Effective date: April 2025 · Last updated: October 2026
At koukoutsa, we are committed to safeguarding the privacy of our users. This Privacy Policy explains how we collect, use and protect your information when you use our platform, app and website, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the applicable laws of Cyprus and Greece.
1. Who we are
- Koukoutsa is provided by N.P. Karma Consultancy Ltd, 3A Lysis Street, 4549 Palodia, Limassol, Cyprus. Contact: info@koukoutsa.com.
- As data controller: for data from our website, the contact form and the accounts of the educational institutions that are our customers.
- As data processor: for data that an educational institution enters into the platform (details of students, parents, guardians and teachers). The educational institution itself is the controller of this data. We process it only on its instructions and under a data processing agreement.
2. What data we collect
Koukoutsa does not itself collect personal data of parents, teachers or children, nor the content of communication through the platform. This data is entered and managed by the educational institution, which is responsible for it. We simply host and process it on the institution’s behalf so that the platform can work (see section 1).
We only collect:
- Website data: what you fill in on the contact form or when you book a demo (full name, institution, email, phone, message).
- Data of the customer institution: the email the institution gives us to set up its account, and the billing details for its subscription.
- Usage data: technical data such as IP addresses, device type and platform usage statistics.
3. How we use your information and legal basis
- Providing and improving the koukoutsa platform, including real-time attendance alerts (push notifications and SMS). Legal basis: performance of our contract with the educational institution and, for data entered by the institution, its instructions as controller.
- Answering enquiries, demos and customer support. Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in serving our customers.
- Security and proper functioning of the platform. Legal basis: legitimate interest.
- Invoicing and meeting accounting and tax obligations. Legal basis: compliance with a legal obligation.
- Sending updates or newsletters, only if you have given your consent. You can withdraw it at any time.
4. Data sharing and disclosure
- We do not sell or rent your data to third parties.
- Data may be shared with trusted service providers who help operate the platform, such as hosting and cloud, SMS, push notification and email providers. These providers are bound by data processing agreements and strict confidentiality obligations.
- Within the platform, each user sees only what their role allows. For example, a parent sees only their own child’s details and the content the institution shares with their class or the whole institution.
- We may disclose information if required by law or to protect our rights.
5. Transfers outside the European Economic Area
Platform data is stored on servers within the European Union. If a service provider (for example, for sending push notifications) processes data outside the European Economic Area (EEA), the transfer only takes place with the appropriate GDPR safeguards, such as a European Commission adequacy decision or Standard Contractual Clauses.
6. Retention
- Platform data is kept for as long as the educational institution’s subscription is active, or as determined by the institution itself.
- When our cooperation ends, data is returned or deleted according to the institution’s instructions, unless the law requires us to keep it.
- Contact form data is kept for as long as needed to respond to your request and for our potential cooperation.
- Accounting and tax records are kept for as long as the law requires.
7. Data security
- We apply technical and organisational security measures in line with industry standards, such as encrypted connections, role-based access and limiting our staff’s access to what is strictly necessary.
- However, no system is completely secure, and we cannot guarantee absolute protection.
- In the event of a data breach, we inform the educational institution, the competent authority and, where required, the people affected, in accordance with the GDPR.
8. Your rights
Under the GDPR, you have the right to:
- Access your data.
- Rectification of inaccurate or incomplete data.
- Erasure (“right to be forgotten”).
- Restriction of processing.
- Data portability.
- Object to processing based on legitimate interest.
- Withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, contact us at info@koukoutsa.com. We respond within one month.
For data entered by an educational institution, you can also contact the institution directly. If we receive the request, we forward it to the institution and support it in responding. Parents and guardians can request the deletion of their children’s data, subject to verification.
9. Children’s privacy
Koukoutsa is designed to protect children’s data. Children’s personal data is entered by the educational institution only for legitimate educational and organisational purposes, with the approval of parents or guardians where required.
10. Cookies and tracking
We may use cookies or similar technologies to improve the user experience and collect usage data. Cookies that are not strictly necessary are only used with your consent. You can manage your cookie preferences in your browser or device settings.
11. Right to lodge a complaint
If you believe the processing of your data breaches the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
- Cyprus: Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).
- Greece: Hellenic Data Protection Authority (www.dpa.gr).
We would appreciate it, however, if you contacted us first so we can try to resolve the matter.
12. Changes to this Privacy Policy
We may update this policy periodically. Users will be notified of significant changes, and continued use of koukoutsa constitutes acceptance of the revised policy.
13. Contact us
If you have any questions or concerns about this Privacy Policy or the protection of your data, please contact us at info@koukoutsa.com.