1. Scope of this notice
This privacy notice explains how Praktikal Education OÜ processes personal data in connection with:
- the public Praktikal website;
- the Praktikal platform used by teachers, students, school staff, and organization administrators;
- account registration, authentication, support, billing, and security operations related to those services.
This notice applies to the processing of personal data described below, subject to applicable data protection law.
2. Controller details and roles
Unless stated otherwise, the data controller for the processing described in this notice is:
Praktikal Education OÜ
Sirbi 13, Tartu, Estonia
Registry code:
16229727
VAT number: EE102398843
Email:
info@praktikal.ee
Praktikal acts as a controller in particular for:
- operation of the public website;
- handling contact and commercial inquiries;
- account lifecycle, authentication, access control, and platform security;
- customer relationship management, support, billing, and compliance;
- service improvement and platform administration.
In school and classroom contexts, the customer organization determines why and how student and learning data is processed and acts as the controller. Praktikal processes that data on the organization's documented instructions and acts as a processor. Our data processing terms for that processing are set out in our Data Processing Agreement. The organization remains responsible for its own education-specific legal obligations. This includes decisions about parent/guardian access, grade or attendance communications, and other statutory school notifications where those functions are carried out through the school.
3. Whose data we process and what data we process
Depending on how you interact with Praktikal, we may process the following categories of personal data:
- Website visitors and prospects: IP address, browser and device information, pages visited, referral information, language preference, and contact inquiry details.
- Account holders and organization users: name, email address, authentication identifiers, organization and account role information, sign-in metadata, and security logs.
- Teachers and content creators: lessons, worksheets, questions, comments, uploaded materials, repository items, and related collaboration metadata.
- Students and participants: answers, results, grades, participation data, session tokens for anonymous slideshow participation, and other activity data generated during platform use. Participants who join a session without an account are identified by a system-assigned pseudonym.
- Live session activity: audio and video streams, session chat messages, and shared board content created during live sessions.
- Support and service communications: support tickets, inquiry history, message content, and troubleshooting context you share with us.
- Commercial and compliance data: billing details, accounting records, transaction-related information, and records required by law.
We do not intend to collect or process special category data through Praktikal unless this is explicitly required for a specific service and lawfully supported. Please do not upload or enter such data into the platform unless Praktikal has expressly made that workflow available.
4. Why we process personal data and the legal bases we rely on
Where Praktikal acts as the controller, we rely on the following purposes and legal bases:
| Purpose | Typical data involved | Legal basis |
|---|---|---|
| Deliver and localize the website | IP address, browser/device data, language preference, technical usage data | Legitimate interests in operating a secure, usable public website |
| Respond to contact and sales inquiries | Name, email, phone number, organization, message content | Steps prior to entering into a contract and legitimate interests in responding to requests |
| Create and manage accounts, authentication, and access rights | Name, email, authentication identifiers, account role, organization context, login/security data | Contract performance and legitimate interests in access control and account security |
| Deliver the platform and learning workflows, where an account is not managed by a customer organization | User-generated content, lessons, worksheets, answers, results, participation data | Contract performance |
| Provide customer support and platform administration | Support history, message content, diagnostic data, account context | Contract performance and legitimate interests in support, troubleshooting, and service continuity |
| Protect the platform and prevent abuse | Logs, IP addresses, device/browser data, authentication events, audit trails | Legitimate interests in security, fraud prevention, and system integrity |
| Billing, bookkeeping, and legal compliance | Billing and transaction data, accounting records, compliance records | Contract performance and legal obligations |
| Measure how the website and platform are used | Pseudonymous account identifier, account role and type, page and event data, approximate location derived from IP address, device and browser data, page performance measurements | Legitimate interests in understanding usage, improving the service, and diagnosing performance problems |
| Optional cookies or future optional communications | Consent-driven identifiers or communication preferences | Consent, where required by law |
Where a customer organization controls learning data, including lessons, answers, results, grades, comments, and participation data, that organization determines the legal basis for the processing and provides the required information to data subjects. Praktikal processes that data only on the organization's documented instructions, on the data processing terms set out in our Data Processing Agreement where those terms have been agreed.
We do not currently use personal data for automated decision-making that produces legal effects for you.
5. Cookies, analytics, and similar technologies
The public website and the platform use technical storage and similar technologies for service delivery. At the time of this notice, this includes in particular:
- Essential functionality: language preference storage and technical tokens needed to keep the website or platform working as expected;
- Platform session and access management: authentication and session-related identifiers needed for sign-in, account context, or anonymous slideshow participation;
- Usage analytics: privacy-focused usage measurement through Umami across the public website and the platform.
Umami is self-hosted on Praktikal's own infrastructure, so analytics data is not shared with a third-party analytics provider. It does not use cookies and does not track visitors across other websites. IP addresses are used only to derive an approximate location and a session identifier, and are not stored.
Where you are signed in as a teacher, school staff member, or organization administrator, measurement is linked to the system-assigned pseudonym for your account, together with your role and account type, so that repeat use can be distinguished from new use. Your name and email address are never sent to the analytics system. Student participation is measured without an account identifier.
