Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy explains how Pascal Education (Cyprus) Ltd processes personal data in connection with the Pascal Canteen App on Android and iOS, the related school canteen web portal and the supporting services used to operate student accounts, orders and payments.

2. Data Controller and Contact Details

Pascal Education (Cyprus) Ltd is the data controller responsible for the personal data described in this Privacy Policy. Its address is Pascal, 177 Kopegchagis Street, 2306 Lakatamia, Lefkosia, Cyprus.

Privacy enquiries and requests may be sent to info@pascal.ac.cy. Messages sent to this address with the subject line “Data Protection Request” are forwarded to the school Data Protection Officer. The name of the individual acting as Data Protection Officer is not published in this Privacy Policy; the role can be contacted through the email address above.

3. About the Pascal Canteen App

The Pascal Canteen App allows authorised students to sign in using credentials issued by the school, view available food and drink products, pre-order items for school breaks, complete payments for physical school meals through Viva.com, and view upcoming and previous orders. Users cannot create accounts inside the app. Student accounts are created and managed by the school, and authorised parents or guardians may manage relevant account information through the related web portal.

4. Personal Data We Process

We may process student and account information including the student’s name, user ID, gender, request or interface language, school account status, spending limits and other settings required to operate the canteen service.

We may process contact information associated with the account. This can include a parent or guardian email address and a parent or guardian phone number. The phone number is used only for one-time-password authentication and account-access verification. It is not sent to Viva.com.

We may process allergy information supplied by a parent, guardian or authorised school administrator. The information is linked to the relevant student account and is used to hide or restrict products containing relevant allergens.

We process order and purchase information including products ordered, quantities, order dates and times, school-break information, meal codes, order status, amounts, account balance information and order history.

Payment-card details entered during checkout are handled by Viva.com. Pascal Education (Cyprus) Ltd and the Pascal Canteen App do not receive or store full payment-card numbers or CVV codes. We may receive and retain limited payment metadata, including masked card details, card references, transaction identifiers and payment status, so that payments can be matched to orders and records can be maintained.

For security and technical operation, web-server, application or hosting logs may contain an IP address, a device identifier, browser information and operating-system information. These log entries are not stored together with, and are not technically linkable to, a user ID, username, email address, session ID, order ID or authenticated account.

We may also process communications and requests sent to the school concerning account support, access, correction, privacy or deletion.

5. How We Obtain Personal Data

Personal data may be obtained from the school when an account is created or administered; from a parent, guardian or authorised school administrator through the web portal or school processes; from the student’s use of the app; from Viva.com in the form of payment status and limited transaction metadata; and automatically through technical and security logs needed to operate and protect the service.

6. Why We Use Personal Data

We use personal data to create, maintain and authenticate school-issued student accounts; send one-time passwords to a parent or guardian phone number; display menus and enable canteen orders; apply spending limits and other authorised account settings; hide or restrict products based on recorded allergy information; process payments for physical school meals through Viva.com; confirm payment and order status; display upcoming orders and purchase history; provide support; investigate errors or suspected misuse; maintain service and information security; and comply with legal, tax, accounting, audit, safeguarding and dispute-resolution obligations.

7. Legal Bases for Processing

We process personal data only where an appropriate legal basis applies. Depending on the activity, the legal basis may include the performance of services provided through the school, compliance with legal obligations, and the legitimate interests of Pascal Education (Cyprus) Ltd in operating, administering and securing the school canteen service. Where allergy information constitutes special-category personal data, it is processed only where an applicable condition under data-protection law is satisfied, such as explicit consent or another legally available condition confirmed by the school Data Protection Officer.

8. Allergy Information and Children’s Data

The app is used by students, including children. Allergy information may be provided by a parent, guardian or authorised school administrator and is linked to the relevant student account. It is used only to support the operation of the canteen service by hiding or restricting products containing relevant allergens. It is not used for advertising, tracking or marketing, and the app does not provide medical diagnosis, treatment or medical advice.

Parents and guardians should ensure that allergy information is accurate and kept up to date. The app is not a substitute for the school’s safeguarding, medical or emergency procedures.

9. Payments and Viva.com

Payments in the app relate to physical school meals and are processed through Viva.com. When a user selects manual card payment, card details are entered directly in the Viva.com payment environment. Pascal Education (Cyprus) Ltd and the Pascal Canteen App do not receive or store the full card number or CVV. Limited payment metadata may be received and retained, such as masked card details, a card reference, a transaction identifier and payment status.

Viva.com processes payment information under its own privacy and security terms. Users should review the information presented by Viva.com during checkout.

