Privacy Policy for Creaza AS

Creaza, August 2025

Who are we?
Creaza AS
Org. no.: 991 840 354
Email: post@creaza.com
Phone: +47 77 88 00
Controller: CEO – Carl Morten Knudsen

When are we the data controller?
We are the data controller when you:

• submit support requests via the form on our website

• register for courses, events, or competitions

Information we collect:

• Name

• Email

• School/workplace (if relevant)

• Other information you provide in the form

How long do we store the data?

• Support requests: 2 years

• Courses, events, and competitions: Until the event has ended, or maximum 1 year

When are we a data processor?
We act as a data processor when schools, municipalities, or other organizations use Creaza as part of their teaching and learning activities. In these cases, the school or municipality is the data controller, and we process personal data only on their behalf and according to their instructions.

The information processed may include:

• Name and contact details

• School affiliation

• User-generated content (such as text, images, audio, and video created within Creaza)

We do not access or use this information for our own purposes. Access is only granted when necessary to provide support, resolve errors, or restore user content, and only with consent from the school/municipality or the individual user.

Information we collect during use
We collect technical data to improve and secure the service:

• IP address (to detect and track attempts of unauthorized access)

• Login timestamps (the two most recent login times are stored)

• Cookies to save settings and keep you logged in

We also collect the following anonymous data to improve the service:

• Device type and operating system

• Browser

• Which parts of the service are used

Use of subcontractors
We use subcontractors (sub-processors) to provide our services. These only process personal data under agreement with us and are subject to the same strict requirements for security and confidentiality.

We use:

• Amazon Web Services (Ireland): Cloud services and data storage

• Hetzner (Germany): Cloud services and data storage for Mindomo

• Expert Software Application SRL (Romania): Operation and development of the Mindomo tool

All subcontractors are located within the EU/EEA.

Security
We have implemented comprehensive technical and organizational measures to protect your data, including:

• Encrypted transfer and storage

• Role-based access control

• Security testing and risk assessments

• Documented internal procedures and training

Deletion

• Data from logged-in users is deleted no later than 90 days after the agreement with the school ends.

• Data from forms on the website is automatically deleted after the retention period stated under section 2.

• See also the section on "Your rights."

Your rights
You have the right to:

• access the information we hold about you.

• have incorrect information corrected.

• have all information about you deleted.

Changes to the privacy policy
We update this privacy policy as needed. Changes will be announced at www.creaza.com.