> ## Documentation Index
> Fetch the complete documentation index at: https://help.zebrania.edu.pl/llms.txt
> Use this file to discover all available pages before exploring further.

# Personal data and the PIN

> What we collect, why we need each item, and why we ask for four digits of a PESEL.

The first thing Zebrania asks for is a first name, a last name, and **four
digits of the child's PESEL**. That is a fair moment to stop and ask: why does
this app want a piece of my child's national identification number? This page
answers that question directly, together with the rest of the data we ask for.

The formal documents are separate, and they are the binding ones:
[privacy policy](https://www.zebrania.edu.pl/en/privacy) and
[terms](https://www.zebrania.edu.pl/en/terms). This page neither replaces nor
summarises them — it explains **how and why the product is built this way**.
Who sees what, and how to delete your account, is covered by
[Privacy](/en/privacy).

## What the app needs in order to work at all

| Data                                           | Why it is needed                                                                                                                              |
| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Your email address**                         | The only way you can sign in and recover access. It also carries meeting notifications.                                                       |
| **The child's first and last name**            | The homeroom teacher has to know who the enrolment is about, and recognise the child on the class list.                                       |
| **The PIN — four digits of the child's PESEL** | It proves to the teacher that you are enrolling **your own** child, not somebody else's. Covered in detail below.                             |
| **Your phone number** (optional)               | SMS reminders before a meeting. Without a number you get email only.                                                                          |
| **The student's contact details**              | The homeroom teacher needs a current phone and email for every child in the class. You fill these in separately, after the child is enrolled. |

Everything else — after-school care, religion and ethics, pickup
authorizations, the health statement, image consent — is a **statement** you
file when you choose to. The app does not need any of it to work, and does not
collect it for itself. See
[Consents and statements](/en/parent/consents-and-statements).

## The PIN: four digits of a PESEL

### What it is, and what it is not

The PIN **is not a password**. It does not protect your account, you cannot
sign in with it, and nobody asks for it at login. It is a **shared secret**: a
number you know and that the school already holds in its own records.

The app says so right next to the field: "PIN = last 4 digits of child's
PESEL. The teacher will verify identity."

### Why a shared secret at all

Because without one, **anyone could enrol as any child's parent**.

A class code circulates in messenger groups, reaches siblings' parents,
grandparents, and sometimes further. The code alone tells the teacher nothing
about who used it. If a first and last name were enough to enrol a child, the
best case would be a mess — two records for the same child, a mix-up between
similar surnames. The worst case is considerably more serious: a stranger with
a view into your child's class and the ability to file statements in your name,
pickup authorizations included.

Four digits are the smallest thing both sides **already know** and a passer-by
does not. The teacher compares them against the register, and approves or
rejects the request.

### Why four digits and not the whole PESEL

Because a fragment is enough to check against the school's records, and a
fragment is worth far less than the whole thing.

* **We do not ask for the full number and we do not hold it.** The form has
  room for four digits; the database has a field for four digits. The full
  PESEL never reaches us — it cannot be stolen from us, because it is not
  there.
* **Four trailing digits do not identify a child on their own.** They carry no
  date of birth, and the number cannot be reconstructed from them. Outside the
  context of one specific class they say nothing.
* **They are entirely sufficient for the job.** The teacher has to confirm the
  request came from somebody who knows the child. Four digits do that as well
  as eleven.

### Why not a scanned document

Because a scanned birth certificate or ID would solve the same problem **at the
cost of a far larger pile of data**: the full PESEL, an address, sometimes both
parents' details — and all of it as a file somebody would have to store, show
to somebody, and eventually delete.

Zebrania does not accept attachments for identity verification, and does not
plan to. The same principle recurs elsewhere in the product: **a fragment of
somebody's identity earns its place only when it actually does verification
work.** That is why the authorized person's document number disappeared from
pickup authorizations — it confirmed nothing, since a different document can be
produced at the door anyway. The PIN stays, because it does its job.

### Who sees the PIN

| Who                                                  | Sees it                                                                         |
| ---------------------------------------------------- | ------------------------------------------------------------------------------- |
| **You and the child's other guardian**               | Yes — on your **My children** list, where you can also correct it.              |
| **The homeroom teacher of the class you enrol into** | Yes — in the pending-approval list, so it can be compared against the register. |
| **Other parents in the class**                       | **No.** Never, in any form.                                                     |
| **A teacher of another class**                       | **No.**                                                                         |
| **Somebody holding a link to a single meeting**      | **No.** Such a link shows the slot grid and nothing else.                       |

### How long it is kept

The PIN lives in two places, exactly like the child's name — because Zebrania
keeps **two separate records** for the same person:

* **In the child record on your list.** It is yours; you correct it, and it goes
  when the child does.
* **In the student record on the school's side.** That is a copy taken at the
  moment of enrolment. The school manages it.

