Privacy Policy for CU

This privacy policy provides information on how personal data is processed in the CU portal, provided by Cu.School AS ("Cu.School") with organization number 928 652 912.

Cu.School is responsible for the data processing activities described in this document. The terms "we" and "us" refer to Cu.School. The terms "you" and "your" refer to the physical person whose personal data we process.

1. Purpose of Processing Personal Data

1.1 Processing Personal Data to Offer the CU Service

The CU service is designed for educators and children with dyslexia/learning and writing difficulties, as well as their guardians. To provide this service, it is necessary to process personal data. We process personal data about students and educators to offer the service.

Data processed for students:

  • Name

  • Email

  • Mobile number

  • Date of birth

  • Gender (optional)

  • School, class, and contact teacher

  • Calendar info on when they have lessons

  • Journal/notes from the teacher about the named student

  • Documents produced from a session between the educator and student (normally only educational information)

  • Free text field where the student can provide information about their academic situation and preferences for teaching

During registration, the student will undergo a test that includes individual profiling to identify the student's needs and form the basis for the best possible targeted measures in private education.

Data processed for educators:

  • Education

  • Address

  • Diplomas

  • Police clearance certificate

  • Free text field where the educator can provide information about their academic competence and experiences

Data processed for guardians:

  • Name

  • Phone

  • Email

  • Payment information/settlement information (transaction processed by an external payment provider)

Additionally, the following information will be collected:

  • Messages between teacher and student

  • Video call recordings

  • Scores/analysis from CU and Dysmate (dyslexia test)

  • Video analysis data

Student data will be made available to the educator to conduct tailored teaching. The data may also be made available to guardians.

The processing of personal data for this purpose is based on GDPR Article 6(1)(b).

Since information about the student's reading/learning and writing difficulties is processed, consent is also required under GDPR Article 9. Consent is given upon the first login to the service and means that Cu.School and the educators associated with the student gain access to the student's health information. Consent is necessary for the CU service to be valuable and can be withdrawn at any time.

1.2 Processing Personal Data for Service Delivery and Service Exchange

We process personal data about partners and suppliers for the purpose of service delivery and service exchange. The personal data processed includes names, phone numbers, addresses, email addresses, and billing information. The legal basis for this processing is legitimate interest under GDPR Article 6(1)(f). The legitimate interest consists of fulfilling agreements and carrying out service delivery and service exchange.

1.3 Use of Cookies

We use cookies on our website cu.school. The information we collect is related to user login to extend the logged-in session.

PurposeCookie NameInformationProviderStorage DurationSession variablePHPSESSIDdev.cu.schoolCUUntil the site closesSpreadsheet operation in sessionzscookcsrsheet.zoho.euZohoUntil the site closesSpreadsheet operation in sessionZW_CSRF_TOKENsheet.zoho.euZohoUntil the site closesSpreadsheet operation in sessionCT_CSRF_TOKENsheet.zoho.euZohoUntil the site closesSpreadsheet operation in sessionconcsrcontacts.zoho.euZohoUntil the site closesSpreadsheet operation in session98bac1f50fstatic.zohocdn.comZohoUntil the site closesVideo playbackYSCyoutube.comYouTubeUntil the site closesVideo playbackVISITOR_INFO1_LIVEyoutube.comYouTubeUntil the site closes

2. Recipients of Personal Data and Use of Subcontractors

CU.School does not share your personal data with third parties unless we have a legal basis for doing so.

CU.School uses subcontractors (data processors) for certain administrative tasks. When we share data with a data processor, the processing of personal data is secured through data processing agreements. These agreements ensure that personal data is not used for other purposes and that the processing meets GDPR requirements.

We use the following suppliers:

SupplierPurposeIT-sjefenHosting the service

CU.School does not process personal data outside the EU/EEA.

3. Data Subject Rights

By contacting CU, you as a data subject have the right to request:

  • Correction, Access, and Deletion: You have the right to request a free copy of your personal data, request correction of inaccurate data, and in certain circumstances request that your personal data be deleted.

  • Restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances, for example, while we investigate any objections from you regarding our processing of personal data.

  • Data Portability: In some cases, you have the right to data portability, meaning you can request that we provide your data in a structured, commonly used, and machine-readable format to transfer it to another data controller. This only applies if we process personal data based on your consent or because it is necessary to fulfill an agreement with you.

  • Object: In some cases, you have the right to object to our processing of your personal data. We will then stop processing the data unless we can demonstrate compelling legitimate grounds to continue processing.

  • Object to Direct Marketing: You have the right to object to our direct marketing (including profiling for these purposes). We will then stop processing your personal data for these purposes.

  • Withdraw Consent: If the processing of personal data is based on your consent, you have the right to withdraw your consent at any time. We will then stop future processing of personal data based on your consent.

  • Complaint to the Data Protection Authority: You have the right to complain to the Data Protection Authority about our processing of your personal data. We appreciate it if you contact us directly first.

4. Retention Period

CU.School will store personal data as long as it is necessary for the purpose of the processing.

This means we process information about users as long as they have a user account. When the service is terminated, or an educator ends their assignment with us, we will stop further processing of the data. However, we will retain legally required information, such as payment information, in accordance with accounting and bookkeeping legislation.

We process information about partners and suppliers as long as we have an active contractual relationship and as long as follow-up may be needed after the end of the contract.

We will not store personal data beyond this unless there is another legal basis for continued processing or the processing is necessary to establish, exercise, or defend a legal claim.

5. Contact Information for the Data Controller

If you have questions about how CU.School processes personal data, contact: hei@cu.school.no