Trust
GDPR
A practical playbook for how Min Dugsi handles the General Data Protection Regulation. For the legal text, see our Privacy Policy and our Data Processing Agreement.
Schools as controllers
Each school operating on Min Dugsi is the data controller for its own students, parents and staff. We are the processor — we do not decide *why* your data is held.
Subject rights workflow
Access, rectification, erasure and portability requests flow through your tenant admin. The tenant admin can export student + family records via the dashboard, and erasure is soft-delete with a 30-day grace before purge.
Retention defaults
Active student records: kept while the student is enrolled. Archived after departure: 7 years (Danish accounting requirement) for finance rows, 2 years for behavioural and academic rows. Tenant admins may shorten these defaults.
Sub-processor list
Supabase — EU. Vercel — EU. Meta Platforms Ireland (WhatsApp Business API) — used for parent and teacher notifications. Updated 2026-06.
Erasure
Tenant-level: contact us to fully delete a tenant within 30 days. Student-level: tenant admins can perform soft-delete; hard-delete (auth.users + linked rows) requires a written request via the school admin.
Data-protection contact
Message us on WhatsApp via the /contact page. Use that channel for sub-processor questions, signed DPA requests, or rights requests where the school admin is unresponsive. Phone-first by design — we do not run an email contact channel.