1. Introduction
Welcome to the Nori platform. This Privacy Policy explains how personal data is processed when using the platform.
The Nori platform is developed and managed by SC Aprilred SRL, headquartered in Târgu Mureș, Romania.
Educational institutions using Nori generally act as the Data Controller for children’s and parents’ data. SC Aprilred SRL generally acts as the Data Processor, processing personal data on behalf of those institutions, except where it processes its own business information (such as customer accounts, invoicing, support requests, and website administration), in which case it acts as an independent controller.
2. Categories of Personal Data
- User identification data (name, email address, role).
- Institution information.
- Child information entered by authorized users (name, group, attendance, dietary preferences and meal-related information).
- Technical information such as login records, IP address, browser type and security logs.
3. Purposes of Processing
- Providing and maintaining the platform.
- Attendance and group management.
- Meal ordering and dietary preference management.
- Communication between institutions and parents.
- Account administration and security.
- Legal compliance.
4. Legal Bases
- Performance of a contract (GDPR Art. 6(1)(b)).
- Legal obligation (Art. 6(1)(c)).
- Legitimate interests (Art. 6(1)(f)).
- Where special-category data such as dietary information is processed, the applicable GDPR provisions and instructions of the educational institution apply.
5. Children’s Data
Nori is not intended for direct use by children. Children’s data is supplied only by authorized educational institutions or, where permitted, their legal guardians.
6. Data Sharing
Personal data is shared only with the relevant educational institution, authorized users, trusted service providers acting under contractual obligations, or competent authorities where required by law.
7. Retention
Data is retained only for as long as necessary to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods are determined by the educational institution where applicable.
8. Security
Appropriate technical and organizational measures are implemented to protect personal data against unauthorized access, alteration, disclosure, or destruction.
9. Your Rights
- Right of access.
- Right to rectification.
- Right to erasure where applicable.
- Right to restriction of processing.
- Right to data portability where applicable.
- Right to object.
- Right to lodge a complaint with the competent supervisory authority.
10. Contact
SC Aprilred SRL
19 Márton Áron Street
Târgu Mureș, Romania
Email: hello@aprilred.com
11. Changes
This Privacy Policy may be updated periodically. The latest version will always be published on the official Nori website.