How we handle your personal data
Minimal data. Never sold.
This policy explains what personal data we collect on our website and on TEEI Language, TEEI Mentorship and Skills Academy, why we collect it, and how we protect it. We follow GDPR standards for all users regardless of location, and we never sell your information.
Data controller
Who we are.
The Educational Equality Institute (TEEI) is an international nonprofit organisation dedicated to expanding education access for girls, women, and communities affected by war and displacement. Our motto is Pathways to Independence.
Norway Headquarters
The Educational Equality Institute, 5th Floor, 28 Nydalsveien, 0484 Oslo, Norway. Organisation Number: 928 776 719. This is the data controller.
United States 501(c)(3)
The Educational Equality Institute Inc., 100 Church Street, New York, NY 10007, USA. EIN: 33-2331817.
As an organisation headquartered in Norway and serving learners across Europe, we comply with the General Data Protection Regulation (GDPR). We extend these protections to all users regardless of location.
Scope
Which TEEI services this policy covers.
This policy covers our website and our three platforms for learners and volunteers. Where a section applies to only one of them, it says so.
The TEEI website
theeducationalequalityinstitute.org, including the donation, volunteer, partner and blog pages.
TEEI Language
language.theeducationalequalityinstitute.org
TEEI Mentorship
mentorship.theeducationalequalityinstitute.org
Skills Academy
skills.theeducationalequalityinstitute.org
Evenhall, our platform for companies that run volunteering programmes with us, has its own privacy notice and does not send data to PostHog.
The detail
What we collect, why, and for how long.
We collect different types of information depending on how you interact with us. We follow a principle of data minimisation, collecting only what is necessary for our educational mission.
Learner and mentee registration
Core serviceData collected when you register as a learner or mentee on our platforms.
- Name and email address
- Phone number (for account verification and session reminders)
- Country of residence and time zone
- Languages you speak and want to learn
- Professional background and learning goals
- Session history and course progress
Privacy by design: Learner and mentee profiles are private. Your personal details are never publicly listed. Only mentors you choose to connect with can see the information needed to schedule and conduct sessions.
Volunteer mentor registration
Core serviceData collected when you register as a volunteer mentor or language partner.
- Name, email address, and phone number
- Professional affiliation and LinkedIn profile (for verification)
- Areas of expertise and languages spoken
- Availability schedule
- Photo and biographical information (displayed on your public mentor profile)
- Session statistics and learner reviews
Donations
When you donateData collected when you make a donation to support our programmes.
- Name and contact information
- Payment details (processed securely by our payment partners; we do not store full card numbers)
- Donation history for tax receipt purposes
- When a donation completes, Google receives the amount, the currency and a donation reference, so we can see which ads lead to donations. Without your yes to Marketing this is sent without cookies. We never send Google your name or email address.
Visits to our website
Automatic and by choiceWhat happens when you visit theeducationalequalityinstitute.org. The cookie banner has three optional switches, Analytics, Marketing and Functional, and the Cookie Policy names every cookie and storage key.
- On every visit. Our server counts the page you open, with the time, your browser's identifying text (the user agent) and the page you came from. It stores no IP address and sets no cookie for this count.
- Before you answer the banner. Google's tag for Google Ads and Google Analytics loads on our live site when you first touch, scroll or press a key, or after 30 seconds. Until you accept, it sets no cookies and saves nothing on your device. It still sends Google a short signal marked "consent denied". The signal carries the page address and title, the page you came from, your screen size and language, browser and device details, and a random identifier made in your browser and not saved. Like every request to Google, it carries your IP address. The same happens after you decline.
- With Analytics on. PostHog records the pages you view, the buttons you use on some pages and the steps you take in some forms, for example that a contact form was sent, never what you wrote. It does not capture every click. It can record your visit as a session recording and a heatmap, with everything you type masked; recordings include the browser's console messages. Hotjar records how you move through pages, including clicks, scrolling and mouse movement, for heatmaps and recordings. Google Analytics sets its cookies. Sentry receives reports of errors in the page, with the page address and browser details.
- With Marketing on. Google Ads can link a donation or signup to the ad you clicked. We keep the ad click reference in a cookie for 90 days. When you follow a signup link to one of our platforms, we record the click on our server with that reference and keyed hashes of your IP address and browser. Without Marketing, we remove an ad click reference from the address bar and store nothing on this site; it only goes along when you click a signup link to one of our platforms, which keep it as described below.
- Donation forms and matching gifts. The Fundraise Up donation form loads only on our donation pages. It loads when you first scroll, click, move the mouse or touch the screen, or after 15 seconds, and sets its own cookies. On our workplace giving page, Double the Donation's employer search loads shortly after the page opens. Neither waits for your answer to the cookie banner.
- Forms. Some forms use Cloudflare Turnstile to tell people from automated traffic. It loads when you start using the form and processes your IP address and browser details.
- Newsletter. When you sign up, we store your email address, the details you give, your IP address and your browser's user agent in our database. Your email address, details and IP address also go to a Google Sheet our team uses. Our server also tells PostHog that a signup happened, under a random subscriber number, with the subscriber type, language and programme. This does not depend on the cookie banner.
