NXTLVL Education Ltd (“we“, “us”) is committed to protecting and respecting your privacy. The website at https://www.nxtlvl.io// (our “Website”) and services are meant to provide a space for children from different parts of the world to connect and develop skills like creativity, critical-thinking and communication through game-based learning.

This Privacy and Cookie Policy (“Policy”) applies to our customers/subscribers and if you want to know more about our services.

The Policy explains how we collect your personal data and why we are allowed to do so (on what legal basis), how personal data provided by children between 6 – 13 years (whose parent’s or guardian’s consent we need) and teenagers up to the age of 14 years (“Children”) will be used by us, and the cookies on our Website. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of the General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018 the Data Controller is NXTLVL Education Ltd.

We will only collect information that is necessary for us to provide you with our services. If we do not need the information, then we will only collect it if you agree (consent). However, if certain information is necessary but you do not want us to collect it, unfortunately we will not be able to provide the services to you. We will flag this to you in each case.“You” means a parent or guardian, or child.

‍OUR APPOINTED REPRESENTATIVE IN THE EUROPEAN ECONOMIC AREA (EEA) As we are based in the United Kingdom, we have appointed Konstantinos Papazafeiropoulos to be our representative within the EEA. If you are based in the EEA and have concerns or questions about your personal data, you can contact our representative. Their contact details are NXTLVL, 2nd floor, Leoforos Andrea Siggrou 80-88, 11741, Athens, Greece.

1. YOUR PERSONAL INFORMATION

Information we collect and use

We collect and use some or all of the following types of information from you when you use the Website or when we provide our services:

• Information that you provide by filling in the subscription form to “secure your spot”. • Information you provide when you report a problem with the Website or our services. • Personal details for parents or guardians such as first name, last name, email address, country of location or residence, time zone, language or any other information input when using the Website or our services. • Personal details for a child such as first name, last name, date of birth, age, gender, country of location or residence, native language or any other information input when using the Website or our services. • Information on your NXTLVL dashboard: the child’s and parent or guardian’s personal information, the child’s progress record, the child’s personalised feedback from facilitators, and the child’s personal targets. • Video and voice recordings of the child from each session used for evaluating progress and providing feedback. • When the child uses the chat rooms or other social features e.g. on the NXTLVL dashboard, Zoom, Google Meet. • Financial and billing information e.g. your invoices and payment receipts/confirmation (but not your credit or debit card details). • If you contact us, we may keep a record of that correspondence including your email address. • We may also ask a parent or guardian to complete surveys that we use for research purposes, although you do not have to respond to them. • Technical information such as details of your visits to the Website including, IP address, traffic data,, weblogs and other communication data, and the resources that you access. • Device type, browser type, and language. • We do not collect any special categories of data about you (i.e. information about your race or ethnicity religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

This Website may include links to third-party websites, plug-ins (such as our payment provider) and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy policy of every website you visit.

---

2. USES MADE OF YOUR INFORMATION

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and the reasons to do so. We have also provided reasons why collecting certain information is important for us.

Note that we may process your personal data for more than one reason depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific reason we are relying on to use your personal data if this is not provided below.

Change of purpose

We will only use your personal data for the reasons for which we collected it, unless we reasonably think that we need to use it for another reason and that reason is very similar to the original reason. If you wish to get an explanation as to how using the personal data for the new reason is closely related with the original reason, please contact us. If we need to use your personal data for an unrelated reason, we will tell you and we will explain the reason which allows us to do so.Please note that we may use your personal data without your knowledge or consent, as we have explained in the table, where this is required or permitted by law.

Marketing

In addition to the above uses we may use a parent or guardian’s information (and, where a parent or guardian has consented, permit selected third parties to use your information), to notify a parent or guardian about goods or services which may be of interest to you. Where we do this, we will contact the parent or guardian by electronic means (e-mail or SMS) only if the parent or guardian has consented to such communication. If a parent or guardian does not want us to use your data in this way, please either (i) tick the relevant box situated on the form on which we collect your data (for example, the registration form); (ii) unsubscribe from our electronic communications using the method indicated in the relevant communication; or (iii) inform us at any time by contacting us at the contact details set out below.

