Privacy policy

1. Who we are

GIVEITAWAY publishes HAWA, a teacher attendance and school management platform working with biometric terminals, and runs this website (https://giveitaway.club).

• Legal entity: GIVEITAWAY
• Registered address: [to be completed]
• Registration number: [to be completed]
• Privacy contact: infos@giveitaway.club
• Phone: +1 (613) 617-3459

This policy applies to every visitor, prospect, customer and user worldwide. Where a local law gives you stronger rights, those rights apply.

2. Our two roles

As data controller

We decide how and why personal data is used for this website, the shop, estimates and orders, customer accounts, the learning centre, support, notifications we send you and our own business administration.

As data processor for schools

When a school, university or other institution (the "Customer") uses the HAWA platform, it decides which teachers, staff and students are registered and what is done with their data. The Customer is the data controller and GIVEITAWAY processes that data only on its documented instructions, under the data processing terms in section 11 and in our Terms of use. Teachers, staff and students should address their requests first to their institution; we help the institution answer them.

3. Data we collect on this website

Browsing

• Technical data: IP address, browser, device type, pages visited, date and time, referring page. Used for security, abuse prevention and troubleshooting.
• Cookies and similar technologies: see section 12 and the Cookie settings page.

Demo requests and contact

• Name, work email, phone number, school or university, role, number of teachers, country and your message.

Estimate requests, orders and delivery

• Contact details, organisation, delivery address, products and quantities, estimates, purchase order numbers, messages exchanged, shipping and tracking information, invoices and payment records.
• We do not store payment card numbers on this website. Payments are made by the methods stated in the estimate (for example bank transfer); any card payment is handled by the payment provider.

Customer account

• Name, email, phone and WhatsApp number, organisation, country, city, address, preferred language.
• Password, stored only as a salted hash that we cannot read.
• Two-step verification: codes sent by email (stored as hashes for 10 minutes) or an authenticator app secret (stored encrypted).
• Security data: sign-in dates, failed attempts, temporary lockouts, confirmation and reset links.
• Notification preferences (email, WhatsApp, SMS).

Communications

• Emails, WhatsApp and SMS messages we send you, delivery status and provider identifiers, and the messages you write to us about an order.

Learning centre and guides

• Whether you are signed in and allowed to watch full videos. Videos are hosted on YouTube; YouTube receives data about you only when you choose to play a video or accept external media.

Consent records

• Your cookie choice, its date, the policy version and a one-way hash of your IP address, kept as proof of consent.

4. Data processed in the HAWA platform (on behalf of schools)

Depending on how the Customer configures HAWA, the platform may process:

• Identification: name, staff or student number, photo, subjects, classes, levels, buildings and rooms.
• Biometric data: fingerprint, face, iris or palm vein templates used by the terminals to recognise a person, and the identifiers of NFC or RFID cards and PIN codes.
• Attendance: check-in and check-out events, terminal used, lateness, grace periods applied, manual corrections and reversals with the name of the person who made them.
• Teaching: timetables, sessions, course volumes, session coverage, catch-up sessions.
• Pay and HR: hourly rates per course, level and semester, hours taught, payslips, recruitment history (who recruited whom and when).
• Students: names, classes and contact details used to send schedule notifications.
• Administrators: accounts, roles and an activity log.

Biometric data

Biometric data is a special category of data under the GDPR and many other laws. We require every Customer to:

• have a valid legal basis, which in many countries means the explicit, free consent of each person or a specific legal authorisation;
• inform each person clearly before enrolment;
• offer an alternative (card or PIN code) to anyone who does not want to use biometrics, without penalty;
• delete a person's biometric data when they leave or withdraw consent.

Where the terminal supports it, templates (mathematical representations) are used instead of images, stored encrypted, and are not usable to rebuild a fingerprint or face. Biometric data is never used for any purpose other than identifying the person at the terminal, never sold and never used to train models.

5. Why we use personal data and on what legal basis

• Answering demo requests, preparing estimates and quotes: steps taken at your request before a contract (GDPR art. 6(1)(b)).
• Processing orders, production, delivery, invoicing, warranty and support: performance of the contract (6(1)(b)) and legal obligations such as accounting and tax (6(1)(c)).
• Running the customer space, account security, two-step verification, fraud and abuse prevention: our legitimate interest in keeping accounts and the service secure (6(1)(f)).
• Order notifications by email: performance of the contract; by WhatsApp or SMS: your consent (6(1)(a)), which you can withdraw at any time.
• Learning centre access: performance of the contract with customers.
• External media and audience measurement: your consent (6(1)(a)).
• Improving our products from aggregated, non-identifying statistics: legitimate interest.
• Handling legal claims and requests from authorities: legal obligation or legitimate interest.
• Processing for schools in the platform: on the Customer's instructions (art. 28).

We do not sell personal data and we do not use it for third-party advertising.

6. Automated decisions

HAWA calculates session coverage, hours taught and pay from attendance data and the rates set by the Customer. These calculations help the institution; they are not decisions producing legal effects on their own. Every institution remains responsible for reviewing payroll and must allow any teacher to contest a result and obtain a human review.

