Use of Cookies and Tracking Technologies

Our website and platform use “cookies,” which are small text files that ensure security, enable proper service operation, and improve your browsing experience.

• Essential Cookies: these are mandatory to enable login, account security for children and adolescents, and basic functionality. These cannot be disabled, as they are necessary to prevent fraud and attacks.
• Analytics and Marketing Cookies: these allow us to understand how our services are used (e.g., Google Analytics, Facebook Pixel). These cookies remain inactive by default and will only be activated if you give us your prior informed consent through our configuration banner. You can manage or withdraw your preferences at any time through our cookie manager.

8. How Long Do We Retain Data?

We apply strict retention criteria based on the nature of the data and applicable regulations:

• Academic Data of Children and Adolescents: will be retained as long as the educational institution (Data Controller) requires it to maintain the academic record and comply with its legal obligations to the respective education ministries.
• Billing and Transactional Data: will be retained for the mandatory legal periods required by tax regulations in the countries where we operate (generally between 5 and 10 years).
• Contact and Support Data: will be retained for the time necessary to resolve your request and up to 12 months after the last interaction, unless there is an active contractual relationship.
• Secure Deletion: once these periods have elapsed or the purpose has ended, non-essential information will be deleted or anonymized through secure erasure protocols, preventing any subsequent recovery in accordance with the standards of the governing bodies in each country where we operate.

9. Your Data Subject Rights

You have the right to:

• Access the personal data we hold about you and the children and adolescents under your care.
• Rectify data if it is inaccurate or incomplete.
• Erase data (request its deletion).
• Object to the use of your data for specific purposes.
• Request data portability to another provider.
• Request restriction of processing of your data.

To exercise these rights over data for which TBox is the Data Controller, please send a request to: privacidad@tboxplanet.com. To protect your information, we may ask you to verify your identity before processing your request, which we will respond to within the legally established timeframes.

To exercise rights over identification, contact, or academic progress data of your child, you must direct your request to your educational institution, as they are the primary Data Controller for such processing.

10. Use of Artificial Intelligence (AI)

At TBox, we implement cutting-edge technologies to enhance the educational experience of children and adolescents. The use of AI on our platforms is governed by the following commitments:

• Educational Purpose: we use generative AI exclusively to create educational content (stories, examples, exercises) or to enhance chat assistants that support children’s and adolescents’ learning.
• No Automated Decision-Making: we do not use artificial intelligence to make automated decisions that legally or significantly affect users, especially in evaluation processes that impact the academic record of children and adolescents.
• Human Oversight (Human-in-the-Loop): the use of AI is purely for educational support purposes and is always performed under technical and pedagogical supervision.
• Rights Guarantee: in the event that a future AI tool is used for a decision with significant effects, TBox will guarantee the right of parents, educators, and children and adolescents (according to their maturity) to: (a) be clearly informed about the algorithm’s logic; (b) request direct human intervention; (c) express their point of view and challenge the decision before the appropriate authorities.

11. How Will We Notify You About Security Incidents?

At TBox, protecting the integrity and confidentiality of children’s and adolescents’ information is our priority. We have a documented incident management protocol based on international cybersecurity standards:

• Notification Commitment: if a security incident occurs that poses a high risk to the rights and freedoms of users, especially children and adolescents, we will notify you promptly through the registered contact channels.
• Legal Timeframes: in accordance with the laws that regulate us, we commit to notifying the Competent Regulatory Authorities and, where applicable, the affected data subjects, within a maximum period of seventy-two (72) hours after becoming aware of the breach.
• Notification Content: the communication will include, at a minimum, the nature of the incident, the categories of affected personal data of children and adolescents, the possible consequences, and the mitigation measures immediately adopted to protect your information.

12. How Will We Notify You of Changes to This Notice?

At TBox, we are committed to maintaining transparency about how we manage your information. Due to the evolution of our technologies and regulations issued by Competent Regulatory Authorities, this notice may be updated periodically:

• Notification of Material Changes: if we make significant changes that affect the purposes of processing, legal bases, or the rights of children and adolescents, we will proactively inform you through a prominent announcement on our platform or by email sent to the registered account.
• Advance Notice Period: whenever possible, we will notify you of such changes before they take effect, allowing you to review the modifications and, if you choose, exercise your right to withdraw consent or delete your data.
• Ongoing Reference: we recommend reviewing the “Last Updated” date at the beginning of this document to ensure you are aware of the current version.

This Privacy Notice was originally drafted in Spanish. In the event of any conflict or discrepancy with a translated version, the Spanish version shall prevail.