For Children, we will not contact you for marketing, but we may contact your parent or guardia

Automated decision making

We use automated decision making to a limited extent in allocating cohorts. First, we ask you for your three preferred options ranked in the order of your preference. You will then be automatically allocated to a cohort from one of your preferred options for each session.If we cannot place you in either of your preferred pre-selected cohorts, we will discuss and arrange another suitable cohort with your parent or guardian.

---

3. SHARING YOUR INFORMATION WITH OTHERS

We normally share your personal data with our third party service providers, agents, subcontractors and other associated organisations to complete tasks and provide services to you on our behalf (e.g. to host our servers). With your consent, we use cookies and other technologies to better understand how our website is used and your personal data/ Cookies may be used to personalise advertising with the help of external partners.

We may share your personal data with any member of our corporate group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006 (where applicable). We will not share recordings of you unless we have been in touch to discuss this with you and your parent / guardian and you have both agreed to it. ‍ We may also share your personal data with third parties: • in the event that we sell or buy any business or assets, in which case we may share your personal data to the prospective seller or buyer of such business or assets; or • if we or substantially all of our assets are acquired by a third party, in which case personal data held by us about our customers will be one of the transferred assets; or • if we are under a duty to share your personal data in order to comply with any legal obligation, or in order to enforce or apply our Website Terms and Conditions or Customer Terms of Service; or • to protect our rights, property, or safety or that of our affiliated entities and our users and any third party we interact with to provide the Website.

We may share a parent or guardian’s contact details in relation to selected third parties only, only where the parent or guardian has consented to such selected third parties informing them about certain goods or services, which may be of interest to you / them.

Except as explained and if necessary in order for us to carry out our obligations arising from any contracts entered into between you and us, we will not share your data with third parties unless we have asked you and you have given your express agreement to do so.

---

4. STORING YOUR PERSONAL DATA

Security We take appropriate measures to ensure that any personal data you provide us is kept safely, including security measures to prevent personal data from being accidentally lost, or used or accessed in any way that is not allowed. We only give access to your personal data to those who have a genuine business need to know it. Those using your information will do so only in a way allowed by us and they will not share your information with anyone else except as we have described in section 3. Where we have given you (or where you have chosen) a password to log into your NXTLVL dashboard, you promise to keep this password safe and not share it with anyone else. ‍ We also have plans in place to deal with any potential accident or incident which could lead to your personal information being accessed by someone who is not allowed to do so. We will tell you and any applicable regulator of a suspected data security breach where have to do so by law. ‍ Unfortunately, the transmission of information via the internet is not completely secure or safe. Although we will do our best to protect your personal data, we cannot promise the security of your data shared to the Website; any personal data you give us is at your own risk. Once we have received your information, we will use strict procedures and security features to try to keep the data safe. ‍ The Website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and terms of use and that we do not accept any responsibility or liability for these policies and terms of use. Please check these policies before you submit any personal data to these websites. ‍ Keeping your personal data up to date If your personal details change you may update them on the NXTLVL dashboard, or by contacting us using the contact details below. If you have any questions about how we use data collected which relates to you, please contact us by sending a request by email to the contact details below. ‍ If you ask us to update your personal data, we will do our best to update your personal data within 14 days of any new or updated personal data being provided to us, so that the personal data we hold about you is as accurate and up to date as possible.

How long we keep your personal data • We will hold names, addresses, email addresses and contact details for as long as you are subscribed to our services and for the period we are required to retain this information by applicable UK tax law (currently 6 years). • We will hold the video and voice recordings from each session for one month from the date of the session. We will promptly delete the recording if you request us to delete it after the session. • We do not hold on to any personal data collected when you use our chat rooms or social features. • If you contact us to find out more about our services. We only hold on to your name, email address and contact details for up to one year. ‍ Where we store your personal data All information we hold about you is stored on AWS Data Centres (Dublin Region), Hubspot (www.hubspot.com), Twilio-Segment (www.segment.com), Google (www.google.com) / Google Drive (www.google.com/drive), Zoom (www.zoom.us) Cloud Recordings secure servers within the EEA. ‍ We will let you know if the data that we collect from you will be sent to or stored at a destination outside the United Kingdom and/or the European Economic Area ("EEA"). ‍ If we send your personal data to a country that does not have good enough safety rules in the view of the authorities in the United Kingdom and/or EEA, we will have agreements with standard contractual clauses approved by the United Kingdom’s Information Commissioner’s Office and/or the EU Commission and any other appropriate safeguards which may be needed for sending and keeping the data safely.

