Trust and data protection
This page summarizes how Techlogia Lab meets the data-protection and security requirements of schools. It is aimed at school leadership, official data protection officers and school authorities evaluating the platform.
At a glance
- Processing under Art. 28 GDPR — a signed data processing agreement (DPA) is a precondition before the first student class is created.
- Hosting exclusively in Germany (Hetzner) — no third-country transfers.
- Data minimization — students sign in via a class code without an email address; pseudonymous identifiers are used internally.
- Automatic deletion concept — class student data is deleted automatically 90 days after the class is deactivated.
- Protection of minors — for learners under 16, consent of the legal guardians is required (Art. 8 GDPR).
- No tracking, no advertising in the student area.
Documents and evidence
We provide the following documents to schools for their data-protection review:
| Document | Availability | Link |
|---|---|---|
| DPA (Art. 28 GDPR) | Public | Open |
| Privacy policy | Public | Open |
| Security policy | Public | Open |
| Accessibility statement | Public | Open |
| Legal notice (Impressum) | Public | Open |
| Data protection impact assessment (Art. 35), summary | On request | Request by email |
| Record of processing activities (Art. 30) | On request | Request by email |
| Technical and organizational measures, list of sub-processors | On request | Request by email |
| Template consent for legal guardians | On request | Request by email |
Hosting and data location
All personal data is processed and stored in German data centers (Hetzner). There is no transfer to third countries, so no Schrems II problem arises.
Technical and organizational measures (excerpt)
- Data is encrypted in transit (TLS 1.3) and on disk.
- Suspicious access is detected and blocked automatically; the servers are hardened and monitored for attacks.
- Practice VMs are isolated from each other and from the rest of the network and shut down automatically.
- Backups run automatically and are stored encrypted.
- Role-based access only; administration accounts are protected with two-factor sign-in.
What we do not claim
In the interest of honest compliance, we deliberately draw these lines:
- We do not claim a completed ISO 27001 certification — we are actively working toward it: risk management, an asset inventory and a statement of applicability are already in place; external certification is not yet completed.
- Our curriculum reference is aligned with the education standards (GI, Media Competence Framework NRW, FISI), but not an official accreditation; final subject sign-off rests with the teacher.
- The DPA is undergoing final legal review; you receive the current version via the link above.
Contact
We are happy to answer your data protection officer's questions. Write to info@techlogia.de.