Privacy policy

How Ksiopea processes personal data. Privacy by design: no telemetry, no trackers, and data hosted in the European Union.

Courtesy translation. The Spanish version is the legally binding one.

1. Data controller

2. Data processed

Ksiopea processes two sets of data with distinct roles:

Account data

• The user’s name and email address.
• Access credential, stored encrypted; optionally, a second authentication factor.
• Minimal technical access and security logs.

If you sign in with Google, we process only your email address and name to authenticate access to an already-registered account; we do not access any other data in your Google account (files, calendar, contacts or otherwise) and we do not create new accounts from Google.

Institution data used to build the timetable

• Teachers’ names and availability, rooms, subjects, groups and period structure.
• Ksiopea does not process student data: it neither requires nor stores grades, named enrolments or other data of minors.

3. Purpose

• To provide the timetable generation and management service.
• To authenticate access and protect account security.
• To handle support and manage the contractual relationship and billing.

4. Legal basis

• Performance of the service contract.
• Compliance with legal obligations (tax and commercial).
• Legitimate interest in ensuring the security of the platform.

5. Teacher data: data processing agreement

Regarding the teacher data the institution enters to build its timetables, the institution is the data controller and Oksigenia SL acts as processor, processing it only on the institution’s instructions and to provide the service. This relationship is formalised in the corresponding processing agreement (Art. 28 GDPR).

6. Retention

Data is kept while the service relationship lasts and, afterwards, for the periods required by applicable law (among others, four years for tax matters and six years for commercial books). An institution’s timetable data is deleted or returned to it at the end of the service, as agreed.

7. Recipients and location

No data is shared with third parties except by legal obligation. Only the processors strictly necessary for the service are involved: the hosting infrastructure, located in the European Union, and the firm that handles Oksigenia SL’s administration. Ksiopea uses no advertising trackers or third-party SDKs, and performs no international data transfers for its operation.

8. Self-hosting

For clients who require it, Ksiopea supports deployment on the institution’s own infrastructure, so that its data resides on its server.

9. Rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, as well as withdraw consent, by writing to privacidad@oksigenia.com. If you consider the processing does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es).

10. Security

Oksigenia SL applies technical and organisational measures in line with the state of the art: credential encryption, second authentication factor, role-based access control and encryption of configuration secrets. The platform includes no telemetry or behavioural analytics.

Last updated: August 2026 · Oksigenia SL