10. Who May Receive Personal Data

Personal data may be accessed only where necessary by authorised staff of Pascal Education (Cyprus) Ltd who administer accounts, school canteen orders, support, finance, security or compliance. It may also be processed by authorised technical service providers that support the hosting, development, maintenance, security and operation of the app and related portal under appropriate contractual and confidentiality obligations.

Viva.com receives the information necessary to process payments and return transaction status. Personal data may also be disclosed to professional advisers, auditors, insurers, competent authorities or courts where required by law or where necessary to establish, exercise or defend legal claims.

11. International Transfers

Where a service provider processes personal data outside the European Economic Area, Pascal Education (Cyprus) Ltd requires an appropriate transfer mechanism and safeguards in accordance with applicable data-protection law.

12. Data Retention

Student account information, parent or guardian contact details and allergy information are retained while the student remains actively enrolled at Pascal Education (Cyprus) Ltd. This allows parents or guardians to update only information that has changed instead of submitting the same information again each academic year. When the student is no longer actively enrolled, this information is deleted or anonymised unless continued retention is required by law.

Order history, payment transaction references and related accounting records are retained for up to seven years for legal, tax, accounting, audit or dispute-resolution purposes.

Technical and security logs, including IP address, device identifier, browser and operating-system information, are retained for up to one month. After that period, they are deleted, overwritten or anonymised in accordance with the organisation’s security procedures.

Backup copies may be retained for up to one year. They are then deleted or overwritten in accordance with the organisation’s backup procedures. Backup data is used for recovery, continuity and security purposes and is not used for ordinary account operations.

Personal data may be retained for longer only where necessary to comply with a legal obligation, investigate a security incident, protect the rights and safety of students or other users, or establish, exercise or defend legal claims.

13. Data-Protection Rights

Subject to applicable law, a parent, guardian or another authorised person may request access to personal data held about the relevant student account; correction of inaccurate or incomplete information; deletion of personal data where the legal requirements for deletion are met; restriction of processing in certain circumstances; objection to processing based on legitimate interests; data portability where applicable; and withdrawal of consent where processing is based on consent, without affecting processing carried out before withdrawal.

Requests must be sent to info@pascal.ac.cy with the subject line “Data Protection Request”. Requests are handled manually. Before acting on a request, the school may verify the requester’s identity, authority and relationship to the relevant student account using information already held by the school. Where necessary, confirmation may be requested from the parent, guardian or authorised school administrator.

Once a request has been verified, Pascal Education (Cyprus) Ltd will assess and process it in accordance with applicable law. Where only part of the account information has changed, the parent or guardian may request correction of that information without creating the student account again. Personal data will not be deleted where continued retention is required for legal, tax, accounting, safeguarding, security or dispute-resolution purposes.

We will respond without undue delay and normally within one month of receiving a valid request. Where a request is complex or numerous, the response period may be extended where permitted by law, and the requester will be informed.

14. Account Deactivation and Deletion

Users cannot create accounts inside the app. Accounts are created and managed by the school. Requests to deactivate an account or delete associated personal data must be submitted manually to info@pascal.ac.cy. The school will verify the requester’s identity and authority before making changes to a student account. Deletion does not apply to records that must continue to be retained for legal, tax, accounting, safeguarding, security or dispute-resolution purposes.

15. Security

We use appropriate organisational and technical measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access is limited to authorised persons who need the information for their duties. No method of electronic storage or transmission can be guaranteed to be completely secure.

16. Advertising, Analytics and Tracking

The Pascal Canteen App is not intended to display third-party advertising, perform cross-app tracking or use personal data for targeted advertising. The reviewed app configuration does not use advertising, analytics or tracking SDKs. The technical and security logs described in this Privacy Policy are used for service operation and security, are retained for up to one month and are not technically linked to authenticated user accounts.

17. Complaints

We encourage you to contact the school Data Protection Officer first at info@pascal.ac.cy so that the concern can be addressed. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or another competent supervisory authority.

The Office of the Commissioner for Personal Data Protection is located at 15 Kypranoros Street, 1061 Nicosia, Cyprus. Its postal address is P.O. Box 23378, 1682 Nicosia, Cyprus, its telephone number is +357 22818456, and its website is https://www.dataprotection.gov.cy/.

18. Changes to This Privacy Policy

We may update this Privacy Policy when the app, related services, legal requirements or processing activities change. The updated version will be published at https://bitespsc.pascal.ac.cy/application/privacy-policy and will show the date of the latest revision. Material changes may also be communicated through the app, the related portal or school communication channels where appropriate.

19. Contact Us

For questions about this Privacy Policy or the processing of personal data, contact Pascal Education (Cyprus) Ltd at Pascal, 177 Kopegchagis Street, 2306 Lakatamia, Lefkosia, Cyprus, or email info@pascal.ac.cy. For privacy requests, use the subject line “Data Protection Request”.