What we know about you, and why.

1. Who is responsible

Nullbase ApS (CVR 37283681), Rougsøvej 1, 8950 Randers SØ, develops and runs Lerlo. You can write to us at kontakt@lerlo.dk.

For the website lerlo.dk (the public pages, log in and account creation), Nullbase ApS is the data controller.

For Lerlo as a service – what a school uses after logging in – the school or the municipality is the data controller, and Nullbase ApS is the data processor. We process the information only to deliver the service and only on the school's instructions, as set out in the data processing agreement. Questions about your child's or your own information in a school's Lerlo should therefore be directed to the school.

2. The website lerlo.dk

Visitor counts

We count visits to the public pages and to log in and sign up with Plausible, an EU-hosted tool without cookies. Your IP address and your browser's characteristics are passed through our server to Plausible to count unique visits; neither we nor Plausible store them. The pages inside Lerlo are not counted. We send no information to anyone else, and nothing is loaded from third parties – no fonts, scripts or pictures from other domains.

Cookies

The website sets only technical cookies: a session cookie when you log in; a cookie that protects forms against forged submissions (CSRF); a cookie with your choice of language, if you switch language; and a cookie that keeps you on the same server during an update. None of them is used to track you, and there is no consent banner, because there is nothing to consent to.

The contact form

If you write to us through the form, your name, your email address, the school if you give it, and your message are sent as an email to kontakt@lerlo.dk. We store it nowhere other than in our mail system and use it only to reply to you. We briefly keep a count per IP address to limit automated submissions.

Accounts

If you create an account, we store your email address, your name, a hash of your password and what you set up yourself: two-factor, language and theme. Emails are sent only about your account and your school – never marketing. Accounts are created by invitation from a school.

3. Lerlo as a service

In a school's Lerlo, information about the school's staff and pupils is processed. Which information that is, the school decides, within what Lerlo can hold:

• Staff: name, email address, roles, the classes and subjects they teach, an optional profile picture and their own teaching material.
• Pupils: first and last name, an optional date of birth (used to show their age), classes through the years, an optional picture, when and why a pupil left, teachers' notes, seats in seating plans and placement rules, and results and answers from activities in lessons.
• Teaching: lessons with notes, pictures and files, seating plans and their history, activities and their results, and the school's log of changes.

Pupils have no login. When a pupil takes part in an activity, the phone remembers only a random number for a few hours, which cannot be traced back to the child.

How we protect the information

Personal data is encrypted in the application before it is written to the database, and uploaded files are encrypted before they are stored. Access follows roles: teachers see their own classes, administrators their school, nobody another school. All staff use two-factor. Every change to the school's data is logged. It is described in detail on the page Security and GDPR.

Where the information is processed

In the EU. Lerlo is hosted at Hetzner in Germany, service emails are sent through a provider in France, and visits are counted by Plausible in the EU. The list of sub-processors is on the security page and in the data processing agreement. Information is not transferred to countries outside the EU/EEA.

For how long

For as long as the school uses Lerlo, and as the school decides: the school chooses how long pupils who left are kept, after which they are deleted automatically with everything that belongs to them. The log keeps each entry for two years. If the school deletes a pupil, a class or its account with us, everything that belongs to it is deleted at once. If a school stops using Lerlo, the school is deleted with its classes, pupils, files and log once the school has downloaded what it wants to keep.

4. Your rights

You have the right to access the information we process about you, to have it corrected or deleted, to restrict the processing, to object, and to receive your information in a machine-readable format. If it concerns information in a school's Lerlo, you should contact the school, which is the data controller; the school can download everything about a pupil or a member of staff as one export and correct or delete it. If it concerns the website or your account, write to us at kontakt@lerlo.dk.

You can complain to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk.

5. Changes

If we change this policy, we put the date at the top and describe the change here. Significant changes that affect the schools are notified directly to the school's administrator.