Skooler
Log in

Privacy Policy


1. Introduction

Acadu AS is committed to protecting the privacy of all users. This Privacy Policy describes how personal data is handled in accordance with the General Data Protection Regulation (GDPR) and applicable Norwegian and EU data protection laws.

Definitions:
"Acadu AS": The company providing the Service (also referred to as "Acadu," "we", "us", or "our").
"Service": The digital learning platform provided by Acadu AS, including Skooler GO, Skooler Pro, and any related features, tools, and services.
"School": A school, municipality, organization or an educational institution registered with Skooler GO and/or Skooler Pro.
"Account Holder": A User who registers for and controls a Free or Premium account and is responsible for managing access to the Service, including inviting and administering Invited Users.
"Invited User": A User who is granted access to the Service by an Account Holder, including students, children, and parents or legal guardians. Invited Users do not independently control their account or access to the Service.
"User": Any individual accessing or using the Service, including Account Holders and Invited Users.
"User Content": Any content created, uploaded, submitted, stored, or shared by Users within the Service.
"Personal Data": Any information relating to an identified or identifiable natural person.

2. Roles and Responsibilities

2.1 Schools
When the Service is used by a School (municipalities, organizations or other educational institutions), these entities act as the Data Controllers, determining the purposes and means of processing personal data. Acadu AS acts as a Data Processor, processing personal data on instructions from the Data Controller under a Data Processing Agreement (DPA).

2.2 Account Holders
When individuals access and use the service through Free or Premium accounts, Acadu AS acts as the Data Controller.
The Service may be used in relation to children. Where Account Holders provide personal data relating to children, they are responsible for ensuring a valid legal basis for such processing in accordance with applicable law. Where required, this includes obtaining consent from a parent or legal guardian.

2.3 Invited Users
Invited Users, including students and their parents or legal guardians, may exercise their data protection rights by contacting the Account Holder or Acadu AS directly. Parents or legal guardians may also exercise data protection rights on behalf of the child.
Acadu AS will take appropriate measures to respond to such requests in accordance with applicable data protection laws.

3. Categories of Personal Data

Typical categories of personal data we process include:

  • Name, email address, phone number
  • User role (e.g., student, teacher, parent/guardian)
  • School affiliation and class memberships
  • Communication, content and activity logs within the platform

Special categories of personal data are only processed where explicitly required and permitted by law, and only under instruction from the Data Controller where applicable.

4. Purpose of Processing

Acadu AS only processes personal data necessary for the platform to function effectively as an educational tool, including:

  • Managing users and classes
  • Enabling collaboration and communication
  • Supporting teaching and learning activities
  • Storing and displaying User Content

Acadu AS does not use personal data for profiling.

4.1 Communication
Acadu AS may use contact information, including email address, for communication necessary to provide and operate the Service. Such communications cannot be opted out of while the Service is in use and include:

  • Account registration and onboarding
  • Service-related notifications, including updates, security alerts, and system messages
  • Billing and payment-related communications
  • Notifications regarding account status, including suspension, inactivity, or deletion

Where the Service is used in relation to Invited Users, such communications may also be sent where relevant for their use of the Service or participation in activities within the Service.

Acadu AS may also send newsletters or other non-essential communications about the Service to Account Holders. Such communications are only sent where permitted by applicable law and, where required, based on the Account Holder’s consent. Account Holders may opt out of non-essential communications at any time by using the unsubscribe link provided in such communications or by contacting Acadu AS directly.

4.2 Cookies
Acadu uses only necessary cookies to provide, operate, and secure the Service. We do not use cookies for advertising, profiling, or tracking purposes.

5.1 Schools
The legal basis for the processing of personal data is determined by the educational institution in accordance with our Data Processing Agreement (DPA), and will typically be:

  • Performance of a task carried out in the public interest (Article 6(1)(e) GDPR), where the institution processes personal data as part of its educational mandate; and/or
  • Compliance with a legal obligation (Article 6(1)(c) GDPR), where required by applicable education laws.

5.2 Account Holders and Invited Users
For Account Holders of Free and Premium accounts, and for Invited Users associated with such accounts, Acadu AS processes personal data based on:

  • Performance of a contract (Article 6(1)(b) GDPR), as processing is necessary to provide the service requested by the Account Holder, including services involving Invited Users
  • Legitimate interests (Article 6(1)(f) GDPR), including maintaining the security of the service, preventing misuse, and improving the platform.

