WELL3 PLATFORM - PRIVACY AND COOKIE POLICY

PREAMBLE AND GOVERNANCE STRUCTURE

This Privacy and Cookie Policy governs the processing of data on the Moodle Learning Management System (LMS) operated for the Well3 – Wellbeing at School Project co-funded by the European Union. Project Reference Number: 2025-1-SE01-KA220-SCH-000364528 .

To protect individual privacy while ensuring the scientific, educational, and managerial integrity of the project, user accounts on this platform operate under two distinct structural frameworks:

• School Participants and Stakeholders (Students, Teachers, and School Managers): All accounts created for school-based participants are strictly pseudonymized. No direct personal identification data, including real names, personal email addresses, or personal phone numbers, is stored on or processed through this platform. Platform accounts utilize placeholder user codes. The mapping key connecting these pseudonymous codes to actual identities is kept strictly offline, managed exclusively by authorized personnel at each participating school, and stored in separate, secure school databases.

• Project Team Members (Curation, Facilitation, and Research Team): Accounts for external and internal project creators, facilitators, researchers, and system administrators are identifiable. These accounts contain professional details (full name, institutional email address, partner organization affiliation, and administrative permissions) necessary for project curation, training delivery, technical support, and platform administration.

CORE PROJECT TOOLS AND DATA PROCESSING ACTIVITIES

Data processed on this platform is directly connected to specific educational, research, and collaborative activities under the Well3 project framework:

The "Sensor" Questionnaire

The Sensor questionnaire is administered to all participating school stakeholders (students, teachers, and school managers) to collect data and perception metrics regarding wellbeing at school. This dataset constitutes the primary research benchmark for the Well3 project, establishing initial conditions, evaluating school climate, and measuring overall project outcomes. All Sensor responses are recorded under pseudonymous account codes; external researchers and facilitators cannot link responses to individual participants.

Teacher Professional Development

Dedicated training modules, educational resources, and evaluation quizzes are provided for participating teachers. The platform processes quiz scores, submission attempts, activity completion logs, and overall course progress. All performance and progress records are linked exclusively to the teacher’s pseudonymous identifier.

Project Logbook

A dedicated Logbook tool is embedded within the platform for real-time collaboration, operational monitoring, and field reporting by the project curation team (comprising both internal school coordinators and external partner facilitators/researchers). Data processed includes observational notes, operational feedback, timestamped entries, and administrative logs.

CATEGORIES OF DATA PROCESSED

The platform processes distinct categories of data based on the user's role:

Pseudonymized Stakeholder Data:

• Login credentials (pseudonymous username, password, assigned role, and dummy/internal project email).

• Questionnaire responses and perception metrics submitted via the Sensor tool.

• Educational performance data, quiz and questionnaire responses, grades, and course completion metrics.

• System interaction logs, including login/logout timestamps, resource access records, task submissions, and forum contributions.

Identifiable Project Team Data includes also:

• Professional profile details, including full name, institutional email address, affiliation, and assigned system role.

• Operational records, including Logbook contributions, module modifications, grading feedback, forum posts, and direct support logs.

Technical and Infrastructure Data:

• Technical transmission logs, including IP addresses, browser specifications, device attributes, and access timestamps, processed automatically to ensure network communication, security, and platform stability.

PURPOSES AND LEGAL BASES FOR PROCESSING

Data processed through the platform is used exclusively to gather baseline school wellbeing data via the Sensor questionnaire, deliver training, manage project activities via the Logbook, evaluate project outcomes, conduct statistical analysis for academic publication in aggregated form, comply with European Union grant reporting obligations, and maintain system security.

The legal bases for processing under Regulation (EU) 2016/679 (GDPR) are:

• For School Participants: Processing is necessary for the performance of a task carried out in the public interest (educational and research mandate under Article 6(1)(e) GDPR), compliance with legal obligations under the EU grant agreement (Article 6(1)(c) GDPR), and/or informed consent collected offline by participating schools.

• For Project Team Members: Processing is necessary for the legitimate interests pursued by the Controller and project consortium in managing, curating, and administering the Well3 project (Article 6(1)(f) GDPR).

COOKIES AND THIRD-PARTY TECHNICAL INTEGRATIONS

This platform utilises essential first-party cookies for system functionality and privacy-restricted third-party cookies for embedded educational video streaming.

