CURIOO LIMITED (Suite C, Level 7, World Trust Tower, 50 Stanley Street, Central, Hong Kong SAR) operates curioo.com, campus.curioo.com and the Signature Project, and is the data user responsible for the personal data described in this policy under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Where you use our services from the European Economic Area or the United Kingdom, we also act as the controller of your personal data under the GDPR and UK GDPR respectively.
CURIOOkids Studios are operated by independent licensed partners. When you enrol a child at a studio, the partner collects and holds that data as a separate data user under its own privacy notice. We receive only what section 5 describes.
Questions and requests: hello@curioo.com.
We collect the minimum needed for each service. This policy is written in plain terms because the honest answer is short.
Enquiry and contact forms: name, email, country, organisation where given, and your message. We use it to reply and, for partner enquiries, to assess a partnership. Legal basis: taking steps at your request before a contract; our legitimate interest in responding.
Account data: name, school email address, optional personal recovery email, school, country, role, password (stored hashed), licence and payment records, certification records, and which projects and downloads you have opened. We use it to run your account, deliver the licence, issue certificates, take payment, provide support and improve the curriculum. Legal basis: performance of the licence contract; our legitimate interest in securing and improving the service.
Campus holds no student data. Students do not log in and there are no student accounts or class lists. Assessment is recorded by the teacher on a tracker downloaded to the school’s own systems.
Enrolment data: the student’s name, age, country and optional email; a parent or guardian’s name, email and payment details; the student’s project idea, checkpoint submissions and portfolio; session and showcase recordings; a certificate record. We use it to run the cohort, mentor the student, issue the certificate, take payment and, with consent, feature showcase work (see section 7). Legal basis: performance of the enrolment contract entered into by the parent or guardian; consent for any use of recordings beyond the cohort.
Server logs (IP address, browser, pages requested, timestamps) kept for security and to keep the sites working. We do not use advertising trackers, and our fonts and assets are served from our own servers so that no third-party font or content network sees your visit. See the cookie policy.
Our services are marketed to parents, teachers, schools and partners. The only service in which a person under 18 gives us personal data directly is the Signature Project, and enrolment there is completed by a parent or guardian, who confirms the student’s age and consents on the student’s behalf. We do not knowingly collect personal data from a child under 13 anywhere, and where a student is under 16 the parent or guardian is our point of contact for all account matters. If you believe a child has given us data without consent, write to us and we will delete it.
We do not sell personal data and we do not share it for advertising. We share it only with:
A current list of service providers is available on request.
When you use the studio finder, you leave curioo.com for the partner’s own website, which has its own privacy notice. Partners send us aggregate figures (enrolments, retention) and, where a parent has consented under our media consent policy, photographs and video for marketing. Partners do not send us children’s personal records.
We are a Hong Kong company serving families and schools in more than twenty countries, so data is transferred internationally by nature. Where we transfer personal data from the EEA or the UK, we rely on the standard contractual clauses or the UK addendum with the receiving party. Where Hong Kong law restricts transfer, we follow the guidance of the Privacy Commissioner for Personal Data.
Signature Project sessions and showcases are recorded so that students can review them and so that mentors can assess checkpoints. Recordings are visible to the cohort, the mentor and CURIOO staff, and are deleted twelve months after the cohort ends unless the student or parent asks us to keep the showcase recording as part of the portfolio. We never publish a recording, photograph or a child’s name or work publicly without written consent under our media consent policy, and consent can be withdrawn at any time.
Under the Personal Data (Privacy) Ordinance you may ask to access the personal data we hold about you and to have it corrected. If you are in the EEA or the UK you may also ask us to delete it, restrict or object to its use, or provide it to you in a portable form, and you may complain to your supervisory authority. Campus users can export and delete their account data from Account & billing. For everything else, write to hello@curioo.com. We respond within forty days as the Ordinance requires, and sooner where we can.
Data is encrypted in transit and at rest. Passwords are stored hashed. Access to personal data inside CURIOO is limited to staff who need it for their role. If a breach affects you we will tell you and, where required, the Privacy Commissioner, without undue delay.
We will post any change here and update the date at the top. If a change materially affects how we use your data we will email account holders before it takes effect.