Privacy Policy
Last updated: [TODO: date of publication]
This is a translation for your convenience. Only the German version is legally binding: German version
This policy explains which personal data the Book Exchange processes, why, for how long, and which rights you have. It applies to the Book Exchange website and app. Most of our users are pupils, so we try to keep it short and clear. If something is unclear, ask us (see Who is responsible) or ask your parents to help.
In short
- We only collect what the Book Exchange needs to work: your account, your listings, your reservations and your messages.
- Other pupils only see your display name, never your email address. Only pupils of your own school see your listings.
- We do not use advertising, tracking or analytics, and we never sell data.
- Chat messages are checked automatically to protect pupils, partly by OpenAI in the USA (only the text, without your name).
- Bank details for a transfer are stored encrypted, shown only to your buyer, and deleted when the sale ends.
- You can delete your account at any time in your account settings.
Who is responsible
Controller under the GDPR: Conseil Supérieur des Élèves (CoSup), the pupils' representative body of the European Schools Wilhelmstr. 62, 75323 Bad Wildbad, Germany Email: [email protected]
Privacy contact: [email protected]
Data protection officer: [TODO: name and contact of the data protection officer, or state that CoSup has not appointed one]
The Book Exchange is an independent project run by CoSup. It is not operated, endorsed or controlled by the European Schools, and the European Schools are not responsible for its content or for the processing of personal data on this platform.
Your account
When you register with email and password, we store: your email address, your password (only as a secure hash, never readable), your display name, your school, your role (pupil, moderator or admin), your language, your email settings, whether your email address is confirmed, and when your account was created and changed. Your school is assigned from your school email address, so we send a link to that address to confirm it: until you confirm it, you can look around but not sell, reserve or send messages. We also record when you last signed in, so that unused accounts can be deleted (see How long we keep data).
We use this to create your account, sign you in, show your display name to other pupils, show you only your own school, and send you the emails described below. Other pupils never see your email address.
Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for). [TODO: confirm with the data protection officer whether the legal basis is the terms of use (Art. 6(1)(b)) or consent (Art. 6(1)(a))]
Signing in with your school Microsoft account
This applies once Microsoft sign-in has been switched on for the Book Exchange. Until then, you sign in with your email address and password.
You can sign in with the Microsoft account the European Schools gave you. Microsoft then tells us: your Microsoft account ID, your school code, your status as a pupil, the account type, the school email address and which organisation the account belongs to. We use this only to check that you are a current pupil of a European School and to assign your school. We do not store your school email address, your Microsoft account ID or any Microsoft token. We store only a pseudonymous fingerprint of your account ID (a keyed HMAC-SHA256 value, from which the ID cannot be recovered), so we recognise you next time, and the personal email address you give us. While Microsoft sign-in is on, an account connected to Microsoft can only sign in with Microsoft, and once a year we ask you to sign in with Microsoft again to confirm that you are still a pupil (see How long we keep data).
The Microsoft accounts are operated by the European Schools in their own Microsoft Entra ID. Microsoft processes the sign-in for the European Schools, not for CoSup.
Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR (our legitimate interest in making sure that only pupils of the European Schools use the platform).
Listings, reservations and handover
When you sell a book we store the book (title, author, subject, ISBN and similar details), its condition and price, your photos, the status of the listing, and, once it is sold, the buyer and the date of the sale. Photos are re-saved in your browser before upload so that hidden information (for example the location where a photo was taken) is removed; our server rejects photos that still contain such information.
When you reserve a book we store the reservation (buyer, seller, listing, status, dates) and the steps of the handover: confirmations by both of you, reminders, and problems you report. Requests that the seller does not answer expire after 48 hours. You can have at most 3 open reservations and send at most 10 requests a day.
Your listings and your display name are visible only to pupils of your own school. Moderators of your school can see them too.
Legal basis: Art. 6(1)(b) GDPR.
Messages and automatic checks
Buyer and seller can write to each other about a book. We store the messages with sender and time. Only the two of you can read them. Moderators only see a conversation when someone reports it or when a message is flagged by the automatic check.
To protect pupils, every message is checked before it is shown: first against word lists on our own server, then by the moderation service of OpenAI (OpenAI, L.L.C., USA). OpenAI receives only the text of the message, without your name, email address or any other account details, and returns a safety assessment. If the service is not reachable, the message is delivered and checked later.
Depending on the result, a message may be blocked, a report may be created for the moderators of your school, or (if a message suggests you might hurt yourself) you see a note with where to get help. In urgent cases the safeguarding contact of your school receives an email containing only a link to the report, no message text and no names. These automatic checks do not decide anything else about you, for example they do not block your account; that is only ever done by a person.
Legal basis: Art. 6(1)(b) GDPR for delivering messages; Art. 6(1)(f) GDPR (our legitimate interest in protecting pupils, many of them minors, from bullying, abuse and danger) for the checks and reports.
Payments and bank details
Payments are made directly between buyer and seller, in cash or by bank transfer. CoSup never receives or handles money.
If you sell a book and choose to share bank details for a transfer, we store the IBAN and the account holder name encrypted. Only the buyer of that sale can see them, and only while the reservation is accepted. The payment QR code is created in the buyer's browser. The bank details are deleted automatically as soon as the sale is completed, cancelled or expires, and at the latest 14 days after they were shared. We never write them into logs.
Legal basis: Art. 6(1)(b) GDPR.
Wishlist
You can put books on your wishlist. We then store which books you want and, when a matching book is listed at your school, a notice for you. We email you about new matches at most once a day; you can turn these emails off in your account settings.
