Who is responsible

Datanetic Solutions, Υψηλάντου 34, 153 51 Παλλήνη, VAT number EL141510855, is the controller for the data described on this page — the website, enquiries sent through it, and our contractual relationship with a school as a customer. For anything about it, write to info@schoolly.gr.

For the data entered inside the application — students, families, teachers and staff — the school itself is the controller. It decides what is collected and why; we act solely as its processor, on its instructions and under a separate data processing agreement.

Privacy and security

Protecting this data is a design decision rather than a layer added afterwards. Each school has its own isolated data space and never sees another school's records. User access is controlled per module and per action, passwords are stored only hashed and never in readable form, and all traffic to the application travels over an encrypted connection (HTTPS).

We follow practices built around privacy — asking for the minimum data needed, pseudonymisation and anonymisation where feasible, encryption in transit. Our staff access a school's data only where that is necessary for support or to fix a fault, are bound by confidentiality, and every material change to a record is written to its history.

Data is hosted on cloud infrastructure inside the European Union and backed up regularly. No service is perfectly secure, but every measure that is reasonable for a system of this size is in place.

What this website collects

Only two things. If you send the contact or demo form, we receive the name, email address, and any phone number, school name, subject and message you typed into it. Separately, your browser's IP address is looked at once per visit to guess which language to show you; the address is not stored, only the country it resolves to, and only for as long as the cache entry lasts.

The website has no accounts, no basket and takes no payments. Everything to do with subscriptions happens inside the application.

How we use your data

An enquiry is used to answer that enquiry, and for nothing else. It is not added to a mailing list, not used for advertising, and not sold or shared with anyone for their own purposes. The language guess exists so that a first-time visitor from Greece is not shown an English page.

Account and school details are used to run the service: to give you access, to answer questions, support requests or complaints, to tell you about material changes and new features, to improve the security and operation of the application, to form the agreement between us and to issue the invoices for your subscription.

To settle our accounting, financial and tax obligations, the strictly necessary details are shared with our accountants and legal advisers, who are contractually bound to process them securely and in confidence.

Student, family and staff data is never used for marketing, advertising or to train artificial intelligence models, ours or anyone else's.

The lawful basis

Answering an enquiry rests on the steps taken at your request before entering into a contract, and on our legitimate interest in responding to people who write to us. Holding the account and providing the service rest on performance of the contract between us.

Issuing and keeping invoices rests on a legal obligation. Securing the service, dealing with abuse and showing the site in a sensible language rest on our legitimate interest in a safe and usable service.

Where something requires consent it is asked for explicitly and can be withdrawn at any time — school bus location tracking in particular, which is off unless it is switched on.

How long it is kept

Enquiries are kept in our mailbox for as long as they are useful for the conversation they belong to, and are deleted after that. The country cached against an IP address expires after seven days on its own.

A school's data is kept for as long as its account exists, whether the subscription is active or has lapsed. Following a written deletion request, the account and its data are permanently deleted.

The exceptions are tax invoices and the details that accompany them, which we are required to keep for the period tax law prescribes, and anything needed to establish or defend legal claims.

Cookies

Some cookies here are strictly necessary and are set whatever you decide: the session cookie, which keeps a form you are filling in attached to you; the token that stops another website submitting our forms on your behalf; and a record of the choice you make in the cookie notice, so you are not asked again on every page. None of them says anything about you to anyone else.

Beyond those, this site uses Google Analytics to see which pages are read and where people give up. It is off until you turn it on. Nothing is loaded, no cookie is set and nothing reaches Google unless you accept analytics in the cookie notice — accepting only the essentials leaves the site with no analytics on it at all.

You can change your mind whenever you like, and doing so takes the analytics cookies away rather than merely stopping new ones. There is no advertising on this website and no advertising cookie.

The application likewise sets only the cookies it needs to keep you signed in and to protect its forms.

Third parties on this website

The map on the contact page is a Google Maps embed, and Google receives your IP address and may set its own cookies when that frame loads. It is loaded lazily, so it only happens if you scroll to it. Fonts are served from this site and not from a font CDN. The language guess queries the ip-api.com service with your IP address; it can be switched off entirely.

The contact and demo forms are protected by Google reCAPTCHA, which receives your IP address and information about how you used the page in order to tell a person from a script. It runs on those two pages only, and it runs whether or not you accept analytics, because without it the forms would be filled by bots. Google's own privacy policy and terms govern that processing, and both are linked under the form.

Google Analytics, if you accept it, receives your IP address, the pages you visited and the approximate location that address suggests. We have asked Google to shorten the address before storing it. We do not use it for advertising and we have not linked it to any advertising product.

Data inside the application

Depending on what each school chooses to record, the application may hold identity and contact details for students, parents and guardians, teachers and staff, enrolment and class details, attendance and absences, grades and assessments, financial records and invoices, messages and announcements, files and documents, and — where the school has enabled student transport — pick-up addresses and route data.

Which of these are collected, on what lawful basis and for how long, is decided by the school. The same is true of any special category data, such as health or allergy information a school may need: it is entered on the school's responsibility and lawful basis, and we simply hold it on its behalf.

We have no purpose of our own for this data. We do not sell it, do not share it with third parties, and do not use it for anything beyond running the service for the school it belongs to.

Children's data

Much of the data in the application concerns children, and it is treated accordingly. We never collect data directly from a student through advertising, sign-up or promotion; it is entered by the school as part of its relationship with the family.

The student and parent portals show only what the school has explicitly shared with that particular recipient — a document, a note or a file is not visible because it exists, but because someone shared it.

School bus location tracking, where it is used, works only with explicit consent and only for the duration of the trip.

Google and Microsoft integrations

A school can connect its own Google or Microsoft account so that the application's email goes out from its own address and its appointments appear in its own calendar. The connection is made over OAuth: we never see or store your password, only an access token that you can revoke at any time, either inside the application or from your provider's security settings.

That access is used solely to operate the application and is not shared with third parties. In calendar sync we write only inside a calendar the application creates itself; we never delete or modify your existing events or calendars.

Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who else is involved

Running the service takes a small number of providers: hosting and backup infrastructure, an email delivery service, and an electronic payments provider for subscriptions. Each acts as a processor, is bound by contract, and handles only the data its role requires.

Your card details never reach us: they are entered directly into the payment provider's environment, which returns nothing to us but the outcome of the transaction.

We do not transfer data outside the European Economic Area, unless a school asks for it by connecting a third-party service of its own, in which case that service's own safeguards apply.

If there is a breach

If we identify a data breach that could put people at risk, we notify the schools affected without undue delay, with what we know of its extent and the measures we have taken, so that they can meet their own obligations as controllers.

Your rights

You have the right to access your data, to have it corrected or deleted, to receive it in a portable, readable form, to object to our processing it, and to ask for that processing to be restricted. Where processing rests on consent, you may withdraw it at any time, without affecting the lawfulness of what was done before you did.

If you are a student, a parent or an employee at a school that uses the application, your request goes to the school, which is the controller. If it reaches us, we will pass it on and support the school technically in answering it.

For anything concerning data we control, write to info@schoolly.gr and we will answer. If you believe your request was not satisfied, you may complain to the Hellenic Data Protection Authority (www.dpa.gr) — though we would appreciate hearing from you first, because most things are resolved that way.

Changes to this policy

If this policy changes, the date at the top of the page changes with it. Material changes are also announced inside the application.

Privacy and data protection policy