Because this measurement uses no cookies and stores nothing on your device, it does not require cookie consent. Where measurement is linked to your account pseudonym, the data is personal data and we rely on our legitimate interests in understanding usage and improving the service, as set out in section 4. You can object to that processing as described in section 9. We do not use analytics for advertising or profiling, and we do not combine it with data from other sources.
If Praktikal introduces optional analytics or marketing cookies in the future, we will update this notice and, where required, obtain consent before activating them.
You can also use your browser settings to manage cookies and similar storage, although blocking essential technologies may affect site or platform functionality.
6. Recipients, processors, and international transfers
We share personal data only on a need-to-know basis and only where there is a valid legal basis. Recipients may include:
- service providers that help us operate the website and platform, including hosting, storage, infrastructure, security, analytics, and support providers;
- infrastructure providers used to host the service, including IONOS data center infrastructure and object storage in Frankfurt and Berlin, Germany;
- email delivery providers, including Postmark for website contact-form email delivery, and Novu for platform notifications;
- machine translation providers, currently DeepL, where a user requests translation of authored text;
- AI providers, currently Anthropic and OpenAI, where AI-assisted features are enabled for your account — see section 6a below;
- identity and access tooling, including Keycloak-based authentication components used by the platform;
- payment service providers, including Stripe for platform payment processing;
- schools, teachers, organization administrators, and other authorized users, where access is part of the service configuration or permissions model;
- auditors, professional advisers, and public authorities where disclosure is required by law or necessary to defend legal claims.
Our core hosting footprint is currently in the EU or EEA. Some providers may still process personal data outside the EU or EEA or permit remote access from outside those regions. Where that happens, we rely on an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism under applicable data protection law.
Our provider setup may change over time as the service evolves. For processing we carry out on behalf of customer organizations, the current list is available on our Sub-processors page. That list is limited to processing covered by the Data Processing Agreement. Providers used for Praktikal's own controller activities are described in this notice. If you need more information, contact us at info@praktikal.ee.
6a. AI-assisted features
Praktikal offers AI-assisted features, including authoring assistance and analysis of learning materials and results. These features are optional and are enabled for your account or organization before any data is sent to an AI provider.
What is sent. Where you use AI features, the content you are working on is sent to an AI provider so that it can generate a response. Where that content includes student answers or results, participants are identified by a system-assigned pseudonym rather than by name, and account names are not included. The text of an answer is sent as the student wrote it, so it may contain identifying information if the student included any.
Where it is processed. AI processing carried out on Praktikal's own provider credentials currently uses Anthropic and OpenAI, which may process the data outside the European Union. Where that happens, we rely on an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism. We are moving this processing to providers operating within the European Union, and will update this notice when that is complete.
Your own AI provider. You may instead connect your own AI provider credentials, or connect an external AI client to the platform through the Model Context Protocol. If you do, data you request through that connection is sent to the provider you have chosen, under your agreement with that provider, and may be processed outside the European Union depending on the provider. Praktikal does not control that provider's processing.
Decisions about students. AI features do not make automated decisions about students. Where AI output relates to grading or assessment, it is a suggestion for a teacher to accept, amend, or reject.
7. How long we retain data
We keep personal data only for as long as it is needed for the purpose for which it was collected, for security and continuity needs, and to comply with law. Retention periods depend on the type of data, the service context, customer configuration, legal obligations, and operational need. In practice, this means:
- Website inquiries: for the time needed to answer the request and maintain a limited follow-up record;
- Technical and security logs: for limited periods needed for security, abuse prevention, diagnostics, and service improvement;
- Account and profile data: for the lifetime of the account and, where needed, a limited period afterward for account recovery, disputes, security, or legal obligations;
- Learning content, answers, results, and grades: for the duration of the educational relationship and according to the customer organization's or school's configuration and instructions;
- Billing and compliance records: for the statutory retention period required by applicable accounting, tax, or other legal obligations;
- Backups: for the duration of the relevant backup rotation cycle.
Because retention can depend on customer setup, incident handling, and legal requirements, some periods may vary by context.
8. Security and confidentiality
We apply technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, misuse, and unlawful disclosure. These measures include access controls, role-based permissions, logging, environment segregation, and security-focused operational controls.
No internet-based system can be completely risk free, but we work to keep the platform and the public website appropriately secured for their use cases.
9. Your rights
Subject to applicable law, you may have the right to:
- request access to your personal data;
- request rectification of inaccurate or incomplete data;
- request erasure of data in certain situations;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive a copy of certain data in a portable format;
- withdraw consent where processing is based on consent;
- lodge a complaint with a supervisory authority.
If your request concerns classroom, school, or organization-specific use of the platform, it may be most effective to contact the relevant school, teacher, or organization first. You can also contact Praktikal at info@praktikal.ee.
You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) or with your local supervisory authority where applicable.
10. School use, updates, and contact
Praktikal is used in school contexts, including by teachers and students. Where schools or teachers decide how student data is used in their educational activities, they are responsible for their own notices, lawful basis, and any guardian-facing obligations required by law.
We may update this privacy notice from time to time to reflect legal, technical, or product changes. When we do, we will publish the updated version on this page and update the revision date shown above.
For privacy questions or rights requests, contact:
- Email: info@praktikal.ee
- Postal contact: Praktikal Education OÜ, Sirbi 13, Tartu, Estonia