1. Introduction
Schedual is timetabling software for schools. One constraint engine builds the whole school's week for the International Baccalaureate (PYP, MYP, DP and CP), Cambridge IGCSE, GCSE and A-Level, the French Baccalauréat and US high schools, and publishes it to teachers and students on the web and, soon, on iOS and Android.
We comply with Regulation (EU) 2016/679 (GDPR), the French Loi Informatique et Libertés as amended, and the other applicable European data-protection laws. This policy explains what personal data we process when you use our website, our applications, our phone line or our other services (the "Services"), and why.
Schedual does not sell personal data, does not show advertising and does not use third-party trackers. Ever.
2. Our two roles
Under the GDPR we act in two capacities, depending on the data:
- Controller for the data we collect for our own purposes: the accounts of school administrators, billing contacts, website visitors, people who contact us (by form, email or phone), the schools and school staff we prospect, and our independent sales partners.
- Processor for the school's own data — students, teachers, subjects, rooms and timetables. The school is the Controller of those records (Art. 4(7) GDPR); our obligations are set out in the Data Processing Agreement.
The rest of this policy describes our practices as Controller.
3. Who we are
SCHEDUAL SAS, share capital €1,000, SIREN 130 277 288, RCS Paris, D-U-N-S 28-830-3330, 47 rue Vivienne, 75002 Paris, France — Legal Notice.
| Contact | |
|---|---|
| Privacy and data-subject requests | [email protected] |
| Security incidents | [email protected] |
| Contracts and the DPA | [email protected] |
| Phone | +33 1 62 04 50 88 |
At our current size we are not required to appoint a Data Protection Officer (Art. 37 GDPR); privacy@ is the single point of contact for every privacy question.
4. Data we process as Controller
4.1 Accounts and billing
Name and professional email of school administrators and staff users; role; school name, curriculum and school codes (for example an IB school code or a French UAI); billing contact, address and VAT number where applicable; Stripe customer and subscription identifiers (Schedual never sees card numbers); subscription tier, invoices, purchase orders and signed documents. If your school signed up through a sales partner's link, we record that partner's referral code with the account so the partner is credited.
4.2 Technical and security data
IP address (in access logs), browser and device type, sign-in and session events, two-factor authentication events, application errors (captured on our own servers), and an audit log of administrative actions.
4.3 Contact with us
Messages sent through our forms, emails to our addresses, support tickets and their attachments.
Our phone line. When you call +33 1 62 04 50 88 or one of our sales numbers, our telephony provider (Twilio) processes your phone number and the call's metadata (time, duration, the menu option you chose) in order to connect the call. Calls you make to us are not recorded. If you leave a voicemail, you are told so before the tone; the recording is copied to our own storage in the EU, deleted from Twilio's systems, and kept for 90 days.
When we call your school. Calls our sales team places through Schedual may be recorded and analysed to train the team. You are told so by a short message as soon as you answer, before you speak with anyone; if you object, just say so and the recording is erased unheard. A recording is transcribed on our own server in France, then the audio is deleted (from Twilio's systems as well); the transcript and its analysis are kept for 6 months.
4.4 Prospecting schools
We contact schools that may benefit from Schedual. For this we use the professional contact details of schools and of their staff (name, role, school email and phone) taken from public sources such as school websites and public registers, together with notes on our exchanges. We never buy consumer lists and never prospect pupils or parents. You can object at any time — see section 11.
4.5 Independent sales partners
For the independent agents who introduce schools to Schedual: identity and contact details, their contract, the schools they introduce, their calls placed through Schedual (numbers, time and duration; recordings and their analysis as described above), commissions and payment details.
4.6 Mobile applications (coming soon)
The iOS and Android apps use the same account as the web. If you allow notifications, the app registers a push token for your device so we can tell you when your timetable changes or a lesson is covered. The apps contain no advertising or analytics SDK.
5. Legal bases (Art. 6 GDPR)
| Processing | Legal basis |
|---|---|
| Providing the Services to subscribing schools, support, notifications | Contract — Art. 6(1)(b) |
| Billing, invoicing and accounting | Contract and legal obligation — Art. 6(1)(b) and (c) |
| Security, audit logs, fraud and abuse prevention | Legitimate interest in protecting the Services — Art. 6(1)(f) |
| Answering calls, voicemails and messages | Legitimate interest in answering you, or pre-contractual steps — Art. 6(1)(f) or (b) |
| Recording and analysing sales calls to train our sales team | Legitimate interest in improving how we present Schedual — Art. 6(1)(f), with a right to object at the start of the call or at any time |
| B2B prospecting of schools | Legitimate interest in developing our business — Art. 6(1)(f), with a right to object at any time |
| Sales-partner programme | Contract — Art. 6(1)(b) |
| Push notifications | Your consent in the app's settings — Art. 6(1)(a), withdrawable at any time |
7. Who receives the data
Only our own team, and providers that help us deliver the Services, each limited to what its task requires and bound by a written contract with data-protection terms: hosting, network protection and backups; payments (Stripe); telephony (Twilio); email; document extraction for bulk imports (Mistral AI, Paris); and, once the apps launch, Apple and Google to deliver push notifications. The complete, dated list is on the Sub-processors page.
