Privacy policy

1. Controller

Mindoo GmbH
Karpfenweg 12, 76189 Karlsruhe, Deutschland
Email: Please enable JavaScript
Data protection contact: Karsten Lehmann

2. General principles

This website provides information about the “Teacher's Desk” app. We process personal data only to the extent necessary and in line with the principles of data minimisation and “data protection by design and by default” (Art. 25 GDPR).

3. Hosting

The website is hosted by Cloudflare. When it is accessed, technically necessary access data (e.g. IP address, timestamp, page requested) is processed to ensure delivery and security. The legal basis is our legitimate interests (Art. 6(1)(f) GDPR).

4. No tracking cookies

This website sets no marketing or tracking cookies. A local browser setting only stores your choice for light/dark mode as well as your language selection on your device; this information does not leave your device.

5. Getting in touch

If you contact us by email, we process your details to handle the request (Art. 6(1)(b) or Art. 6(1)(f) GDPR). The data is erased as soon as it is no longer required.

6. Data processing in the Teacher's Desk app

The app is local-first and end-to-end encrypted: content is encrypted on your device before it leaves it. The keys remain on your devices, and our servers see nothing but ciphertext. Neither we nor our hosting provider can read names, grades or minutes (data protection by design, Art. 25 and Art. 32 GDPR).

The MindooDB Cloud sync servers run in data centres of Hetzner Online GmbH in Germany; a data processing agreement is in place with Hetzner. Content is stored exclusively in Germany. The servers sit behind the network proxy of Cloudflare, Inc. (USA), which forwards connections; it only sees encrypted content and connection data such as IP addresses. Transfers to the USA are safeguarded by the EU-US Data Privacy Framework and EU standard contractual clauses. Besides the encrypted content, we only store the account and connection data needed for operation (user name, public keys, IP addresses, sync timestamps). The legal basis is the user agreement (Art. 6(1)(b) GDPR).

When teachers use Teacher's Desk to process data about their students, the school is the controller and Mindoo GmbH acts as processor. Schools can obtain a data processing agreement under Art. 28 GDPR from us – just write to the address above.

Download the data processing agreement template for schools (German): PDF · Word

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). The data checkout in the app lets you export your content yourself at any time. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

8. Changes

We adjust this privacy policy when the legal situation or our services change.