In short
- Your school is in charge. For student data, the school is the controller and we are the processor. We act only on your instructions.
- Students stay anonymous. We process a nickname, class membership and game statistics. No email, no real name, no location.
- Data stays in the EU. Our own servers run in the EU, operated by {{HOSTING_PROVIDER}}.
- Fast breach notice. If something goes wrong, we tell you without undue delay and in any case within 48 hours.
- Clean ending. When your licence ends, we delete the class data.
- A DPA is available. Our data processing agreement template is available on request from [email protected].
Who does what
For student data in a class, the school (or the teacher acting for it) decides why and how data is used. The school is the controller under GDPR. {{COMPANY_LEGAL_NAME}} is the processor and processes the data only to provide the teacher panel and the class features, on the school’s documented instructions (GDPR Art. 28).
For teacher accounts and billing, {{COMPANY_LEGAL_NAME}} is the controller: we need the teacher’s email and the school name to run the account, send invoices and meet our legal obligations.
{{COMPANY_LEGAL_NAME}}, {{COMPANY_ADDRESS}}. Contact for schools: [email protected]. Privacy questions: [email protected].
What the service does
Teachers use the panel at teach.tallyfall.com to create classes, share a six-character class code, assign topics and levels, and see reports. Students join with the code in Tallyfall Kids (or the web game). A parent or guardian enters the code behind the parental gate. Students in a licensed class get the full Tallyfall Kids content while they are members.
Student data we process
| Data | Purpose |
|---|---|
| Nickname (chosen from a ready-made list) | To show the student in the class list and reports |
| Class membership (which class, when joined) | To link the student to the class and unlock content |
| Game statistics: levels played, results, stars, rule attempts, whether Calm mode was used | To show the teacher progress reports |
| Anonymous device key | To link the student’s device to the class |
We do not process students’ email addresses, real names, photos, location, contacts or advertising IDs. There are no ads and no tracking tools in Tallyfall Kids.
Please do not ask students to use their real name. Nicknames come from a fixed list, so this should not be possible.
Teacher data we process
| Data | Purpose | How long |
|---|---|---|
| Teacher email address and school name | Account, sign-in, licence, invoices | For the licence period plus 12 months |
| Billing data (amount, invoice details; card details are handled by Stripe only) | Invoices, accounting | As long as accounting and tax law requires |
| Support requests | Help | 24 months |
How long we keep student data
- While the licence or trial is active: we keep class data so teachers can see progress. Individual game summaries older than 24 months are combined into anonymous statistics.
- When a student leaves a class: the student no longer appears in that class. The student’s own progress stays in their Tallyfall Kids app, under the Kids privacy notice.
- When the licence or trial ends: see “At the end of the contract” below.
Subprocessors
We use these subprocessors. We will tell schools in advance about any new subprocessor, so you can object.
| Subprocessor | Service | Location |
|---|---|---|
| {{HOSTING_PROVIDER}} | Our own servers for the panel and API | EU |
| Cloudflare | Content delivery, protection against attacks, TLS; may process IP addresses briefly | Global network |
| Stripe | Payments and invoices for licences (teacher and billing data only) | Global |
| {{EMAIL_PROVIDER}} | Email to teachers | See the provider |
| Apple and Google | App stores (students’ devices) | Global |
Where a subprocessor processes data outside the EU or the European Economic Area, we use an adequacy decision or the European Commission’s Standard Contractual Clauses (SCCs).
Security
- All connections are encrypted (HTTPS/TLS).
- Data is stored on our own servers in the EU.
- Access is limited to staff who need it and is protected.
- Teachers can see only their own classes.
Data breaches
If we become aware of a personal data breach that affects your school’s data, we notify the school without undue delay and in any case within 48 hours. We tell you what happened, which data is affected, what we have done and what you may need to do, so you can meet your own duties (for example the 72-hour notice to the authority under GDPR Art. 33).
Helping with requests
If a student or parent asks the school to access, correct or delete data, we help you respond. Teachers can remove a student from a class in the panel at any time. For anything else, write to [email protected].
At the end of the contract
When a licence or trial ends and is not renewed, we delete class memberships and the class reports linked to them within 30 days. Before that, the school can ask us to export the class reports. The teacher account and billing records are kept as described above. We keep no copies of class data, except where the law requires us to.
Data processing agreement (DPA)
Our DPA template, based on GDPR Art. 28, is available on request from [email protected]. A downloadable PDF will follow. The licence terms are in the School licence terms.
Complaints
Students, parents and teachers can complain to a data protection authority: in Hungary the NAIH (naih.hu), or the supervisory authority in their country.
Effective date: {{EFFECTIVE_DATE}}