- Your cookie choice. Each answer you give the banner is logged on our server with the page, your browser's user agent and a keyed hash of your IP address, so we can show that we honoured it.
We do not intentionally collect sensitive personal data such as health information, political opinions, or religious beliefs. If you voluntarily share such information during mentoring sessions or in your profile, we treat it with heightened protection.
Using TEEI Language, Mentorship and Skills Academy
PlatformsThe platforms ask for your own choice about analytics and Google Ads. Here is what happens with and without it.
- Product analytics, only after you accept. PostHog records the pages you open, without the part of the address after a question mark, and the actions you take. It records where you click, without the text of what you clicked, heatmap clicks and scrolling, and how fast pages load. It also records clicks that lead nowhere, error messages from the browser console, and your device, browser and screen size.
- After you sign in. Those events carry an account reference instead of your name or email address, with your role, the app language and how you joined. The reference is a code calculated from your email address. It is pseudonymous, not anonymous: anyone who knows your email address could calculate it.
- Session recordings. PostHog can record how you move through a platform, with what you type and the text on screen masked. Video rooms are never recorded.
- Milestones from our servers. Our servers tell PostHog about key steps, such as an account created or verified, a booking made or a session completed, under the same account reference. We do this whether or not you accepted analytics, to see where people get stuck. You can object by writing to privacy@theeducationalequalityinstitute.org, and we then stop these events for your account.
- Google Ads, only after you say yes. Google's tag loads only after a yes. If you arrived from a Google ad, our server keeps the ad click reference with your account. It sends the reference to Google with a conversion, such as an account verified, a volunteer verified or a session completed, only after your account has said yes. We never send your email address to Google.
- Error reports. When something breaks, Sentry receives an error report with the page, browser details and your account reference. This does not wait for a choice, because we need it to fix faults. The reports are stored in Sentry's EU region in Germany.
How we use your data
PurposesEvery use of personal data is tied to a specific purpose. Here is what we do and why.
| Purpose | What we use |
|---|---|
| Delivering our programmes | Account details, learning preferences, session history to match you with mentors, schedule sessions, and track progress |
| Platform operations | Email and phone for account verification, password resets, and session notifications |
| Improving our services | Usage data from PostHog and Hotjar, under a pseudonymous account reference or none, with what you type masked, to understand how our website and platforms are used and where people get stuck |
| Fixing errors | Error reports from Sentry with the page, browser details and, on the platforms, your account reference |
| Measuring our ads | Google Ads and Google Analytics data that links a visit, donation or signup to the ad that brought you, with cookies only after your yes |
| Safeguarding | Screening volunteer applications, session logs for protection of vulnerable learners |
| DataCamp learner survey | If you received DataCamp access through TEEI: your survey answers, kept with your name and your DataCamp activity (learning hours, courses completed), to evaluate the programme and to show you what you shared on your personal link. You agree to this before you start, and you can withdraw your agreement at any time by writing to privacy@theeducationalequalityinstitute.org; we then delete your answers. DataCamp and other partners receive group summaries only, never your own answers or your name. Taking part is voluntary and does not affect your access to TEEI programmes. |
| Reporting to funders | Aggregated statistics only (e.g., "8,000+ learners served"). Never individual data without consent. |
| Communications | Email address for programme updates, newsletters (only with your consent), and essential service messages |
| Legal compliance | Financial records for tax and regulatory requirements |
We will never: sell your personal information; share individual learner data with funders or corporate partners without explicit consent; contact you for marketing without your permission.
Some decisions are automated. TEEI Language checks eligibility automatically from the country a learner says they are from and, for learners not from Ukraine, the gender they give. Learners outside the current audience are placed on a waiting list. TEEI Language volunteer applications can be approved after automated screening. To ask a person to review a decision, write to privacy@theeducationalequalityinstitute.org.
Legal basis for processing
GDPR Article 6Under GDPR, we process your data based on the following legal grounds.
| Ground | When it applies |
|---|---|
| Contract | Processing necessary to provide you with our educational services when you register |
| Consent | For optional communications like newsletters; for your answers to the DataCamp learner survey, which you agree to before you start and can withdraw by writing to privacy@theeducationalequalityinstitute.org; and for any use of your story or testimonial, including a story you share in the DataCamp learner survey, which you can withdraw through your personal link; and for analytics and advertising cookies and recordings in your browser: PostHog, Hotjar, Google Analytics and Sentry on our website, PostHog on the platforms, and Google Ads on both |
| Legitimate interests | For improving our services, preventing fraud, and ensuring platform security, balanced against your rights. This covers the page count on our website, which uses no cookies; Google's signal without cookies before you answer the banner; the newsletter signup events and the platform milestones our servers send to PostHog; error reports from the platforms to Sentry; the log of your cookie choices; and Cloudflare's security checks. You can object to any of these by writing to privacy@theeducationalequalityinstitute.org. |
| Legal obligation | For financial record-keeping and regulatory compliance |
Where we rely on consent, you can withdraw it at any time: on our website in Cookie Settings, on the platforms by changing your choice there, or by contacting us.
