Children's Privacy Notice

1. A note to parents and guardians

Eco Heroes exists because we believe children deserve to learn about sustainability through stories, games, and play — not lectures and fear. That commitment extends to how we handle their data: we collect as little as possible, we protect it carefully, and we give you (the parent or guardian) full control over your child's experience.

This notice explains what we do, what your rights are, and how to reach us when you have questions. It complements our main Privacy Policy — the general policy applies to everyone, this one adds the special protections we give to users under 18.

2. Age thresholds and consent

The GDPR sets a general rule that services targeted at children need parental consent for users under 16, but allows each EU member state to lower this to as far as 13. Here is how the major countries where Eco Heroes operates have set their thresholds:

For our platform, we apply the threshold of the user's country of residence. If a child in Spain is 14, they can consent on their own. If a child in Germany is 14, they need parental consent. We ask for the user's country during registration so we can apply the correct rule.

Because Eco Heroes International SL is established in Spain and our lead supervisory authority is the AEPD, the Spanish 14-year threshold is our default reference. For users in other countries, we apply the stricter local rule.

3. What data we collect from children

For any child user (under 18), we collect the minimum data needed to provide the service:

3.1 Account data

• Age range bracket (8–11, 12–14, 15–17 — not exact birthdate)
• Display name or nickname (we strongly recommend not using the child's real name)
• Parent or teacher email (for account recovery and parental consent)
• Language preference
• Country of residence (for applying the correct age rules)

3.2 Learning data

• Progress through SDG lessons, missions, and books
• Quiz and trivia scores
• Achievement badges earned
• Games played and completion status

3.3 Data we do NOT collect from children

4. Parental consent and verification

When a child under the local age threshold tries to create an account, the registration process requires verifiable parental consent. Here is how it works:

1. The child begins creating an account and provides their country and age
2. If they are below the local consent age, we ask for a parent or guardian's email address
3. We send a verification email to the parent/guardian with a unique link
4. The parent/guardian clicks the link, reads a summary of what data will be collected and how, and actively confirms consent
5. The child's account is activated only after this confirmation

We do not use credit card verification as a consent mechanism (some platforms do this, but it excludes families without credit cards and creates perverse incentives). We rely on a verified parent email, which is the method the Spanish AEPD has consistently indicated is acceptable for most educational platforms.

If the account is created through a school access code, the school (as the children's educator) is assumed to have obtained appropriate consent from parents as part of enrollment. The school takes responsibility for this, and our Data Processing Agreement with schools makes this explicit.

5. Parental rights

As a parent or legal guardian, you have the following rights regarding your child's data. These rights can be exercised at any time:

5.1 Right to review

You can request to see all data we hold about your child. We will provide it within 30 days at no cost.

5.2 Right to correct

You can ask us to correct any inaccurate data about your child.

5.3 Right to delete (right to be forgotten)

You can ask us to delete your child's account and all associated data. This is done within 30 days of your request.

5.4 Right to withdraw consent

You can withdraw your consent at any time. Withdrawal does not affect processing that happened before withdrawal, but stops all future processing based on that consent.

5.5 Right to restrict processing

You can ask us to stop actively processing your child's data while a dispute or concern is being resolved.

5.6 Right to portability

You can request a machine-readable export of your child's data to transfer to another service.

5.7 Right to complain

If you believe we have mishandled your child's data, you can file a complaint with the Spanish AEPD (www.aepd.es) or your local data protection authority.

5.8 How to exercise these rights

Email info@eco-heroes.org with the subject line "Parental Request - [child's account email]". We will verify your relationship to the child (usually by confirming you are the parent email on file) and respond within 30 days.

6. What we will never do

7. For teachers using Eco Heroes with a class

If you are a teacher using Eco Heroes with school students through a school access code:

• The school is responsible for obtaining any required parental consent (through your school's general privacy notice and enrollment process)
• The school holds a Data Processing Agreement with Eco Heroes that makes this responsibility explicit
• You (the teacher) can see aggregated class progress but not individual student identity beyond nicknames
• Students use school-issued nicknames, not real names
• Progress data is deleted at the end of each academic year unless the school requests retention for continuity

If your school has not yet signed a Data Processing Agreement with us, please contact info@eco-heroes.org before using Eco Heroes with students.

8. For young users — a note just for you

9. Security measures for children's accounts

Children's accounts have the same security protections as adult accounts, plus additional safeguards:

• Password requirements are enforced (minimum 8 characters, not just letters)
• Accounts with repeated failed login attempts are temporarily locked
• We notify the parent email on file of any significant account changes (password reset, email change)
• We never enable features that connect children to strangers
• The school cohort system means children only see their own class's aggregated data, not data from other schools

10. Contact for children's privacy questions

If we do not respond within 30 days, or if our response does not satisfy your concerns, you have the right to file a complaint with: