Privacy Policy

Last updated: October 2026

Escudo Web Software, S.L., with registered address at Calle Cerería 17, Local A, 45600 Talavera de la Reina (Toledo, Spain) — hereinafter "Escudo Web", "we" or "our" — wants you to understand how we process personal data on the iris.lugus.digital website and in the iRiS applications.

This policy complies with Regulation (EU) 2016/679, the General Data Protection Regulation (hereinafter, the "GDPR"), and with Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). Its purpose is to explain clearly what data we process, why, how we protect it and what rights you have.

1. Introduction and scope

This policy covers two different areas, in which Escudo Web plays a different role:

• The iris.lugus.digital website (the "iRiS Pages"). Here Escudo Web is the data controller.
• The iRiS applications: iRiS School (Chrome extension for students' Chromebooks), iRiS Teacher (classroom manager for teachers), iRiS Dashboard (console for the school's IT administrators) and iRiS Parental Interaction (app for families on Android and iOS), hereinafter the "iRiS Services". Here Escudo Web acts as data processor on behalf of the school, which is the data controller.

Your privacy, and especially the privacy of the minors who use iRiS, is truly valuable to us. We are committed to protecting it at all times.

2. What personal data do we process, and why?

When we use the term "personal data" in this policy, we mean any information that identifies a person, either directly or in combination with other information.

2.1. The iris.lugus.digital website

The iRiS Pages are informational: they contain no forms, set no cookies and use no analytics or advertising tools.

Like any web server, ours keeps a technical record of the requests it receives: source IP address, date and time, page requested and browser type. These logs are used solely to keep the site secure and working properly, on the basis of our legitimate interest [Article 6(1)(f) GDPR], and are kept only for as long as that purpose requires.

If you contact us through the form on escudoweb.com, that processing is governed by the escudoweb.com Privacy Policy.

2.2. iRiS Services

For iRiS School, iRiS Teacher and iRiS Dashboard to work, the following data about users is processed:

• First name and surname.
• School and iRiS project they belong to, year and class group.
• Email address of the school account.
• Secondary email address (parents or legal guardians), when the school enables parental interaction.
• Identifier and status of the assigned device.
• History of IP addresses from which the user has connected.
• Image of the student's device screen, shown to the teacher during class for classroom management.
• Browsing and video viewing history (optional: only if the school enables it).
• Device geolocation history (optional: only if the school enables it), to locate a lost or stolen device.

The iRiS Parental Interaction app, which only works if the school enables it, also processes:

• Email address of the parent or guardian and access PIN code.
• Link to the child's school device, made by scanning a QR code.
• Settings chosen by the family: browsing modes, list of allowed and blocked sites, rest periods and the "Listen to me, please!" feature.
• Location of the child's device outside school hours (optional: only if the school allows it and the family uses it).

The app requests the following phone permissions: camera, to scan the linking QR code; storage, to export the settings to a file; and location, to show the phone's position on the geolocation map. If a permission is refused, the related feature will not be available.

School directory data. So that users do not have to be registered again, iRiS imports organisational units, users, groups and devices from the school's Google Workspace domain through the Google Admin SDK. The sole purpose of this import is to make the tool easier to use.

Purpose and legal basis. This data is processed solely to provide the iRiS Services contracted by the school — classroom management, Internet filter, learning path, digital wellbeing and parental interaction — in performance of the contract with the school [Article 6(1)(b) GDPR] and in accordance with its instructions as controller.

2.3. Limited use of Google API data

iRiS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use this data only to provide and improve the iRiS features that the school can see.
• We do not transfer it to third parties, except where necessary to provide the service, to comply with the law or as part of a merger or acquisition, with the same safeguards.
• We do not use it for advertising or to build commercial profiles.
• No person reads it, except with the school's consent, for security purposes or where required by law.

2.4. Users under the age of majority

Many iRiS users are minors. The school that contracts iRiS is responsible for informing families and, where applicable, obtaining the consent of parents or legal guardians, and for preventing the use of features that require it when it has not been obtained.

3. Disclosure of personal data

Escudo Web does not and will not disclose personal data to third parties, except when required by the courts, the Public Prosecutor or the competent authorities, as provided by law.

We do not sell, rent or trade personal data, nor do we use it for advertising or profiling unrelated to the contracted services.

3.1. Service providers (sub-processors)

To provide the iRiS Services we use providers that access data on behalf of and under the instructions of Escudo Web, bound by a contract in accordance with Article 28 GDPR:

• Google Cloud: main infrastructure, with servers in the European Economic Area.
• Arsys Internet, S.L.: contingency infrastructure, with servers in Spain, activated only if the main infrastructure fails.
• Authorised distributors: when the school acquires iRiS through a distributor, its technical staff only access the Dashboard temporarily, when the school requests and enables it.

This access does not constitute a disclosure of data. Each school's sub-processors are listed in its data processing agreement.

3.2. Third-party services

We are not responsible for the privacy practices of other organisations — such as Google or Apple, or the websites students visit — which have their own policies. Including a link on the iRiS Pages does not mean we endorse the linked site.

3.3. Cookies and other tracking technologies

The iris.lugus.digital website does not use cookies, either its own or third-party, nor the browser's local storage, nor analytics or advertising tools. For that reason you are not asked for any consent when you visit.

4. How do we protect personal data?

4.1. Security measures

We apply organisational, technical and administrative measures to protect personal data, including encrypted communications and access control. However, no system can guarantee absolute security. If you believe your interaction with us is no longer secure, please let us know immediately through the channels in section 7.

4.2. Retention period

iRiS Services data is kept while the contract with the school is in force and, when it ends, is deleted or returned to the school according to its instructions.

Browsing and geolocation history, when enabled by the school, is kept for between 7 and 30 days, as configured by the school's IT administrator, and is deleted automatically once that period has passed. The family app only shows data for the number of days set by the school.

4.3. Data location: no international transfers

Escudo Web does not carry out international data transfers. All personal data is stored and processed entirely on servers located within the European Economic Area (EEA), subject at all times to the GDPR. We require the same of our providers: data is not transferred, hosted or replicated in third countries.

5. Your rights and choices

You may at any time request access to your personal data, its rectification or erasure, the restriction of or objection to its processing and data portability, and you may withdraw any consent given.

If you use the iRiS Services (as a student, teacher or family), please contact your school first, as it is the controller. If you write to us directly, we will forward your request to the school without delay.

For any other request, write to rgpd@escudoweb.com. We will respond within one month of receipt. We may need to verify your identity before processing it.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the competent supervisory authority in your country.

6. Information for parents and guardians

iRiS is designed for educational settings with minors. The iRiS Parental Interaction app is only enabled if the school decides so, and it is the family that configures it on their own phone for the time outside school hours.

We encourage you to take an active part in your children's digital life. If you find that data about a minor in your care has been processed without the necessary authorisation, please tell your school or write to rgpd@escudoweb.com.

7. How can you contact us?

If you have any questions about this policy or about how Escudo Web processes personal data, you can write to rgpd@escudoweb.com, contact our data protection officer at dpd@escudoweb.com or write to Calle Cerería 17, Local A, 45600 Talavera de la Reina (Toledo, Spain).