Namfus Privacy Policy

Námfús ehf., reg. no. 410702-4440, Höfðabakki 9b, 110 Reykjavík, Iceland, runs the Namfus school system for preschools, compulsory schools, after-school centres and municipalities. This policy describes how personal data is handled in the system, in the mobile apps and on the namfus.com website.

A parent who wants to know what their child’s school records, or who wants to exercise their rights, contacts the school or the municipality first. Namfus helps the school to respond (see section 6).

The school decides what is recorded and which modules of the system are in use, so the list for an individual school can be shorter.

Sensitive data. The school can record information about the support, special needs or health of a student, for example an individual education plan, interventions or allergies. Access to this data is more restricted, and every lookup is logged.

Data in the school system is processed so that the school can meet its legal obligations and run its daily work. This includes student registration, timetables, attendance, assessment, communication with families and reports to the municipality. The legal basis belongs to the school as the controller. It is usually a legal obligation or a task in the public interest under the Icelandic Compulsory School Act and Preschool Act (Article 6(1)(c) and (e) GDPR). Namfus does not use the data for its own purposes, does not sell it and does not use it for marketing.

Namfus processes the data that it is itself responsible for as follows:

The system, the database, files and backups are hosted with Open Telekom Cloud in Germany, inside the EEA. Namfus does not disclose personal data to anyone other than the subprocessors on the Namfus list of subprocessors, unless the law requires it.

The list, with the role and the location of each party, is in the appendix at the end of this page. It also lists the electronic signature services that schools connect with their own accounts.

Artificial intelligence. The AI features are optional, and the controller decides whether they are on. The system does not send the name, national ID number, email address, phone number or photo of a student. It sends an anonymous identifier instead. Text that staff write themselves is sent as written, so it must not contain personal data. In the pronunciation assessment of the ÍSAT module, a voice recording of the student is sent to OpenAI for transcription. Under the OpenAI terms, the data is not used for training. AI makes no decisions about students.

Schools and municipalities receive notice in advance of a new subprocessor, and they can object.

The data of each school is kept apart from the data of other schools, and each user sees only what their role permits. A teacher sees the students they teach, a guardian sees their own children, and a student sees their own information. The server checks permissions on every action.

• Connections are encrypted (HTTPS), and backups are encrypted.
• Every change to personal data, and every lookup of it, is logged against a named user.
• Security management follows an information security management system based on ISO/IEC 27001.
• If a security breach occurs, Namfus notifies the school or the municipality without undue delay, so that it can notify the Icelandic Data Protection Authority within 72 hours.

Retention. Data in the school system is kept as the school decides and as its obligations under the Icelandic Public Archives Act No. 77/2014 require. When a contract ends, Namfus returns the data to the school or deletes it, as the data processing agreement states. Namfus deletes the data that it is itself responsible for when the purpose of the processing is met, unless the law requires a longer retention period, for example accounting law.

You have the right to access the data about you, to have it corrected, restricted or erased, to receive it in a machine-readable format, and to object to processing (Articles 15–21 GDPR). Guardians exercise these rights on behalf of their children. Exercising them costs nothing.

If Namfus receives a request about school data, it forwards the request to the school, which decides on it. Namfus helps the school to collect the data or to delete it.

Cookies. The school system uses only essential cookies, for example to keep a user signed in. The namfus.com website uses no analytics or advertising cookies. Vercel hosts the website, and it logs technical information such as the IP address for a short time, for operation and security.

Changes. Namfus reviews this policy when the processing changes, and at least once a year. The latest version is always at namfus.com/en/privacy, with the date of the last change. Schools are told about significant changes.

Contact. Questions about data that a school or preschool records go to the school or the municipality (see section 6). Namfus answers only for its own processing, which is the public website and communication with customers: Námfús ehf., Höfðabakki 9b, 110 Reykjavík, Iceland. Subsidiary in Germany: Namfus Deutschland GmbH, Königstraße 5, Stuttgart. Data protection officer: Oddur Hafsteinsson, personuvernd@namfus.is. General support: support@namfus.is.

Namfus uses these subprocessors to run the school system. Schools and municipalities receive notice in advance of a new party, and they can object.

A school that uses electronic signatures connects its own account with one of these services. The contract is between the school and the service, and Namfus sends documents for signature through the account of the school. These services are therefore not subprocessors of Namfus.