This policy describes what data we process in FlexPayz Schools, why, how long we keep it, and what rights you have, under Regulation (EU) 2016/679 (GDPR). Data controller: [Denumire legală operator FlexPayz], [Adresă sediu social operator], contact: [Email contact/DPO FlexPayz].

We collect parent-account data (name, email, phone, delivery/billing address) to create the account, process orders and communicate about the order. Legal basis: performance of a contract.

We collect minimal child data (first name, optionally class) to associate the FlexPayz product with that child and to let the parent manage the order. We do not collect child data directly from the child — data is provided by the parent/legal representative. See also Child data protection.

The FlexPayz product (ring/bracelet) is linked, via its NFC identifier, to the child's profile and, where applicable, to the features enabled for that product (e.g. access events). This link is used solely to operate the service.

The parent account is associated with the partner school through which the order was placed. Certain data (e.g. confirmation of product receipt/sizing) may be shared with designated school staff, strictly to complete the order.

If your school enables an access feature (e.g. entry/exit), access-type events associated with the product may be logged. This feature depends on each school's own configuration and is not enabled by default for every user.

We keep order/payment status (e.g. paid, processing) to manage the order and for accounting/tax obligations. Full card details are never stored by us — payment is processed by Stripe, a PCI-DSS certified payment processor.

If you enable FlexPayz School+, we process the data required for the subscription (subscription status, recurring billing via Stripe). It is never pre-selected — enabling it is an explicit choice by the parent.

If, in the future, a FlexPayz School+ feature were to allow recording the child's medical/health information, that data constitutes a special category of personal data under GDPR Article 9 and requires a distinct legal basis (typically the parent's/legal representative's explicit consent). This feature is not active in the FlexPayz Schools platform as of the publication of this policy, and this text does not constitute or imply a legal basis for such processing. Any future activation will be accompanied by a distinct, explicit consent mechanism and a corresponding update to this policy.

We use third-party vendors to operate the service: Stripe (payment processing), SmartBill (invoicing), and courier providers for delivery (e.g. FAN Courier/Europarcel, as applicable). Each vendor processes data strictly per our instructions and its own privacy policy.

Order/invoicing data: [Perioadă de păstrare a documentelor financiar-contabile, conform legislației fiscale aplicabile]. Parent account data: [Perioadă de păstrare a datelor de cont după închiderea contului, dacă este cazul], or until deletion is requested, except for data we are legally required to keep for longer.

You have the right to access, rectify, erase, restrict, port and object, as well as the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP). To exercise your rights, write to [Email contact/DPO FlexPayz].

Child data is provided exclusively by the parent/legal representative, never directly by the child. The parent may request access, rectification or erasure of the child's data at any time, via the parent account or at [Email contact/DPO FlexPayz]. We do not use child data for marketing purposes.