Privacy policy
Draft: the parts in [brackets] are to be completed before Schooma goes live.
1. Who is responsible
Each school is the controller of the personal data of its students, parents and staff. [Company name] processes this data on the school's behalf. For the data of people who register a school or contact us, [company name] is the controller.
2. What data is processed
Names, contact details, dates of birth, school records (classes, timetables, roles), sign-in details and records of access. Sensitive data only where the school enters it.
3. Why
To run the school's work in Schooma, to sign people in securely, to keep a record of access to sensitive data, and to provide support.
4. Where the data is kept
In data centres in [the European Union – provider and location]. Passwords are stored only as secure hashes; sensitive fields are encrypted.
5. How long
As long as the school uses Schooma and as the school decides; after the school leaves, its data is removed [within N days]. Records of access are kept for [N years].
6. Your rights
You can ask for access to your data, its correction or deletion, restriction of processing and data portability, and you can complain to [the supervisory authority]. Requests about a school's data are best sent to the school.
7. Contact
[Contact email / data protection officer]