Last updated: 8 October 2024

1. Introduction

Pickatale AS ("Pickatale" or "we") processes personal data about the following categories of persons:

• Users of our Pickatale services (for example parents, teachers or children)
• Contact persons for our business customers (for example schools, municipalities)
• Receivers of newsletters

We have made this privacy notice to explain how and why we use your personal data and what rights you have. Typically we will process personal data about you when you use our Pickatale services or otherwise contact us. It is very important for us in Pickatale that our reading platform and services are privacy friendly and secure to use.

Important note. Please note that this privacy notice describes only the use of personal data when we are the data controller, which means when we decide the purposes and means of the processing.

If you use Pickatale services as a teacher or pupil, the school will be the data controller of the processing of your personal data, and the school has entered into a data processing agreement with us. Although we act as a data processor for your school, we may use pseudonymised and aggregated data in order to improve our products and services and the time of login for security reasons. If you want more information about the school's processing of personal data, we kindly request you to contact your school.

2. How and why do we use your personal data?

We use personal data for these reasons:

• Provision of our reading platform. In order to give you access to our reading platform and services, we need to use personal data.
• Parent: You need to create a user account. This means we will process your name, e-mail, password, birth year.
• Child: Your child is registered with a nickname, birth year and avatar. We will also process books read and reading progression, such as reading time (minutes and days), books read, quizzes completed and average score.

When you register for Pickatale for the first time, we will ask you for specific consent for the following functions and services:

• Personal follow-up with reports and tips so you can monitor your child’s progress in the app.
• Use of personal information to adapt Pickatale to the user.

We may use pseudonymised and aggregated data in order to improve our products and services, including the retraining and finetuning of our AI models. For the purpose of retraining and finetuning AI models, we use the outputs generated by AI features available in the Pickatale services and the modifications you make to such outputs as training data. Provided that you have used the Pickatale services correctly in accordance with the applicable Terms and Acceptable Use Policy, the training data will not contain any personal data other than the fact that the outputs and modifications thereof are associated with a code which may be linked to your user account only by persons who have access to information connecting the code and the user account. Such identifying information is stored separately so that the outputs and modifications will not be associated with you when we use them as training data.

We will also process your IP address and time of login for security reasons.

If you make your own interactive book by using our AI features use, we may process personal data, including without limitation your input in AI features, to ensure that your use complies with our Terms and/or Acceptable Use Policy. Such use includes moderation of content and enforcement of the Terms and/or Acceptable Use Policy. When you prompt, we have implemented technical measures to ensure that your prompt will not be identifiable for any of our subsuppliers we use to provide AI features, i.e. your prompt will not involve any processing of personal data.

We may also aggregate the information contained in input data (prompts) that you provide when using the Pickatale services with input data provided by other users, or other types of data, in an anonymised manner, for statistical and analytical purposes, service improvement, and retraining purposes. Our further use of such aggregated and anonymised data is not
restricted by laws and regulations pertaining to personal data.

We process personal data related to purposes of providing our reading platform based on that we need to fulfill the contract with you and/or because we have a legitimate interest in giving you a good user experience and secure service, and in improving our AI models based on outputs and modifications thereof.

• Customer handling and enquiries. We need information about our customers to provide our services. If you are a parent we need to process your personal data in order to enter into or fulfil our agreement with you. If you a contact person at our business customer (for example school or municipality), we will process your personal data because we have a legitimate interest in conducting business with the entity you work for. The information collected may include name, e-mail address, address. We handle enquiries because we have a legitimate interest in doing business.
• Payment. To receive correct payments we need to process certain payment information, such as name, address, credit card information and order information. We process such personal data because it is necessary to fulfil the contract with you and/or because we have a legal obligation to do so.
• Social media. We use our social media channels to interact with people and marketing our products. We will typically process the name, user name, visible information, communication (likes, comments and messages), browsing behaviour and preferences of visitors.

We are joint controllers with the social media provider when we use personal data about persons who visit and interact with our fan pages, generate aggregated statistics for activities on our company pages and provide information to the users of the platforms through targeted dissemination. We process such personal data based on our legitimate interests in reaching out to users and customers.

We have the following social media accounts:

• Facebook (Pickatale Norge and Pickatale UK & Ireland)
• Instagram (Pickatale Norge and Pickatale)
• YouTube (Pickatale Norge)

Pickatale is not responsible for the social media providers' processing of personal data for their own purposes. You read more about their processing of personal data in their respective privacy notices at Facebook, Instagram and YouTube.

• Newsletters and direct marketing. We will send you information about future products via e-mail if you provide us your consent to do so. You can withdraw your consent at anytime by sending us an e-mail or by clicking unsuscribe at the bottom of the newsletters.

3. How do we secure your personal data?

Your information is transmitted from your device to our servers using HTTPS. Our database is set up for one-way communication, so that no outsiders can retrieve information. We have implemented and use reputable security solutions to secure your information.

