Data processing agreement
This agreement applies when a school, the owner of the database, uses Schedula, the holder, to process personal data on its behalf. It is written to meet the requirements of the Israeli Protection of Privacy Regulations (Data Security), 2017 for outsourced processing, and forms part of the terms of service.
Draft for legal review. This text is not yet in effect, and lines marked TO CONFIRM are still open.
Last updated: 3 October 2026
Roles
The school owns the database and decides the purposes of processing. Schedula processes the data only on the school’s behalf and on its instructions: these terms, the school’s settings in the service and any written instruction from one of its admins.
The data and whom it is about
- School staff with access: name, email address and role.
- Teachers: name, the contact details the school chooses to enter, subjects, classes, hours, availability, preferences, free-text requests, absences and cover.
- Entries from a connected Google Calendar, if the school connects one.
No records about individual students are needed or requested.
Purposes and processing
- Building, editing, exporting and displaying timetables.
- Collecting teacher preferences and availability.
- Running the start-of-day board: absences and cover.
- Answering questions about the school in the assistant, and reading the files and text the school gives the setup assistant.
- Sending the emails these features need.
Schedula does not use the data for any other purpose.
Systems and access
The data is held in Google Cloud Firestore in Israel and processed by the systems listed under sub-processors. Within Schedula, access is limited to the people who operate the service, only as far as needed to run, support and secure it, and each of them is bound to keep the data confidential.
Security
- Data is encrypted in transit (HTTPS) and at rest by the cloud providers.
- Access inside the service is by role, and every server request that touches a school’s data is checked against that school’s members.
- Access to production systems is limited to the people who operate the service.
- A connected calendar’s access token is stored where no user of the app can read it.
[TO CONFIRM: the security level that applies to the database under the Regulations, and any additional measures it requires.]
Sub-processors
- Google: Firebase Authentication, Cloud Firestore (Israel), Cloud Run (United States) and the Gemini models.
- Vercel: hosting (United States).
- Resend: email (United States).
Schedula tells school admins before adding a new sub-processor. [TO CONFIRM: the data protection terms in place with each sub-processor.]
Security incidents
Schedula tells the school’s admins without undue delay after becoming aware of a security incident affecting the school’s data, with what is known at the time, and helps the school meet its own reporting duties.
Reporting
Once a year, and on reasonable request, Schedula reports to the school on how it meets these obligations.
Duration, return and deletion
This agreement lasts as long as the school uses Schedula. The school can export its timetables at any time. When the school is deleted in the service, or the school asks in writing, its data is deleted from the database, and Schedula confirms the deletion in writing on request. [TO CONFIRM: the deletion window for a school that stops using the service without deleting it.]
Requests from teachers and staff
If a person asks Schedula to see, correct or delete data the school entered, Schedula passes the request to the school and helps it respond.
Contact
contact@schedula.school