<Warning>
  **Deleting your account does not delete the student record on the school's
  side** — and so it does not delete the copy of the PIN that went there. This is
  the same rule described in [Privacy](/en/privacy): the copy belongs to the
  school. Ask the school directly to correct or remove it.
</Warning>

Unlike statements, **the PIN does not expire at the end of the school year** —
the child record and the student record last as long as they are needed to run
the class.

## What the PIN replaces

The case for this design is clearest next to what it replaces. Verification has
to happen somehow; the only question is who pays for it.

| Instead of the PIN                                 | What it would cost                                                                                                                                           |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **A visit to the school, or a call to the office** | Every parent separately, during school hours. The office fields thirty calls per class in September.                                                         |
| **Slips with a code, handed out by the teacher**   | The teacher generates, prints, distributes and tracks who is missing one. A lost slip is another request to the teacher.                                     |
| **The teacher entering every child themselves**    | All of the work moves onto one person with thirty children and no time for it. The parent still has to join the finished record afterwards.                  |
| **A scanned document**                             | Solves verification, but collects far more data than needed — see above.                                                                                     |
| **A data-processing agreement with the school**    | Verification stops being necessary, because the data enters from the school's side. But then nothing moves without the head teacher's signature — see below. |

Four digits move **a small amount of work to the parent**, who is sitting at
the form anyway and knows their own child's PESEL. They take it off the
teacher, who would otherwise have to fill the class on everybody's behalf.

## Why it works this way, and not through an agreement with the school

This is the most important reason, and it is worth stating plainly, because it
explains the shape of the whole product.

In Zebrania **the data originates with you and stays yours**. When you enrol a
child, you hand your own data to a specific teacher you chose. The school as an
institution is not a party to that arrangement — there is no data-processing
agreement, no institutional onboarding, and no data-protection officer's
sign-off gating any form. [Privacy](/en/privacy) covers this at length.

That is not an oversight but a deliberate choice, and it has a concrete payoff
on the other side:

* **A school can start the same day.** A teacher creates an account, creates a
  class, and hands out the code. Nobody waits for the head teacher to read,
  sign and return a contract.
* **The service can be free.** The agreement route means selling top-down:
  reaching the director, negotiating, clearing it with a data-protection
  officer. That raises the cost of running the service to the point where it
  could not be offered free of charge.

The PIN is the price of letting verification happen **without an institution in
the middle**. Without a shared secret you would need either a contract or a
visit.

<Note>
  This page explains why the product is built the way it is. **It is not legal
  advice.** The binding documents are the
  [privacy policy](https://www.zebrania.edu.pl/en/privacy) and the
  [terms](https://www.zebrania.edu.pl/en/terms), and they take precedence if
  anything written here appears to conflict with them.
</Note>

## What the PIN does not do

The limits are worth knowing, because a field that looks like an identity check
without being one would be worse than no field at all.

* **It does not protect your account.** Signing in does that.
* **It does not verify identity at pickup.** Authorized pickup persons have
  their own list, and the check at the door rests on a name — see
  [Consents and statements](/en/parent/consents-and-statements).
* **It does not replace the teacher's decision.** A matching PIN is evidence,
  not automatic approval. A person always approves an enrolment.
* **It is not required when you join through a guardian invitation.** If the
  other parent has already enrolled the child, you join the existing record —
  see [Inviting a guardian](/en/parent/inviting-a-guardian).

## The documents

| Document           | Where                                                                |
| ------------------ | -------------------------------------------------------------------- |
| **Privacy policy** | [zebrania.edu.pl/en/privacy](https://www.zebrania.edu.pl/en/privacy) |
| **Terms**          | [zebrania.edu.pl/en/terms](https://www.zebrania.edu.pl/en/terms)     |

## What next

* Who sees what, and how to delete your account? [Privacy](/en/privacy).
* Where exactly do you type the PIN? [Children and contact details](/en/parent/children-and-details).
* What else do you file, and how do you take it back? [Consents and statements](/en/parent/consents-and-statements).
* Enrolment rejected? [Troubleshooting](/en/troubleshooting).