Legal basis: Art. 6(1)(b) GDPR.
Reports, moderation and safety
If you report a message, conversation, listing or user, we store who reported what, the reason, your explanation, and the related message, conversation or listing. Moderators of the school concerned and the CoSup IT team review reports. We also store their decisions: for example a hidden listing with the reason, or a blocked account with the reason, who blocked it and when.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a safe platform); Art. 6(1)(c) GDPR where the EU Digital Services Act requires us to process reports.
Emails
We send emails to confirm your email address, to reset your password, about reservations and handovers (requests, answers, reminders, problems), about wishlist matches, before an unused account is deleted, for the yearly Microsoft check, with the reason if your account is blocked, and, to the safeguarding contact of a school, about urgent reports. Reminders and wishlist emails are optional: you can turn them off in your account settings. Emails about your reservations and safety are always sent.
Emails are sent through ZeptoMail by Zoho [TODO: legal entity of Zoho that provides ZeptoMail], from its data centre in the EU. Zoho receives your email address and the content of the email and keeps delivery logs [TODO: how long ZeptoMail keeps delivery logs].
Book information (ISBN lookups)
When you enter or scan an ISBN, our server asks Open Library (Internet Archive, USA) and Google Books (Google, USA) for the book details and the cover. Only the ISBN is sent, from our server, so these services do not receive your IP address or any information about you. Cover images are also loaded through our server. Barcode scanning happens entirely in your browser; camera images are not uploaded.
Server logs
When you use the Book Exchange, our server records technical data for each request: IP address, date and time, the address requested, the result and the browser identifier. We need this to run the service securely and to find errors. These logs are deleted after 7 days.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in operating the service securely).
Who receives data
- Other pupils of your school: your display name and your listings; your buyer or seller: your messages, and your bank details if you share them.
- Moderators of your school and the CoSup IT team: what they need to handle reports and keep the platform running.
- The safeguarding contact of your school: a link to urgent reports.
- netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany: hosting of all platform data on servers in Germany (processor under Art. 28 GDPR).
- Zoho (ZeptoMail), EU data centre: sending emails (processor).
- OpenAI, L.L.C., USA: checking the text of chat messages (processor).
- Cloudflare, Inc., USA: every connection to the Book Exchange passes through Cloudflare's network (name service, encryption, protection against attacks), which processes IP addresses and request data for this (processor).
- Authorities, only where the law obliges us.
Data outside the EU
All platform data is stored in Germany. Two services involve the USA: the text of chat messages is sent to OpenAI for the safety check, and connections pass through the global network of Cloudflare, which may process IP addresses outside the EU. [TODO: transfer mechanism for OpenAI and Cloudflare: the EU-US Data Privacy Framework where the company is certified under it, otherwise the EU standard contractual clauses in its data processing addendum; confirm that both addenda have been accepted] Under OpenAI's API terms, the text is not used to train models and is kept for at most 30 days to detect abuse.
How long we keep data
- Your account: until you delete it. If you don't sign in for 12 months, we send you an email; if you still don't sign in within 30 days, the account is deleted. Accounts of moderators and administrators are managed by CoSup.
- With Microsoft sign-in: if you haven't signed in with Microsoft since the school year started (1 September), we email you from 1 October; if you don't sign in with Microsoft within 30 days of that email (for example because you have left school), your account is deleted.
- Bank details: deleted automatically when the sale is completed, cancelled or expires, and at the latest 14 days after they were shared.
- Reservation requests: expire after 48 hours without an answer; completed and cancelled reservations stay as part of the sale's history.
- Listings: 6 months after a listing is sold or withdrawn, its photos are deleted and it is no longer linked to the seller or the buyer; the rest (book, price, condition, dates) is kept for anonymous statistics.
- Messages: deleted 6 months after the last message in the conversation, unless a report about them is still open.
- Reports: 12 months after a report has been closed, the people and the content it concerns are removed; only the reason and the dates remain, for statistics.
- Server logs: 7 days (see above).
When you delete your account, we remove your email address, your password, your display name and your Microsoft link, end your open reservations and listings, and delete your wishlist. Messages you sent stay in the other person's conversation, shown as "Deleted user", until they are deleted as described above; reports about you stay for the moderators as long as needed to handle them.
Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a common format (Art. 20), and to object to processing based on our legitimate interest (Art. 21). If processing is based on your consent, you can withdraw it at any time for the future.
Many things you can do yourself in your account settings: change your display name, turn off optional emails, disable or delete your account. For everything else, write to [email protected].
You can complain to a data protection supervisory authority. The authority responsible for CoSup is: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, [email protected], https://www.baden-wuerttemberg.datenschutz.de. You can also contact the authority in the country where you live.
Pupils under the age of digital consent
The Book Exchange is meant for pupils of the European Schools, most of whom are minors. If you are younger than the age at which you may agree to the processing of your data yourself in your country (between 13 and 16 years, depending on the country), a parent or guardian must agree before you use the Book Exchange. [TODO: how parental consent is collected, e.g. the parental consent form, once confirmed with the data protection officer]
Security
All connections are encrypted (HTTPS). Passwords are stored only as hashes, bank details only encrypted. Moderators only see data of their own school. Administrator access is limited to the CoSup IT team. We store as little as possible: no school email addresses for Microsoft sign-in, no photo location data, no tracking.
Changes to this policy
We update this policy when the Book Exchange or the law changes. The date at the top shows the current version. Only the German version of this policy is legally binding; the other languages are translations.