Privacy in the STEP work-placement programme

3XA ECOM LLC ("Valfiguer"), EIN 38-4404525, 407 Lincoln Rd STE 708, Miami Beach, FL 33139, USA.

Privacy contact: privacy@edurails.com. We have not appointed a representative in the European Union (Art. 27 GDPR): for any privacy matter, write to us directly at privacy@edurails.com.

Your school shared it. Your school is the controller of your data as a student and organises your work placement with you. Your school also informs you about this.

Full name, email, school, programme (DAM or DAW), year, placement hours, period and start and end dates and, if your school provides them, the name and email of your school tutor. When you sign in to EduRails, also: your account, your enrolment, your progress and your certificates.

Your ID number, your age, your phone and health data are not requested. EduRails is only for people aged 18 or over: your school confirms it and you declare it when you sign in.

Organising your placement (your seat, your period and your EduRails invitation): Valfiguer's legitimate interest in managing the placements agreed with your school (Article 6(1)(f) GDPR).

Your EduRails account, your training and your certificates: the terms of use you accept when you sign in (Article 6(1)(b)).

Letting your Valfiguer tutors follow your progress and informing your school about it for its assessment: legitimate interest (Article 6(1)(f)).

Emailing you about your placement: the basis of each purpose above. Handling your rights and the security of the service: legal obligation (Article 6(1)(c)).

Valfiguer's legitimate interest is being able to host and train you. It does not use your data for advertising, does not sell it and does not use it to train artificial intelligence models. No automated decisions are made about you.

Your Valfiguer placement tutors, who see a summary of your progress in their management tool (Projekt Republic, Valfiguer's own): courses, progress percentage and certificates with their verification link; never your answers, your notes, your attempts or your conversations with the AI tutor.

Your school, which only sees its own students. The providers Valfiguer uses to run the service: Hetzner (servers in Germany) and Resend (email delivery). If you choose to sign in with Google or GitHub, that provider too. If you share a certificate, anyone with its code will see your name, the course, the date and the issuer.

Your data is stored on servers in the EU (Germany), but Valfiguer and Resend are in the USA and access it from there. For Valfiguer, the safeguard is the European Commission's standard contractual clauses (Decision (EU) 2021/914, module one) signed with your school; for Resend, those in its processing agreement. You can request a copy by writing to privacy@edurails.com.

For the length of your placement and 12 months after your period ends. After that, your assignment is anonymised (only statistics without your name or email remain), your summary in your tutors' tool is deleted and your access to the STEP organization ends; your EduRails account is erased unless you ask to keep it.

Your certificates remain verifiable so you can prove them; if you erase your account, only with your initials.

You can request access, rectification, erasure, restriction of processing and, for what is based on the terms of use, portability of your data. Write to privacy@edurails.com from the email your school registered; you will get an answer within one month at most. You can download a copy of your EduRails data from your profile.

If something in your assignment is wrong (name, dates, hours), tell your school too, since it sent it.

You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest, including the follow-up of your progress. Valfiguer will stop unless it demonstrates compelling legitimate grounds or needs the data for legal claims. Without this data Valfiguer cannot host your placement: in that case, talk to your school.

To the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your EU country of residence.