Educational videos embedded within platform modules are served via Vimeo's player infrastructure using restrictive browser privacy headers, specifically referrerpolicy="strict-origin-when-cross-origin". This configuration ensures that full page URLs are withheld, non-essential behavioral or advertising cookies are restricted, and technical buffering data is used solely for streaming delivery adapted to connection speeds. 

International transfers to Vimeo, Inc. (USA) are safeguarded under Vimeo's Data Processing Addendum (DPA), Standard Contractual Clauses (SCCs), and the EU-U.S. Data Privacy Framework.

For further technical details about Vimeo's data processing practices consult Vimeo's official cookie documentation at https://vimeo.com/cookie_list

COOKIE DETAILS:

1. MoodleSession (First-Party)

• Provider: Moodle 

• Type: Strictly Necessary

• Expiration: Session (deleted when browser closes or on logout)

• Purpose: Maintains user authentication state across page requests.

2. MOODLEID (First-Party)

• Provider: Moodle 

• Type: Functional

• Expiration: Approximately 60 Days

• Purpose: Remembers pseudonymous username on the login interface for ease of access.

3. VUID (Third-Party)

• Provider: Vimeo, Inc. 

• Type: Functional and Analytics

• Expiration: 2 Years

• Purpose: Stores non-personally identifiable player telemetry and volume or quality configurations.

4. player (Third-Party)

• Provider: Vimeo, Inc. 

• Type: Functional

• Expiration: 1 Year or Session

• Purpose: Saves player preference states such as captions and resolution adaptation.

CERTIFICATES AND MICROCREDENTIALS

Processing of personal data available in the Platform is necessary for the legitimate interests pursued by the Controller and project consortium in managing, curating, and administering the issuing of certificates.

Microcredentials can be generated by activation of the Moodle integration with https://micoo.io/. In that case, the minimum set of data required for the issuing of microcredentials will be synchronized: status of completion, certificate data, date of completion, name, surname, course descriptors, project, institution.

Please consult the Privacy and cookies Policies of micoo.io for further information:

• https://www.iubenda.com/privacy-policy/71250446
• https://www.iubenda.com/privacy-policy/71250446/cookie-policy

DATA SHARING AND RECIPIENTS

Platform data is never sold, rented, or commercialized. Access to data is strictly limited to authorized recipient categories:

1. Technical Hosting Provider and Infrastructure Processor: Technical hosting, server maintenance, database management, and platform infrastructure are provided by LearningDigital acting as a Data Processor. LearningDigital processes platform data strictly under instruction from the Well3 Consortium Coordinator acting as Data Controller to ensure system security, hosting performance, and server stability.

2. Well3 Consortium Partners and Researchers: Authorized research staff, facilitators, and project partners access pseudonymous Sensor responses, teacher progress metrics, and team Logbooks solely for project execution, facilitation, and evaluation.

3. Vimeo, Inc.: Operating as a technical video delivery provider under privacy-restricted player configurations.

4. European Union Authorities and Auditors: Authorized representatives of the European Commission or national agencies conducting statutory technical, administrative, or financial audits.

5. Micoo.io: Operating as microcredential issuer.

DATA RETENTION AND ARCHIVAL

In accordance with European Union grant regulations and auditing standards, platform records, activity logs, quiz completion metrics, team Logbooks, and Sensor questionnaire datasets will not be erased immediately upon the conclusion of active school participation.

All project records can be securely archived for a mandatory retention period of five (5) years following the final grant payment by the European Commission, unless subsequent amendments to EU framework regulations or statutory legal claims require an extended preservation period. Upon expiration of the mandatory retention period, all platform records will be permanently erased or fully anonymized.

EXERCISE OF DATA SUBJECT RIGHTS

• School Participants (Students, Teachers, and Managers): Because all platform data associated with school participants is pseudonymous, any requests to exercise data subject rights under Articles 15 through 22 of the GDPR (including access, rectification, or erasure of Sensor or quiz data) must be submitted directly to the participant's school. The participating school holds sole responsibility for managing the offline identification key and fulfilling validated requests.

• Project Team Members: Identifiable project team members may exercise their rights to access, update, or correct their personal profile and administrative details by contacting the Well3 dedicated privacy email: johan.tranborg@enkoping.se.
  

CONTACT INFORMATION

For inquiries regarding the processing of platform data or privacy management within the Well3 project:

Dedicated Privacy Email: johan.tranborg@enkoping.se