Privacy Policy

Effective date: 22 August 2025
Last updated: 22 August 2025

1. Who we are and how to contact us

Controller: World Schools, Route de la Bernadaz 5A, 1094 Paudex, Switzerland.
Email: info@world-schools.com.

2. What this policy covers

This policy explains how we collect and use personal data when you visit our website, create an account, submit enquiries to schools, or post reviews.

3. Data we collect

  • Account & profile: name, email, country, telephone; saved schools and preferences.
  • Enquiries: parent/guardian first and last name, email, country, telephone, message content, school selected, timestamps.
  • Reviews: review text, alias/pseudonym, optional email for verification (not published), timestamps and moderation history.
  • Usage & technical: IP address, device/browser information, pages viewed, referring URLs; cookie consent preferences.
  • Communications: emails you send us, support requests.

4. Sources of data

  • Directly from you (forms, account, emails).
  • Automatically from your device (through cookies/analytics, subject to consent where required).
  • From schools (e.g., when they respond to enquiries you initiated via us) only as metadata (e.g., status) where applicable.

5. Purposes and legal bases (GDPR/Swiss)

  • Provide the Service (account, saved schools, reviews): Contract or Legitimate Interests.
  • Forward your enquiries to schools and enable responses: Contract or Legitimate Interests.
  • Moderation, safety and abuse prevention (including anti‑spam, security logs): Legitimate Interests and Legal obligation where applicable.
  • Analytics and improvement (GA4, after consent where required): Legitimate Interests and/or Consent (via cookie banner).
  • Communications (service emails such as verification, deletion confirmations): Legitimate Interests or Contract.

6. Sharing your data

We share data with:

  • Schools you choose: When you submit an enquiry, we transmit your details and message to the selected school. The school then acts as an independent controller of that data.
  • Service providers (processors):
    • Pagely (hosting, on AWS infrastructure)
    • Cloudflare (CDN/DNS/DDoS protection)
    • Amazon SES (email sending)
    • n8n (workflow automation)
    • JetForm (site forms)
    • Google Analytics 4 (analytics; only after consent)
    • HubSpot (B2B only) — we do not store parents’/families’ contact details here

We require processors to protect data and act only on our instructions. We do not sell personal data.

7. International transfers

Some providers may process data outside Switzerland/EEA (including the United States). Where required, we rely on Standard Contractual Clauses (SCCs) with the Swiss/UK addenda as applicable, and implement supplementary measures.

8. Retention

  • Enquiry logs (content/metadata): 24 months.
  • Account/profile: while your account is active; if inactive for 24 months, we may delete or anonymise.
  • Reviews: while published and for 30 days in backups after removal.
  • Security logs: 12 months.
  • Backups: retained up to 30 days. We may retain minimal records if required by law or for security, fraud prevention, or abuse management.

9. Cookies and analytics

We use CookieYes to obtain and record your consent for cookies. You can Accept all, Reject all, or Manage preferences at any time via the cookie banner. We load Google Analytics 4 only after consent in regions where required. We do not use advertising cookies, remarketing, or heatmaps.

10. Your rights

Subject to applicable law, you can request access, rectification, erasure, restriction, portability, and objection, and you can withdraw consent at any time. To exercise your rights, email info@world-schools.com. You can also delete your account at https://world-schools.com/dashboard/delete-account/ (30‑day grace period).

If you are in the EEA/UK/CH and believe we’ve not resolved your concern, you may lodge a complaint with your local supervisory authority.

11. Children

The Service is for users 13+. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided data, contact us and we will delete it.

12. Security

We use appropriate technical and organisational measures including encryption in transit/at rest, access controls and least‑privilege, regular updates and vulnerability fixes, staff confidentiality and training, and vendor due‑diligence. No method of transmission or storage is 100% secure.

13. Communications

We send essential service emails (e.g., verification codes, deletion confirmations). We do not send marketing newsletters. You can unsubscribe from non‑essential emails via the link in our messages.

14. Do Not Track

We do not respond to browser “Do Not Track” signals.

15. US privacy notice (CPRA/California)

We do not sell or share personal information as defined by the CPRA, and we do not use cross‑context behavioural advertising. California residents may request access or deletion by emailing info@world-schools.com. We do not collect sensitive personal information for the purpose of inferring characteristics.

16. Changes to this policy

We may update this policy from time to time. For material changes, we will provide 14 days’ notice (e.g., banner) before they take effect. If you continue using the Service after the effective date, you consent to the updated policy.

17. Contact

Questions or requests? Email info@world-schools.com or write to Route de la Bernadaz 5A, 1094 Paudex, Switzerland.