GDPR: your obligations and rights

Schoolysoft processes personal data of minor students and their families. As a school, you are the data controller and Schoolysoft is your data processor.

Your obligations as data controller

  1. Inform individuals: at enrolment, parents must be informed of the processing carried out (information notices).
  2. Obtain consent where required (e.g. student photos, marketing communications).
  3. Respond to individuals’ requests: access, rectification, erasure, portability — via the export and archiving tools described below.
  4. Keep a record of processing activities as required by law.

There is no single “Settings -> GDPR” screen or “My account -> Personal data” screen: GDPR tools are spread across several administration screens, detailed below.

Exporting a parent’s data

On a parent’s profile page, a GDPR export button generates a ZIP archive containing their profile, the list of their children, their invoices and the history of actions concerning them.

Exporting the school’s data (right to portability)

Administration -> Data export lets you download the school’s full dataset (students, parents, enrolments, invoices, timetable, attendance, report cards, homework log, last 1000 audit-log lines) as a ZIP, directly from the browser. Encrypted data (Art. 9 health data, national ID numbers, IBANs, MFA secrets) is replaced with a “redacted” marker and is not included. Limit: 5 exports per 30 days.

Special-category data (Art. 9 GDPR)

Health data (care plans, infirmary) is subject to reinforced protection:

  • Access limited to authorised profiles: nurse, head teacher, administration.
  • Encrypted storage.
  • Limited retention period.

Archiving and pseudonymising a student

The Administration -> Archiving & GDPR screen manages the lifecycle of student data:

  1. Archiving: students who left (graduated, transferred, withdrawn) more than 5 years ago can be archived automatically, or archived manually on a case-by-case basis.
  2. Pseudonymisation (right to erasure, Art. 17): a student must first have Archived status before they can be pseudonymised. This action replaces their personal data with a pseudonym and is irreversible.

Nothing is deleted immediately: data goes through the Archived step first, and can then be pseudonymised on request.

Contact

For any GDPR question about Schoolysoft: dpo@schoolysoft.com.