4. Who has access to your personal data?

We may share personal data with the following recipients or categories of recipients:

• Service providers. We use service providers, such as IT suppliers (such as databases, e-mail, analytics, marketing, license management, internal communications, newsletters, customer relationship management and customer service) and marketing companies etc., that process personal data on our behalf as data processors. We will always enter into appropriate data processor agreements with our data processors. Pickatale's services are hosted by Amazon Web Services (AWS).
• Payment service providers. We use payment providers Stripe Inc. and Strex AS that process your personal data on behalf of Pickatale when you purchase something from us. However, please note that Pickatale is not responsible for the payment service providers' own processing of personal data for their own purposes. For example, you may create a user account with the service provider. You can read more about their processing of personal data in the respective privacy notices of Stripe and Strex.
• Professional advisors. We may share personal data with our professional advisors, such as lawyers, accountants, auditors, consultants etc.
• Public authorities or other parties if requires by law. We will disclose your personal data if we are required to do so by law or in response to valid requests by public authorities (for example a court or a government agency).

We will never share or otherwise make available your personal data to others unless there is a legal basis for such disclosure. Examples of such a basis will typically be an agreement with you or a legal basis that requires us to disclose the information. Pickatale has limited access to the database so that only our employees and third parties with whom we have data processing agreements have access. Pickatale will in some cases share statistics of anonymised information with third parties. Pickatale only uses subcontractors who have the same level of protection for personal data as we have.

5. Transfers of personal data

The use of some data processors may, to a very limited extent, involve transfers of personal data to the United States. For such transfers we ensure that the personal data is afforded a level of protection that is equivalent to that guaranteed within the EU/EEA. Our transfers to the United States are based on adequacy decisions, i.e. EU–U.S. Data Privacy Framework and UK Extension to the EU–U.S. Data Privacy Framework.

6. How long do we store your personal data?

In general, we store your personal data for as long as necessary to fulfill the purpose that the personal data was collected for or otherwise processed. However, the actual retention period depends on the purposes we use personal data for:

• Provision of our reading platform. We store your personal data for as long as you continue to use Pickatale with a valid user account. If you cancel your subscription, your personal data will be deleted after 1 year. Please note that uninstalling the app does not involve deleting data or terminating a subscription.
• Newsletters and direct marketing. We will send you newsletters and other marketing enquiries via e-mail until you click "Unsubscribe" on the bottom of the newsletter or otherwise withdraw your consent by emailing us.
• Customer handling and enquiries. We will store information about our customers (parents or schools) as long as we have you as a customer. Enquiries are deleted at regular intervals, but normally not stored for more than three years.
• Payment. We will retain payment information about you and relevant accounting material for five years after the end of the accounting year pursuant to legal obligations.
• Social media. In principle, all the content in our social media channels will be stored as long as we administrate the relevant channel. However, please note that you as the end user can remove your own content by deleting posts, clicking unlike etc.

In some situations, we may store the personal data for longer period because we have a legal obligation to do so or because we need to establish, exercise or defend a legal claim. Please also note that even if we have a legal obligation to store your personal data, we may use your personal data for other purposes as well.

7. What rights do you have?

If we process your personal data, you are a data subject that have certain rights:

• Access. You may ask us whether or not your personal data is processed by us and, if this is the case, access your personal data and further information about the processing.
• Rectification. You may ask us to rectify inaccurate personal data about you.
• Deletion. You may ask us to erase your personal data.
• Restriction. You may ask us to restrict our processing of your personal data.
• Objection. You may object to our processing of personal data concerning you.
• Data portability. You may ask us to give you or another controller your personal data in a structured, commonly used and machine-readable format.

If the processing of your personal data is based on consent, you can withdraw your consent at any time. by contacting us at personvern@pickatale.no or by going to My Page (if you have a user account).

Please remember that the rights mentioned might have some restrictions. Giving your personal data is your choice, but we usually need it for you to make an agreement with us or use our services. Failure to give your personal data or using your rights may stop us from providing you the Pickatale services.

You can use your rights by sending us an e-mail at personvern@pickatale.no. We will respond to you as soon as possible, and no later than within 30 days. We may ask you to confirm your identity or provide additional information before we allow you to exercise your rights against us. We do this to ensure that we only give access to your personal data to you – and not someone who claims to be you.

8. Complaints

If you have questions about our use of personal data or are unhappy with how we do it, please feel free to email us at personvern@pickatale.no.

You may also send a complaint to the Norwegian Data Protection Authority, which is the supervisory authority for data protection in Norway, or to the relevant data protection authority in an EU/EEA member state where you work.

9. Changes

Should there be a change in our services or changes in the regulations on the processing of personal data, it may cause a change in the information we have provided here. Changes will be published in the form of updating the app. In addition, updated information will always be easy to find on our website.

10. Contact information

Pickatale is the data controller of the processing of personal data. Our registered address is:

Pickatale AS

Askekroken 11

0277 Oslo

Norway

Business number: 999 638 058 VAT

If you have any enquiries, questions or complaints regarding our processing of personal data, you may contact us anytime at personvern@pickatale.no.