Toddle & GDPR

1. Data Processing Agreement

Toddle offers a Data Processing Agreement to all schools located in the EU/EEA and Switzerland. This Data Processing Agreement is signed at the time of the school’s onboarding with Toddle. You can request a copy of the DPA by writing to privacy@toddleapp.com.

2. Toddle’s role

Toddle handles personal data in two ways.

When a school uses Toddle, the school is the controller of student, parent and staff personal data. Toddle processes that data as a processor, only on the school’s documented instructions under the Data Processing Agreement.

When you interact with Toddle directly, Toddle is the controller. This covers visiting toddleapp.com, requesting a demo, registering for a webinar, subscribing to our newsletter, completing a form or applying for a job. Our Privacy Policy sets out why we use this data and the lawful basis for each purpose.

3. How does Toddle comply with GDPR

• Lawfulness, Fairness and Transparency: For data we process for schools, Toddle acts only on the school’s documented instructions. For data we control, we rely on the lawful bases set out in our Privacy Policy, such as consent, legitimate interests and the performance of a contract.
• Purpose Limitation: We only use your data for the purposes specified in the contract with your school or, for data we control, the purposes set out in our Privacy Policy.
• Data Minimisation: We collect minimal data, only what we need for the purposes above.
• Integrity and confidentiality: We follow industry best practices to keep your data safe and secure. All your data is encrypted at rest and in transit.
• Ownership of data: Personal data about students, teachers, administrators and parents is owned and controlled by the school. Toddle does not claim ownership of it, and individuals keep their rights over their personal data as described below.
• Lawful Basis and Consent: When a school uses Toddle, the school is responsible for determining the lawful basis for processing student, parent, and staff personal data and for obtaining any notices, consents, or authorizations required under applicable law. Toddle acts as a service provider and data processor on the school’s documented instructions. Toddle does not determine the lawful basis for processing and does not collect parental consent for the use of the platform. A sample parental consent form is available from Toddle for schools that choose to use it. When you interact with Toddle directly, Toddle decides the lawful basis. Where we rely on your consent, for example for marketing emails or non-essential cookies, you can withdraw it at any time. Our Cookie Policy explains how we use cookies.
• Our employees: Our employees: All our employees get periodically trained in relevant data security practices. All our employees undergo a relevant background check, sign a non-disclosure agreement and immediately lose access to all systems and data when terminated.

4. Your rights under the GDPR

If your personal data was shared with Toddle by your school, please send your request to your school, as the controller. You can also write to privacy@toddleapp.com and we will pass it on and support your school in responding.

For personal data you gave Toddle directly, write to privacy@toddleapp.com. We will respond within one month, which may be extended where the GDPR allows. We may need to verify your identity before we respond.

• Right to be informed: Our Privacy Policy explains what personal data we process, why we process it, where it is stored and who we share it with. Where your school shared your data with Toddle, your school’s privacy notice explains how the school uses Toddle.
• Right of Access: You can ask at any time for a copy of your personal data and information about how it is processed.
• Right to Rectification: If any of your personal data is inaccurate or incomplete, you can ask for it to be corrected or completed. Teachers, administrators and parents can also edit their own profile details in Toddle.
• Right to erasure (right to be forgotten): If you want your personal data deleted, please write to privacy@toddleapp.com, or contact your school if your school shared your data with Toddle. Your personal data will be deleted from our records unless we are legally required to keep it.
• Right to restriction of processing: You can ask for the processing of your personal data to be restricted. For example, you can ask for this while the accuracy of your data is being checked, or where you need the data kept for a legal claim but do not want it used for anything else. While processing is restricted, the data will be stored but not otherwise used, except as permitted under Article 18 of the GDPR.
• Right to data portability: You can ask to receive the personal data you have provided in a structured, commonly used and machine-readable format, or to have it sent to another provider where this is technically possible.
• Right to object: You can object to the processing of your personal data where it is based on legitimate interests or the performance of a task carried out in the public interest, including profiling on those grounds. Processing will stop unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed for a legal claim. You can also object at any time to the use of your personal data for direct marketing, and it will no longer be used for that purpose.
• Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects on you or similarly significantly affects you. Toddle does not use educational data for profiling, algorithmic decision-making, or any commercial purpose unrelated to providing educational services. Where a school uses Toddle’s AI features, decisions about students remain with the school. You can ask for human review of a decision, give your point of view and contest the decision.
• Right to withdraw consent: Where processing is based on your consent, you can withdraw it at any time, for example by unsubscribing from our marketing emails or writing to privacy@toddleapp.com. This does not affect processing carried out before you withdrew it.
• Right to lodge a complaint: You can complain to the data protection supervisory authority in the EU/EEA country where you live or work, or where the issue occurred. We would welcome the chance to address your concern first at privacy@toddleapp.com.

5. Contact

Toddle’s Data Protection Officer is Anshul Chauhan. In case of any questions/ queries, please reach out to privacy@toddleapp.com.

In compliance with Article 27 of the General Data Protection Regulation (GDPR), we have appointed Rickert Rechtsanwaltsgesellschaft mbH as our representative in the European Union for matters concerning data protection. You may contact our EU GDPR Representative directly using the following details:

Name: Rickert Rechtsanwaltsgesellschaft mbH
– Teacher Tools Private Limited –
Address: Colmantstraße 15, 53115 Bonn, Germany
Email: art-27-rep-toddle@rickert.law