GDPR & school data

Who decides how data is used

Mapnook s.r.o. is responsible for its own website enquiries, business administration and service-security processing. A school generally decides the purposes of personal data it submits for classroom activities. Where Mapnook processes that data only on the school’s instructions, the applicable relationship and obligations must be documented.

A written controller–processor agreement may be part of a wider school service agreement. A public information page does not replace the required terms. Contact hello@viademy.com to establish the arrangements needed for your use before submitting personal data for that purpose.

Classroom data without pupil profiles

The current workflow uses staff accounts, paired devices and numbered teams. It does not require individual pupil profiles, names, dates of birth or pupil email addresses. Lesson records include teacher identity, team/device identifiers, chapter progress and timestamps.

Where a school supplies pupil information for a supported feature or an authorised support request, we may store relevant names, display names or school-issued identifiers for that purpose under the applicable school instructions and retention policy. Device labels and a school’s own records can also make activity identifiable. Use neutral labels where identification is unnecessary and avoid sensitive information.

Providing information is not blanket consent to unrelated future uses. A future identification feature must be assessed, covered by appropriate processing arrangements and reflected in the notices before it is introduced.

Hosting, access and diagnostics

The app and database are hosted on AWS in Frankfurt. The database uses encrypted storage and is not publicly accessible. The app uses authenticated school-based access and role checks; users should keep membership and device permissions up to date.

Cloudflare provides website delivery and security, Resend delivers email, and Better Stack handles app diagnostics. Error reporting is configured to reduce personal information and omit request bodies and user details; a provider may still receive connection information such as an IP address. Email and diagnostic processing can occur outside the EEA. See the privacy policy for providers, retention and transfers.

Retention, requests and incidents

Use our published retention review schedule as a starting point for your school’s requirements and contact us about shorter periods or closure. Account and lesson reviews are handled by our team, rather than an automatic age-based deletion job.

Staff can contact hello@viademy.com for data requests or to report a suspected security incident. Schools should use their own contact process for pupil or parent requests where they control the data. Applicable legal duties govern cooperation, investigation and notifications.

• Privacy and retention details
• EDPB guidance on controllers and processors