EduPage & the GDPR

General Data Protection Regulation

On 25 May 2018, European data protection legislation (GDPR) replaces the 1995 EU Data Protection Directive. The GDPR strengthens the rights that individuals have regarding personal data relating to them and seeks to unify data protection laws across Europe, regardless of where that data is processed.

This document contains the measures and commitments that EduPage provides and guarantees to the schools in order to meet GDPR compliance .

What are your responsibilities?

EduPage customers act as the data controller for any personal data they provide to EduPage in connection with their use of EduPage’s services.

Data controller determines the purposes and means of processing personal data, while the data processor processes data on behalf of the data controller. aSc Applied Software Consultants s.r.o is a data processor and processes personal data on behalf of the data controller when the controller is using EduPage Cloud Platform.

Data controllers are responsible for implementing appropriate technical and organizational measures to ensure and demonstrate that any data processing is performed in compliance with the GDPR. Controllers’ obligations relate to principles such as lawfulness, fairness and transparency, purpose limitation, data minimization, and accuracy, as well as fulfilling data subjects’ rights with respect to their data.

Data controllers are required to only use data processors that provide sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the GDPR. Here are some aspects you may want to consider when conducting your assessment of EduPage services.

What can you do?

You can count on the fact that EduPage is commited to GDPR compliance.

We are also committed to helping EduPage customers with their GDPR compliance by providing robust privacy and security protections built into our services over the years.

Contract

To comply with GDPR, data controllers need to formally sign a legal agreement with data processors.

For EduPage, protection of user private data and data processing agreement is signed between school and aSc Applied Software Consultants s.r.o (creator of EduPage). The contract creation is available below.

How EduPage is commited to the GDPR?

1. EduPage stores data in secured datacenters certified by DIN ISO/IEC 27001.
2. EduPage doesn’t use any sub-processors besides the necessary server hosting and infrastructure providers to process any of school’s data.
3. EduPage never shares any of the inputted data with 3rd parties. The only exception are the exports initiated by the school. EduPage allows the schools to export data to certain government, or to other systems (security hardware, accounting systems and similar). This only happens on a direct request of the school – i.e. by pressing special export button and only the prescribed data are exported.
4. EduPage guarantees the right to be forgotten. Upon request all the data inputted by the school will be removed
5. EduPage has procedures in place that will remove the data inputted by the customer after the customer cancels the service.
6. EduPage guarantees data portability. All the data inputted by the school can be exported if the school wants to transfer them to other service.
7. EduPage data are regularly back-up and EduPage uses secured data centers to store data backups.
8. EduPage technicians signed confidentiality agreement that addresses responsibilities and expected behavior with respect to the protection of information.
9. EduPage uses tiered support levels. By default, EduPage technicians do not see the personal data inputted by the schools. This access is only activated when needed for specific support and maintenance incidents.
10. EduPage collects aggregate statistical data. These data are used to improve the quality of service.
11. EduPage implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk to secure the data and to secure the communication between customer and EduPage service
12. EduPage platform is data redundant, all your information is instantly replicated to two physical computers.
13. EduPage uses encryption to protect data in transit. HTTPS is activated by default for all users.
14. We scan for software vulnerabilities using a combination of commercially available and purpose-built in-house tools. In case of data breach, we will immediately notify the school and conduct the necessary actions to mitigate the possible negative consequences.
15. EduPage has built it user right system, data controller can assign various user rights to different user roles to make sure only the relevant people can see or modify your data.
16. Most important modules have built in history of changes, for every change it can be traced which user and when has made this change.
17. EduPage stores logfiles of the user activity for security purposes. Our technicians will assist you in security incidents analysis i.e when someone steals password of other users. All logfiles are permanently deleted after 12 months.
18. EduPage uses Google analytics service to gather the statistics about EduPage usage. Statistical information about EduPage usage is thus available to Google.
19. EduPage uses Google cloud services(mainly for push notification service)
20. EduPage uses Apple cloud services(mainly for push notification service)