Privacy Policy

Provide students/employees/clients with specific privacy policy notice about the data they collect using Wonda so that they can be completely transparent with their learners, educators and anyone who visits their site on how they collect, use or disclose their data;

protect digital minors with age-of-consent checks and manage access for minors who require parental agreement to access their learning management system;

enable users to easily request access to their data, to see the policies they’ve agreed to and appoint a Privacy officer role to manage subject access/deletion requests from such users centrally.

Our standard Data Processing Agreement (DPA) that covers all of our products and services in a concise and comprehensive Schedule 1.

Cross Border Standard Contract Clauses (SCCs) that will allow us to contract with you to ensure protection of any personal data required to be transferred outside the EEA.

Consent (Article 6.1(a) GDPR): You provide informed consent to us or have a reasonable expectation that we will use your information in a certain way – for example, to engage in our community discussions, or to hear about new services or offers.
You can withdraw your consent at any time either by selecting ‘delete my data’ within the specific service or by request to privacy@wondavr.com;

Contract (Article 6.1(b) GDPR): Providing our services and fulfilling our obligations to you, usually relating to a terms of service or partnership agreement;

Legal Obligation: (Article 6.1(c) GDPR): The necessity to meet compliance with our legal obligations; and/or

Legitimate Interest (Article 6.1(f) GDPR): We (or a third party) have a legitimate interest in processing that is not overridden by your data protection rights.
We only rely on legitimate interests after assessing both our interests and your rights.
Some purposes we consider our legitimate interests include:

Wonda generally does not seek to collect special category data about users. However, users might themselves input such data into the platform (e.g., a learner might mention their health condition or political opinion in an open text response).
In such cases, we treat it with high security and it remains under the control of the data controller (the institution). We do not use this data for any purpose except to provide the service (e.g., store it as part of the simulation record).

For our own employees, we may hold special category data (like health data for sick leaves or biometric data if any for security access) as allowed by employment laws. This is processed in accordance with applicable law and not shared externally.
​

create an individual or corporate user account;

request support;

register for or participate in an online class, exam, certification, training, webcast or other event;

request information or materials;

participate in surveys or evaluations;

participate in promotions, contests or giveaways;

make a purchase through our online payment system;

apply for employment;

submit questions or comments; or

submit content or posts on our forums or other interactive webpages

create or upload content on Wonda (for instance, building a simulation, or posting on a discussion forum within the platform), we collect the data you input. This can include text, images, audio/video recordings of your voice or likeness (if you choose to record media in the platform), etc. This content is stored on our servers as part of providing the service to you and your organization.

Usage and Device Information: We collect information about how and when you access the service. This includes device information (such as device type, operating system version, browser type, screen resolution for VR or web), log information (such as IP address, timestamps of actions, pages or features accessed, and in-app events like “user started simulation X”), and referral information (how you arrived at our site).

Cookies and similar technologies: We use cookies on our websites and application. These can be essential cookies (for login sessions, preferences), as well as analytics cookies. Cookies allow us to remember your session (so you don’t have to log in repeatedly) and to understand usage patterns. We don’t use cookies for advertising purposes to unrelated third parties. You have the ability to manage cookie preferences via our cookie banner or your browser settings.

Telemetry and Diagnostics: If the app encounters an error or crash, we may collect a crash report or error log which helps us diagnose the issue. These reports typically include technical details like device state and codes, not user content, except possibly a user ID to correlate with a session.

Enterprise or Education Clients: If your use of Wonda is provisioned by an organization (e.g., your employer or school), they may give us a roster or list of authorized users. For example, an administrator might provide a list of student emails to pre-create accounts or invite users to the platform.

Single Sign-On (SSO) Providers: If you log in via SSO (Google OAuth, Microsoft Azure AD, etc.), we get basic account info from that provider (like your verified email and name) to create or sync your profile. The exact data shared by SSO depends on what your identity provider releases to us (often it’s just name and email, sometimes an ID and group membership if configured).

Partners and Resellers: If you were referred to us by a partner or signed up through a reseller, we might receive your contact information from them (they should have obtained your permission to share it with us). We use this to onboard you to Wonda.

Social Media or Other Accounts: If you interact with our social media pages (like our LinkedIn or Twitter) or participate in an online event/webinar, we may receive your information via those platforms under their privacy settings.

To provide and maintain our Service: This includes using data to set up your account, host your content, run simulations, and ensure the platform functions as intended. For example, if you upload a video into Wonda, we process that video so it can be streamed to participants in a simulation; if you create a quiz, we store and retrieve the questions and answers during sessions.

