This Privacy Policy explains how the European Centre for AI in Schools Foundation processes personal data when you use the website ecais.eu and contact us. It applies to the website only. Certification, training and events have their own privacy notices, given when you sign up.
1. Who we are
The controller of your personal data is the European Centre for AI in Schools Foundation (ECAIS), a foundation registered in Warsaw, Poland.
For anything about your personal data, contact us using the details on our Contact page and mark your message “Personal data”.
2. What data we collect
We collect only what you give us and the minimum needed to run the website.
Contact and partner forms: name, email address, organisation, role, country and your message.
Newsletter sign-up: email address, name (optional) and a record of your consent.
Emails you send us: whatever you include in your message.
Your visit to the website: IP address, browser and device type, pages visited, referring site, date and time.
You do not have to give us personal data. Without contact details, though, we cannot reply to you.
Please do not send us special category data (for example health information) or data about children through the forms.
3. Why we use your data and on what legal basis
Each use of your data rests on one of the legal bases in Article 6(1) of the GDPR.
Replying to your enquiry or partner application: our legitimate interest in answering people who contact us (Art. 6(1)(f)), or taking steps at your request before entering into an agreement (Art. 6(1)(b)).
Sending our newsletter: your consent (Art. 6(1)(a)), which you can withdraw at any time.
Running, securing and improving the website: our legitimate interest in a safe, working website (Art. 6(1)(f)).
Website analytics using cookies: your consent (Art. 6(1)(a)).
Keeping records required by law, for example accounting: legal obligation (Art. 6(1)(c)).
Establishing, pursuing or defending legal claims: our legitimate interest (Art. 6(1)(f)).
Where we rely on legitimate interest, you can object at any time (see section 7).
4. Cookies
Cookies are small files a website stores on your device. Under Polish electronic communications law, we may only store or read non-essential cookies with your consent.
Essential cookies keep the website working and secure. They do not need consent.
Analytics cookies show us how the website is used. We set them only if you accept them in the cookie banner.
We do not use advertising cookies.
You can change your choice at any time through the cookie settings on this website, or by deleting cookies in your browser settings.
5. Who receives your data
We do not sell your personal data. We share it only with service providers who process it on our behalf under a data processing agreement, and only as far as they need it:
Framer B.V. (Netherlands): website hosting and form submissions.
Our email provider: email.
Our newsletter provider: newsletter sending, if you subscribe.
Our analytics provider: website analytics, if you consent.
Accounting and legal advisers: professional services, where needed.
We may also disclose data to public authorities where the law requires it.
Some providers, or their own subcontractors, may process data outside the European Economic Area, including in the United States. Where they do, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of these safeguards.
6. How long we keep it
Enquiries and correspondence: 2 years after our last contact, unless it leads to an agreement.
Partner applications that lead to an agreement: for the length of the agreement, then until legal claims expire under Polish law.
Newsletter data: until you unsubscribe or withdraw consent.
Analytics data: 14 months.
Server and security logs: 30 days.
Accounting records: as long as Polish accounting and tax law requires.
After these periods we delete or anonymise the data.
7. Your rights
Under the GDPR you have the right to:
access your data and get a copy of it
have inaccurate data corrected
have your data deleted
restrict how we use it
receive it in a portable format, where processing is based on consent or a contract
object to processing based on our legitimate interest, and to direct marketing at any time
withdraw consent at any time, without affecting processing that took place before
To use any of these rights, contact us using the details on our Contact page. We will reply within one month, which can be extended by two months for complex requests. We may ask you to confirm your identity first.
You also have the right to complain to the Polish supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. If you live in another EU country, you can also complain to the authority there.
8. Other information
Children
The website is intended for adults, such as school leaders, teachers and partners. We do not knowingly collect data from children under 16 through it.
Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls and contracts with our providers.
Other websites
Our website links to other sites. Their own privacy policies apply, and we are not responsible for them.
Changes
We may update this policy. The current version is always on this page, with the date it was last updated.
Last updated: 21 October 2026