Cookies and tracking
See full policyWe use cookies and similar technologies, such as your browser's local storage, on our website and platforms.
| Type | Purpose | Your control |
|---|---|---|
| Essential | Sign-in, security and remembering your cookie choice | Cannot be disabled |
| Analytics | PostHog, Hotjar and Google Analytics cookies and storage; on our website, Sentry error reports also wait for this switch | Off until you say yes |
| Marketing | Google Ads cookies that link a donation or signup to an ad | Off until you say yes |
| Functional | On our website, passes your answer to Google's tag; your language choice and similar preferences are kept in your browser without a switch | Cookie Settings |
We use Google Ads advertising cookies only after you say yes to Marketing, and we never sell data to advertisers. A few things do not wait for the banner: our page count without cookies, Google's signal without cookies, the Fundraise Up donation form with its own cookies, and Double the Donation on our workplace giving page. You can manage your choices in Cookie Settings or in your browser settings. The full Cookie Policy names every cookie.
Data retention
How long we keep itWe keep your data only as long as necessary for the purposes described in this policy.
| Category | Retention period |
|---|---|
| Active accounts | Data is retained while you use our services |
| Inactive accounts | We may delete accounts after 3 years of inactivity, with notice |
| Donation records | Retained for 7 years as required by tax regulations |
| DataCamp survey answers | Up to 24 months after the survey closes, then anonymised, or deleted sooner if you withdraw your agreement |
| DataCamp stories | While your permission lasts, 24 months from your choice, or until you withdraw it |
| PostHog analytics events | 1 year, then deleted. Events recorded before 12 September 2026 also hold the IP address and approximate location they were recorded with, until they are deleted |
| PostHog session recordings | 30 days |
| Your cookie choice on our website | Kept in your browser for up to 1 year, then we ask again |
| Aggregated statistics | Retained indefinitely for reporting and research (no personal data) |
When data is no longer needed, we securely delete or anonymise it.
Protection
How we keep data safe.
We implement robust security measures aligned with industry best practices, and take extra care for vulnerable populations.
Encryption
Data is encrypted in transit (TLS) and at rest.
Access controls
Staff access to personal data is limited to those who need it for their role.
Verification
Volunteer mentors are verified through corporate email and LinkedIn profiles.
Platform security
Our technology partners maintain their own security certifications and audits.
Incident response
We have procedures to detect, investigate, and report data breaches within 72 hours as required by GDPR.
Vulnerable populations
We recognise that many of our learners are refugees, internally displaced persons, or others in vulnerable situations. We design our systems with their safety in mind, keeping mentee profiles private, limiting data collection, and ensuring that participation in our programmes cannot be used to identify or locate individuals at risk.
Children under 18
Our mentoring and language practice platforms are for adults aged 18 or older. Nobody under 18 can create an account on TEEI Language or TEEI Mentorship or take part in sessions.
Vulnerable adults
We apply heightened data protection standards: minimal data collection, private-by-default profiles, no public identification without explicit consent, staff training on working with vulnerable populations, and clear pathways to report concerns.
International data transfers
TEEI serves learners across Europe, Ukraine, and beyond. Some of our technology partners process data outside the European Economic Area (EEA). PostHog stores our analytics data in the United States, and we send it under our data processing agreement with PostHog, which includes the EU Standard Contractual Clauses. Google and Cloudflare rely on the EU-U.S. Data Privacy Framework, and Fundraise Up states that its data processing addendum includes the Standard Contractual Clauses. Hotjar and Sentry store the data we send them in the EU. For other transfers we use adequacy decisions or Standard Contractual Clauses (SCCs), with technical measures including encryption and access controls. Our US entity operates under the same privacy standards as our Norwegian headquarters.
Your rights
Access, correct, or delete. Your call.
Under GDPR and our commitment to transparency, you have the following rights.
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectification
Ask us to correct any inaccurate or incomplete data.
Right to Erasure
Request deletion of your personal data (subject to legal retention requirements).
Right to Restrict Processing
Ask us to limit how we use your data in certain circumstances.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests, such as the milestone events our platform servers send to PostHog, or to direct marketing. Write to privacy@theeducationalequalityinstitute.org; for the platform milestones, we then stop them for your account.
Right to Withdraw Consent
Withdraw any consent you have given, at any time. On our website, open Cookie Settings: switching Analytics off stops PostHog and Hotjar and deletes their cookies. On the platforms, change your choice there.
Right to Complain
Lodge a complaint with a supervisory authority. The Norwegian Data Protection Authority (Datatilsynet), P.O. Box 458 Sentrum, 0105 Oslo, Norway: www.datatilsynet.no.
To exercise any of these rights, submit a data request or contact us at privacy@theeducationalequalityinstitute.org. We will respond within 30 days.
Questions
Ask us directly.
Questions about this policy or your personal data go to privacy@theeducationalequalityinstitute.org, or by post to The Educational Equality Institute, 5th Floor, 28 Nydalsveien, 0484 Oslo, Norway. We will respond to your message. For data rights requests, we will respond within 30 days as required by GDPR.
We may update this policy to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will update the date at the top of this page, notify you by email if you have an account with us, and post a notice on our website.
This policy is also available in Ukrainian.