Consent is used only where required for specific optional features or communications. Where processing is based on consent, the User has the right to withdraw their consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal.
If a User withdraws their consent where consent is required for specific processing activities, the relevant account or functionality may be restricted or terminated where continued provision of the Service is no longer possible. In such cases, personal data will be deleted in accordance with our data retention and deletion practices.

6. Data Storage and Security

All personal data is securely stored in Microsoft Azure data centers located in the EU/EEA region. We implement strict technical and organizational measures to ensure a high level of security, including:

  • Role-based access control and authentication mechanisms
  • Encryption in transit and at rest
  • Logging and monitoring of system activity
  • Regular security assessments and updates

7. Data Retention and Deletion

7.1 Schools
In cases where the Service is used by a School (Data Controller), personal data is retained only as long as necessary for its intended purpose or as instructed by the DPA. When a School discontinues use of our Services, all associated data is securely deleted.

7.2 Account Holders
Personal data is stored for as long as the Account Holder has an active Premium subscription or maintains an active Free account through login activity.
Personal data will be deleted or anonymized under the following circumstances:

  • When the Account Holder actively deletes their data or requests deletion; or
  • When no login activity has been registered on a Free account for a continuous period of 120 days.

7.3 Invited Users
Personal data is administered by the Account Holder that granted access to the Service. Invited Users may exercise their data protection rights by contacting the Account Holder administering the Service or Acadu AS directly. Acadu AS may assist in handling such requests in accordance with applicable law. This may include deleting or anonymizing personal data, or restricting access to the Service, where required.

7.4 Deleted Data
Before deletion, it is the User’s responsibility to ensure that any data they wish to retain is exported or downloaded.
Deleted data cannot be restored. Deleted data may remain in secure backup systems for a limited period before being permanently erased.

7.5 Legal Retention
Acadu AS may retain limited data where required to:

  • Comply with legal obligations
  • Establish, exercise, or defend legal claims

Such data is securely stored with restricted access.

8. Data Sharing and Third Parties

We use third-party service providers to deliver parts of the Service, such as email delivery. We do not sell personal data or share it with third parties for commercial purposes.

We may integrate with third-party services like Microsoft 365 (e.g., Teams, OneDrive) where enabled by the School or Premium Account Holder. These integrations are governed by separate agreements between the School or Premium Account Holder and the third-party provider.

9. Aggregated and Anonymized Data

Acadu may create aggregated and anonymized data derived from the use of the Service. Such data does not identify individuals and does not contain personal data, including direct identifiers of students, teachers, or family members.
Aggregated and anonymized data may be used for purposes such as:

  • Service analytics and performance monitoring
  • Benchmarking and statistical analysis
  • Product development and improvement

This processing is carried out in a manner that ensures individuals cannot be identified, directly or indirectly.

10. AI Services

Acadu AS is committed to ensuring that its AI services are designed and used in compliance with the principles and transparency requirements of the EU AI Act, as well as applicable data protection regulations.

AI services are used as assistive tools and do not make automated decisions that produce legal or similarly significant effects on individuals. Processed data is not used to identify Users or create user profiles and is not used to train or enhance AI or machine learning models.

Acadu AS offers integrated AI services through Microsoft Azure OpenAI under Microsoft's data protection commitments. To prevent misuse, Microsoft Azure may temporarily retain processed data for up to 30 days before automatic deletion.

11. Transfers of Personal Data Outside the EU/EEA

Personal data may be transferred outside the EU/EEA where necessary. In such cases, Acadu AS ensures that transfers are carried out with appropriate safeguards, such as Standard Contractual Clauses or transfers to countries with an adequate level of data protection.

12. Your Rights

Under GDPR, you have the right to:

  • Access your personal data
  • Request corrections of inaccurate data
  • Request deletion of data (where permitted)
  • Object to or request restriction of processing
  • Data portability (for applicable roles)
  • Lodge a complaint with a supervisory authority

13. Contact Information

For privacy-related inquiries, or if you wish to exercise your rights: Contact your School (Data Controller) or Account Holder.
Or contact us: Acadu AS
Email: support@skooler.com

14. Changes to This Policy

We may update this Privacy Policy when necessary to reflect changes in legal, technical, or business developments.
You'll always find the latest version here.

Last updated: June 2026