7. Children

This website and the customer space are intended for professionals and are not directed at children. We do not knowingly create accounts for anyone under 16. Student data processed in the platform is handled only on the instructions of the school, which is responsible for obtaining any parental consent required by law.

8. Who receives personal data

• Our team, on a need-to-know basis, bound by confidentiality.
• Hosting and infrastructure: [to be completed].
• Email delivery (SMTP provider chosen by us).
• WhatsApp Business (Meta) or Twilio for WhatsApp and SMS messages, only if you opted in.
• Translation services, used for website texts only, never for your personal data.
• Audience measurement provider, only after your consent.
• Google (Google Fonts, YouTube), only after your consent or when you choose to play a video.
• Banks and payment providers for payments and refunds.
• Carriers and customs brokers for delivery.
• Terminal manufacturers and repair centres for warranty repairs; devices are reset before shipping when possible.
• Accountants, auditors, lawyers and insurers, under confidentiality.
• Public authorities or courts, only when the law requires it.
• A buyer or successor, in case of merger, acquisition or sale of assets, with the same protections.

Every service provider acting for us is bound by a contract that limits its use of the data to our instructions and requires appropriate security.

9. International transfers

Our providers may be located in other countries. When personal data leaves your country, we rely on adequacy decisions where they exist, or on standard contractual clauses approved by the European Commission or an equivalent authority, and on additional measures where needed. You can ask us for a copy of the safeguards used.

10. How long we keep data

• Demo requests without follow-up: 24 months after the last exchange.
• Estimates not accepted: 36 months, then deleted.
• Orders, invoices and accounting records: the period required by accounting and tax law (often 6 to 10 years).
• Customer account: until you delete it, or 36 months after the last sign-in, after a reminder.
• Two-step verification codes: 10 minutes; reset and confirmation links: 1 to 48 hours.
• Notification delivery logs: 180 days.
• Consent records: 36 months.
• Technical security logs: up to 12 months.
• Platform data: as instructed by the Customer, and deleted or returned at the end of the contract (section 11).

Our team may shorten these periods in the site settings. Data needed for a legal claim is kept until the claim is settled.

11. Processing on behalf of schools (summary of our processor commitments)

When we process data for a Customer we:

• act only on the Customer's documented instructions;
• ensure that our staff are bound by confidentiality;
• apply the security measures in section 13;
• use sub-processors only under a written contract with equivalent obligations, and inform the Customer of changes so it can object;
• help the Customer answer requests from teachers, staff and students, and with impact assessments;
• notify the Customer without undue delay, and where possible within 72 hours, of any personal data breach affecting its data;
• delete or return the data at the end of the contract, unless the law requires us to keep it;
• make available the information needed to demonstrate compliance and allow reasonable audits.

12. Cookies

Necessary cookies keep you signed in, protect forms, remember your language and your cookie choice. With your consent we also load external media (Google Fonts, YouTube) and, if configured, audience measurement. You can accept, refuse or change your choice at any time on the Cookie settings page. Refusing optional cookies does not prevent you from using the site.

13. Security

• Encrypted connections (HTTPS) and strict security headers.
• Passwords stored as salted hashes; secrets and authenticator keys encrypted.
• Two-step verification for customer accounts, lockout after repeated failed attempts, limited-life links.
• Access to data restricted by role, with an activity log for administrators.
• Protection against automated abuse, regular updates and backups.

No system is completely secure. If a breach is likely to put your rights at risk, we will inform you and the competent authority as the law requires.

14. Your rights

Depending on the law that applies to you, you have the right to:

• access your data and receive a copy;
• correct inaccurate or incomplete data;
• delete your data (right to erasure);
• restrict or object to its use, including for direct marketing;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting earlier processing;
• not be subject to a decision based solely on automated processing, and obtain human review;
• give instructions about your data after your death, where the law allows.

Signed-in customers can download their data and delete their account from the "My data" page of the customer space. For any other request, write to infos@giveitaway.club. We may ask you to prove your identity. We answer within one month, which may be extended by two months for complex requests; we will tell you if so. You can lodge a complaint with your data protection authority, for example the authority of the country where you live or work.

15. Additional information for specific regions

• European Union, European Economic Area, United Kingdom and Switzerland: this policy is written to meet the GDPR, UK GDPR and Swiss law.
• United States (including California): we do not sell or share personal information for cross-context behavioural advertising. You may request access, correction and deletion, and you will not be discriminated against for exercising your rights.
• Canada: we follow PIPEDA and, for Quebec, Law 25.
• Brazil: rights under the LGPD apply.
• Other countries with data protection laws (for example Nigeria, Kenya, Senegal, Côte d'Ivoire, Cameroon, Morocco, India or China): we apply this policy and the specific rights granted by those laws, including any local registration or transfer requirements.

16. Marketing

We send commercial information only to people who agreed to it, or to existing customers about similar products, with an unsubscribe link in every message. We do not send marketing by WhatsApp or SMS without your prior consent.

17. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If the changes are significant, we will inform customers by email or in the customer space before they take effect.

18. Contact

Questions or requests about personal data: infos@giveitaway.club. Postal address: [to be completed]. Phone: +1 (613) 617-3459.