If you would like to be informed on how Google may use your personal data, including for non-personalised and personalized advertisements that are shown to you and others, please review the Google’s Privacy & Terms site.

If you would like further information, please contact us (see ‘Contact’ below).

---

5. YOUR RIGHTS

Under the General Data Protection Regulationyou have a number of important rights free of charge. In summary, those include rights to: • access to your personal data and to certain other supplementary information that this Policy is already designed to address • require us to correct any mistakes in your information which we hold • require the erasure of personal data concerning you in certain situations • receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations • object at any time to processing of personal data concerning you for direct marketing • object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you • object in certain other situations to our continued processing of your personal data • otherwise restrict our processing of your personal data in certain circumstances • claim compensation for damages caused by our breach of any data protection laws. ‍ For further information on each of those rights, including when they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please: ‍ • email, call or write to us using the details below; • let us have enough information about who you are e.g. name, email address; • let us have proof of who you are and your address (a copy of your driving licence or passport and a recent utility or credit card bill); and • let us know the information to which your request relates, including any account or reference numbers, if you have them.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

If you wish to withdraw your consent at any time, please contact us at legal@nxtlvl.io or click Unsubscribe in any of our emails.

---

6. HOW TO COMPLAIN

We hope that we can resolve any query or concern you raise about our use of your information.

The General Data Protection Regulation and the UK GDPR also give you the right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state or the UK where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/make-a-complaint/ or telephone: 0303 123 1113.

The supervisory authority in the EEA is: Hellenic Data Protection Authority, Kifissias 1-3, PC 115 23, Athens, Greece. Telephone: +30-210 6475600 or e-mail: contact@dpa.gr.

---

7. CHANGES TO OUR PRIVACY POLICY

We can change and update this Policy at any time. If you are a subscriber, you will be informed of any changes we may make to our Policy in the future and you can find the new Policy on our Website, too. Your continued use of the services and the Website shall mean you have accepted the updated Policy.

---

8. INFORMATION ABOUT OUR USE OF COOKIES

Our Website uses cookies to distinguish you from other users of our Website. This helps us to provide you with a good experience when you browse our Website and also allows us to improve our site.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.

We use the following cookies: • Strictly necessary cookies. These are cookies that are required for the operation of our Website. They include, for example, cookies that enable you to log into secure areas of our Website or make use of e-billing services. • Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our Website when they are using it. This helps us to improve the way our Website works, for example, by ensuring that users are finding what they are looking for easily. • Functionality cookies. These are used to recognise you when you return to our Website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Note that cookies may be used by NXTLVL or our third-party service providers for the personalization of ads.

You can find more information about the individual cookies we use and the purposes for which we use them in the table below:

Please note that the following third parties may also use cookies, over which we have no control. These named third parties may include, for example, advertising networks and providers of external services like web traffic analysis services. These third party cookies are likely to be analytical cookies or performance cookies or targeting cookies: ‍ • Our payment provider: Stripe (www.stripe.com) • Our CRM provider: Hubspot(www.hubspot.com) • Our Behavioural Analytics Provider(www.hotjar.com)

However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

Except for essential cookies, all cookies will expire at most after 6 months

---

9. CONTACT

All questions, comments and requests regarding this Privacy and Cookie Policy should be addressed to [legal@nxtlvl.io] or write to us at NXTLVL Education Ltd, Building 423 - Sky View (Ro) Argosy Road, England, DE74 2SA, England, United Kingdom.