Where the platform runs
SingDesk runs on a server owned and operated by [entity name] itself, in Portugal: the database, the uploaded files and the platform's software are there, and nowhere else. No cloud provider hosts the schools' data.
Providers that take part in every school
| Provider | What it does | Data it sees | Location |
|---|---|---|---|
| NovaCloudHosting | Server at the edge of the network that receives the platform's traffic, encrypts it (HTTPS), filters attacks and forwards it to the platform's server through an encrypted tunnel | All traffic passes through it; it keeps technical access logs (IP address, address requested, browser) for about 30 days | Germany (EU) |
| SMTP2GO | Sending of the platform's emails (invitations, reminders, notices), except for schools that use their own email server | Recipient's address and the content of each email | New Zealand (adequacy decision of the European Commission) |
| Microsoft (OneDrive) | Storage of the off-site backups | Backups encrypted on the Provider's server before they leave it; Microsoft does not have the key | [a confirmar] |
| OVH | Registration of the domain and its DNS | No data of the schools; only the platform's addresses | France (EU) |
| CrowdSec | Shared list of malicious network addresses used by the edge server | Network addresses that behaved maliciously towards the platform | France (EU) |
Only when someone turns them on
| Provider | When | Data it sees | Location |
|---|---|---|---|
| Google (Google Calendar) | Only if a school connects its Google account | The lessons synchronised: date, time, title with the student's name and, where set, the participants' email addresses | United States (EU–US Data Privacy Framework) |
| Zoom | Only if a school connects its Zoom account | Meetings created for online lessons, with the student's name in the title | United States (EU–US Data Privacy Framework) |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Only if a person turns on notifications in their browser | The notification is encrypted end to end; the service sees only that one is being delivered to the device | Depends on the browser |
Google Calendar and Zoom act under the school's own account and its own agreement with them; they are listed here so that each school knows what its integration sends.
For the Provider's own contact
| Provider | What it does | Data it sees | Location |
|---|---|---|---|
| Aster Mail | Mailbox of the platform's contact address | Only the emails people send to that address | [a confirmar] |
Changes to this list
Any addition or replacement is announced here and by email to each school's owner at least 30 days before it takes effect, as set out in the Data Processing Agreement. How the Provider handles its own data is described in the Privacy Policy.
This is a translation; the Portuguese version prevails.