Authorities receive data only when a binding legal order compels us.
8. International transfers
Our servers are in France, with a warm standby at IONOS in Germany. Some providers are outside the European Economic Area — notably Backblaze (encrypted backups, United States), Stripe (Ireland, with United States fallback), Twilio (United States), Tailscale (Canada, control plane only) and Cloudflare (global network). For each transfer we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), with supplementary measures where needed: backups are encrypted on our servers before they leave, so the backup provider only holds ciphertext, and voicemails are removed from Twilio as soon as we have copied them.
9. How long we keep data
| Data | Kept for |
|---|---|
| Accounts | Duration of the contract, then deleted within 30 days |
| School data (processor) | Duration of the contract; exported on request, then deleted within 30 days |
| Backups | 30 days, immutable, then they expire automatically |
| Audit logs | 12 months rolling |
| Application error reports | 90 days rolling |
| Support tickets and correspondence | 24 months |
| Voicemails | 90 days |
| Call metadata of sales calls | Duration of the sales relationship, at most 3 years after the last contact |
| Transcripts and analyses of recorded sales calls (audio deleted after transcription) | 6 months |
| Prospect contact details | 3 years after the last contact, or until you object |
| Sales-partner records | Duration of the contract plus the legal limitation period |
| Invoices and accounting records | 10 years (French Commercial Code) |
| Bulk-import files | Deleted once extracted; orphaned files after 7 days; zero retention at Mistral AI |
10. Security and independent verification
We apply measures proportionate to the risk (Art. 32 GDPR): encrypted connections only (TLS 1.3), DNSSEC-signed domain, HSTS; production servers reachable from the internet only through Cloudflare's tunnel; administrator access over a private network with keys, never passwords; row-level isolation between schools in the database; two-factor authentication, enforced for Schedual staff; encrypted, immutable off-site backups with weekly restore drills; continuous dependency scanning; a full audit trail of privileged actions.
You do not have to take our word for it. These results are public and re-run independently:
- Qualys SSL Labs — A+ (TLS configuration)
- Mozilla Observatory — A+ (web security headers)
- Internet.nl — 100 %, listed in its Hall of Fame (modern internet standards: IPv6, DNSSEC, HTTPS, RPKI)
- Cloud Security Alliance STAR Registry — Level 1 (published CAIQ v4.1 self-assessment, renewed yearly)
Live reports and our own gap analysis — including what we do not do yet, such as ISO 27001 or SOC 2 certification — are on the Security page. The technical and organisational measures are listed in Annex A of the DPA.
11. Your rights
You can ask us to access, rectify or erase your data, to restrict its processing, to receive it in a portable format, to withdraw a consent, and to object to processing based on our legitimate interest — including, at any time and without giving a reason, to prospecting. Schedual makes no decision with legal effect based solely on automated processing.
Write to [email protected]. We reply within one month, extendable by two months for complex requests (we will tell you within the first month).
If you are a teacher, a student or a parent at a school that uses Schedual, the school is the Controller of your records: please contact the school first. We help the school answer you, as the DPA requires.
12. Students and children
Schools use Schedual to timetable their pupils, many of whom are minors. The school is the Controller and decides the legal basis (typically its public-interest educational mission or its contract with families) and informs parents. We process only what a timetable needs — name, year, programme, subject choices and groups — and nothing from special categories (Art. 9 GDPR). Students sign in with a handle provided by the school, with no email address, and only ever see their own timetable. Our apps will contain no advertising and no tracking.
13. Data breaches
If a breach affects school data, we notify the school without undue delay and at the latest within 72 hours (Art. 33 GDPR), as set out in § 8 of the DPA.
14. Complaints
You can complain to the French data-protection authority, the CNIL (cnil.fr), or to the authority of your EU country.
15. Changes
When we change this policy materially we email the school's primary contact at least 30 days before the change takes effect. The current version is always at this address, with its date at the top.