To personalize your experience: We might use data like your role (e.g., teacher vs. student) or past activity to tailor what you see. For instance, an instructor sees an “admin” dashboard that a learner does not; or we might remember where you left off in a simulation and return you to that point when you log back in.

To improve the Service: Understanding usage patterns helps us make Wonda better. We analyze aggregated data on which features are used most, where users might get stuck, or how simulations perform. If we see many users dropping off at a certain step, we investigate if the UI needs improvement. We also use user feedback and support inquiries to identify areas for enhancement.

To communicate with you: We use contact information (email, possibly phone) to send necessary communications.
These include:

Service Providers (Subprocessors): We share data with third-party companies that we engage to perform services on our behalf (referred to as subprocessors).
These include cloud hosting providers, email delivery services, customer support software, analytics services, AI service providers (as described in other documents), etc. These subprocessors only receive the data necessary for their function and are contractually obligated to protect it and use it only for our instructed purposes. We maintain an up-to-date list of our subprocessors (see the list of the Wonda platform Subprocessors).
​
Notable examples: Google Cloud (which hosts our databases and files), Intercom (our customer support and documentation platform, which would have your email and support chat history if you use our help widget), Mailjet (which sends invitation or notification emails), and others.

Within a corporate group: If Wonda has affiliates or subsidiaries involved in providing the service, we may share data with them. For instance, if we ever establish a data center in another region operated by a Wonda subsidiary, user data might be processed there. Any such intra-group sharing is covered by internal agreements ensuring the same level of protection.

Legal Requirements: We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency). Before disclosing any information, we will verify the request’s legitimacy and scope and ensure that only the necessary data is provided. When permitted, we would inform the affected user or client of such a request.

Business Transfers: If Wonda is involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your personal data may be transferred as part of that transaction. We would ensure that the new owner or successor entity either honors this Privacy Policy or provides you notice and opportunity to exercise your rights if the policy changes.

Enforcing Our Rights or Safety: We may disclose personal data if necessary to enforce our terms and conditions or other agreements, or to investigate potential violations of those terms. We may also share information as necessary to protect the rights, property, or safety of Wonda, our users, or others. For example, exchanging information with other companies and organizations for fraud protection or to report threats and content that violates the law.
​

Storage locations: The personal data we collect is primarily stored on secure servers in the European Union (we currently use Google Cloud’s EU datacenters for primary storage).
Some data may be duplicated in other regions if a client specifically uses a service hosted elsewhere or for backup redundancy, but by default production data is in the EU.

Security measures for storage: All personal data is stored in encrypted form when at rest. For example, our databases use encryption, and our file storage buckets encrypt files on disk. Access to these storage systems is limited to authorized personnel and services (protected by network restrictions and access controls). We also implement measures like regular security audits and penetration tests to ensure our storage remains safe.

Retention periods: We keep personal data only for as long as it is necessary to fulfill the purposes for which it was collected, or as required by law or legitimate business purposes.

For instance:

Deletion and anonymization: Once the retention period is over, or if we receive a valid deletion request, we will either securely delete the personal data or anonymize it (so it can no longer be associated with a person). Anonymized data (which might be aggregated usage statistics, for instance) may be retained for analytical purposes, since it no longer constitutes personal data.

Ongoing protection: We continually update and patch our systems and storage to address new security threats. In the unlikely event of a security breach, we have incident response plans (as detailed below under “Your rights...notification of data breaches”) to promptly address and mitigate any issues.

if you explicitly sign up for our newsletter on our website, we will send you occasional emails about product news, new features, or industry insights. These emails will contain an easy way to unsubscribe (for instance, a link at the bottom of the email).

If you are an existing customer using Wonda, we might send you information about related services or upgrades that could be of interest. We strive to keep these communications infrequent and relevant. You can opt out if you prefer not to receive them.

right to withdraw consent;

right of access;

right of rectification;

right to erasure;

right of data portability;

right to restrict processing;

right to object;

right to object to automated processing, including profiling;

right to know;

right to opt out of the sale of your personal information, although we do not sell your data;

right to judicial review: in the event that we refuse your request under rights of access, we will provide you with a reason as to why;

right to be free of discrimination if you exercise your rights;

notification of data breaches; and/or

the right to lodge a complaint with a supervisory authority.

If you request a data export or deletion, we may perform identity verification by requiring you to send the request from the email associated with your account and confirming an action through a logged-in session.

For sensitive requests (like access to personal data or account deletion), we might ask for additional information if we have doubts — such as asking you to confirm some profile info we have on file, or in rare cases, providing a piece of identification. We only do this to ensure that someone else isn’t trying to impersonate you in order to get your data.

feedback from our community, customers, relevant authority, industry or other stakeholders;

changes in our products or services; and/or

data processing or policy changes.