Privacy Policy and Consent to Data Processing vis-à-vis the School

Dear parents / students,
Your privacy is very important to us. As we have thus decided to use the privacy-friendly application “Sdui” from Sdui GmbH, Universitätsstr. 3, 56070 Koblenz (Germany) at our school so we can communicate more easily in day-to-day school life. To provide you and your child with an account
on “Sdui”, we need your consent. Using this type of app involves a lot of data processing. So that you are in a position to give informed consent, the following section explains what data processing will take place if you decide to set up a “Sdui” account.

Sdui itself uses CompuGroup Medical servers in Germany, where the data is ultimately processed. Should data be processed elsewhere in exceptional cases, we will inform you separately about this.

1. Information on the processing of the master data of each user: To prevent misuse of the app and to ensure transparency on who has performed which actions, the user’s first and last name must be specified, stored and displayed in the app to be able to use the app. The name must also be specified for carrying out the following actions: 1. Display in the “News” menu item, so that the author of the news (usually a teacher) can see who is on the mailing list and the users can see who the author is. Within the “News” menu item, authors can also mention other users in order to allocate tasks, for example. 2. To display a receipt and read confirmation for a “News” author. 3. Display in the “Cloud” menu item, provided that documents are stored there with the name given.

To assign the students to the appropriate groups and group chats (see 4.) and to display the timetable, information about their timetable is also saved for each student. To also assign parents to the correct groups, parents are linked to their respective children. At the end of each school year, a check is made to determine whether further storage is required in the Sdui application. Please note that retention periods in our local systems or “offline” are not affected by this.

2. Information on logging: To ensure security against attacks and to understand changes to data, logs are generated in the Sdui application. These logs are intended to ensure that the person who entered, changed or deleted the data in the program, as well the time and type of data, can be ultimately traced back. This is important so that we can clear up any discrepancies afterwards.

3. Processing of the e-mail address (optional): You can optionally enter your e-mail in the app, also using an invented name or a nickname. It is required to reset a password and cannot be seen by others. Without specifying an e-mail address, the password can only be reset by submitting a request to the IT administrator’s office.

4. Information about the use of the chat feature: The app offers a school-specific chat feature for schools that opt for it. In particular, pupils, parents and teachers should be granted the advantage of discussing organizational and/or learning-related topics at short notice. So far, such discussions have often taken place via external services such as WhatsApp, which does not guarantee adequate data protection. Sdui chat feature offers a safe in-house alternative that does not require a private mobile phone number. To prevent any misuse, the names of the users can be seen by other users when they write chat messages or recorded by administrators (mostly teachers and possibly students in special positions such as school spokesman) in groups (class association and, if necessary, interest groups such as sports club). Students and parents may only send messages or files (photos, videos, documents, etc.) (hereinafter referred to as “content”) within a chat if an administrator has approved this. The actions taken in the chat, such as exchanged content, are saved. Any specific content that has been communicated can be deleted by the author with effect for anyone. However, it cannot be ruled out that this content has already been copied, downloaded or otherwise duplicated by other users for their own purposes. To prevent misuse, a group administrator (usually a teacher) can restrict the sharing of content. The app saves all settings configured by the user for such features. To facilitate day-to-day school activities, the processing of the aforementioned data is essential for the operation of the chat feature.

5. Information about the video chat function: The Sdui app offers the possibility of video conferencing between two or more participants, using streaming audio and video data. There is also the option of using a chat feature within the web conference. To make this available, we have to process the content as well as the associated metadata (sender, recipient, etc.). These data are not recorded, and no video conference recording feature is provided for data protection reasons. Text chats are also not recorded, but are deleted after the conference has ended. In order for us to be able to assign the participants correctly, a temporary participant number is generated for each conference. It cannot be traced back to individual users after the conference. Subsequently, it can then be seen that a conference took place on a certain date and time, but it is no longer possible to determine who took part in it. We also process authentication data to ensure that only authorized persons have access to the video conference room. Whether or not certain features such as screen sharing can be used depends on the browser or operating system of the end device used for video conferencing. This information must be processed to adapt the features to the specific device used.

6. Use of push notifications: You can subscribe to push notifications in the mobile apps. This feature is provided by the respective provider of the operating system that your devices use, and is used by the app. The provider of your operating system (Apple or Google) needs to collect your personal data to make the service available to you. The legal basis for data processing is the consent that you give directly on your device.

7. Your further rights: Pursuant to the GDPR you have the following rights: Right of access in accordance with Art. 15 GDPR – Right to rectification in accordance with Art. 16 GDPR – Right to erasure in accordance with Art. 17 GDPR – Right to restriction of processing in accordance with Art. 18 GDPR – Right to object in accordance with Art. 21 GDPR. You also have the right to complain to the supervisory authority for data protection about the data processing carried out by us.

8. Information about data processing by Sdui when using the Sdui app: If you decide to use the Sdui app, Sdui GmbH, rather than our school,
will be responsible for processing your data. To achieve the utmost level of transparency, we would like to give you an overview here:

8.1 Collection of data for the provision of the services: You can use our application either via the website or directly in the Sdui app. To enable communication with Sdui, at least the following data are processed for technical reasons: IP address, browser type and browser version, where necessary, the operating system used, referrer URL,
Host name of the accessing computer and time of query. According to Sdui, these logs are stored for a time period of 14 days.

8.2 Collection of data to improve the app: To ensure that Sdui GmbH can continuously improve its app and make it more user-friendly, the app saves statistical values about the use of the features anonymously and without the possibility of tracing them back. This occurs when you accept the data transfer in the app to optimize the app. The legal basis is Art. 6(1)(a) GDPR. You can deactivate the feature at any time in the app. This makes it easier to see which menu item is affected by a higher incidence of user errors, so that this menu item can be revised. The storage of this statistical analysis is based on a legitimate interest in the continuous improvement of the app. This enables user-friendly handling and therefore does not require consent. You can object to this statistical analysis in the app settings at any time.

Comprehensive consent: With a check mark next to “Yes” and my signature, I confirm that I have read the Privacy Policy and that I agree to the processing of the data mentioned above. I can revoke my decision at any time by phone, email or post.