Teelsy

Privacy Policy & GDPR Notice

Last updated: June 26, 2026

Bajtech SRL ("we", "our", or "us") operates the Teelsy mobile application and web platform (the "Service"). This document informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service, and of your rights under the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

1. Data Controller and Data Processor

Under the GDPR, the school or educational institution that deploys Teelsy is the data controller — it determines the purposes and means of processing the personal data of its students, parents, and staff.

Bajtech SRL acts as a data processor — we process personal data solely on documented instructions from the data controller and do not use it for any independent purpose.

Contact for data protection enquiries: office@teelsy.school · Bajtech SRL, Romania

2. Data We Collect

We collect the following categories of personal data:

Account Data: Name, email address, and role (admin, teacher, or parent) provided during account creation.
Educational Data: Student names, dates of birth, class assignments, and attendance records as part of the school management functionality.
Communication Data: Messages, announcements, and reactions shared within the app's chat and announcement features.
Media & Attachments: Profile photos, images, and documents (PDF, DOCX, etc.) uploaded by users.
Consent Records: Timestamps of when users accepted the Terms of Service and this Privacy Policy.
Technical Data: Session tokens and device push notification tokens, used solely for authentication and delivery of notifications.

3. Legal Basis for Processing

We process personal data under the following legal bases (GDPR Art. 6):

Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service to the school and its users.
Consent (Art. 6(1)(a)): Where users have explicitly consented, such as acceptance of these terms at registration.
Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, and platform stability, where these interests are not overridden by your rights.
Legal obligation (Art. 6(1)(c)): Where processing is required to comply with applicable law.

4. How We Use Your Data

Personal data is used exclusively for the following purposes:

To provide and maintain the Service.
To facilitate communication between schools, teachers, and parents.
To send notifications about school announcements and changes to the Service.
To provide customer support.
To maintain security and prevent misuse.

5. Third-Party Sub-Processors

We engage the following sub-processors to deliver the Service. Each is bound by data processing agreements and provides adequate safeguards:

Amazon Web Services (AWS S3): Secure storage of media files and attachments. Data may be stored in EU regions.
OpenAI: Processing of communication content for AI-assisted features. Data is processed under OpenAI's data processing terms.
Email service providers: Delivery of transactional emails (invitations, password resets).
Firebase Cloud Messaging (Google): Delivery of push notifications to mobile devices.

Some of these providers may transfer data outside the European Economic Area (EEA). Where this occurs, transfers are subject to appropriate safeguards such as Standard Contractual Clauses (SCCs) under GDPR Art. 46.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by the data controller's instructions. When an account is deleted or a school terminates its subscription, personal data is removed from our systems within 90 days, unless longer retention is required by law.

7. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data (GDPR Arts. 15–22). To exercise any of these rights, contact us at office@teelsy.school:

Right of access (Art. 15): Obtain a copy of the personal data we hold about you.
Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
Right to restriction of processing (Art. 18): Request that we limit how we use your data in certain circumstances.
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
Right to object (Art. 21): Object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We will respond to requests within 30 days. Note that some rights are exercised through the data controller (your school) rather than directly through us.

8. Right to Lodge a Complaint

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — www.dataprotection.ro. You may also contact the supervisory authority in your country of residence.

9. Children's Data

Teelsy is used in school environments and processes data related to minors (students). This data is processed solely on the instructions of the school (data controller) and, where required, with appropriate parental consent obtained by the school. Bajtech SRL does not use student data for any purpose beyond providing the Service.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the platform or by email. The date at the top of this page reflects when the policy was last updated. Continued use of the Service after changes take effect constitutes acceptance.

11. Contact

For any questions about this Privacy Policy or to exercise your data rights, contact us at office@teelsy.school.

Bajtech SRL · Romania