How we work with GDPR
Pomelo is designed with privacy protection as a fundamental principle. Here we describe how we handle personal data, where data is stored and what measures we take to protect our users' privacy.
Because many of our users are children, we have placed extra emphasis on keeping data collection minimal and on making the information comprehensible even for younger students.
What personal data do we store?
We store only the data needed for the service to work:
- Name — to identify the user in the system
- Email address — for login and notifications
- Date of birth (optional) — if provided by the school, to adapt content to the age group
We do not collect special categories of personal data (so-called sensitive personal data) such as health data, ethnic origin or political opinions. There are no profile pictures, home addresses or phone numbers in the system.
Why is the data processed?
Personal data is processed to:
- Enable login and identify unique users
- Ensure that voting is carried out correctly (one vote per student)
- Send notifications by email
- Adapt content to the age group
The school processes personal data on the basis of its task carried out in the public interest under the Swedish Education Act (Article 6(1)(e) GDPR). Pomelo processes the data as a data processor on the school's behalf.
How are students' responses handled?
Students' privacy is central to how Pomelo is built:
- Anonymous surveys — When students answer learning-environment surveys ("Exit ticket"), the responses are stored entirely without any link to the individual student. The teacher sees only aggregated results for the class as a whole.
- Anonymous voting — Class votes are stored without any user information. It is not possible to see who voted for what.
- Class projects — In the structured work with class projects, responses can be linked to individual students internally in the system to enable follow-up. However, the teacher sees only compiled results at group level in the interface.
How long is the data kept?
Personal data is stored for as long as the school has an agreement with us. When the agreement ends, all data is deleted.
During the term of the agreement, the school is responsible for administering student data, including removing students who leave or change schools.
Where is data stored?
The entire Pomelo platform is operated by Elastx, a Swedish hosting company with data centres in Sweden. This means that:
- All data stays in Sweden
- Operations are handled by a Swedish company subject to Swedish law
- No data is subject to foreign legislation such as the US CLOUD Act
We do not use any foreign cloud services for the platform's operation or data storage.
Subprocessors
| Service | Provider | Purpose | Data location | Data shared |
|---|---|---|---|---|
| Hosting & database | Elastx (Sweden) | Operation of the platform | Sweden | All |
| Email delivery | Brevo (EU) | Transactional email, e.g. login codes | EU | Email address only |
Who is the data controller?
The school that uses Pomelo is the data controller for the personal data handled in the system. Yuzu Educational Thinking AB (company reg. no. 559558-8137), which develops and operates Pomelo, acts as the data processor.
A data processing agreement (DPA) is signed with every customer.
Your rights
As a user, you have the right to:
- Access the data we store about you
- Request rectification of incorrect data
- Request erasure of your data
Depending on the applicable legal basis, you may also have the right to request restriction of the processing or to object to it. Contact your school for more information.
If you are dissatisfied with how your personal data is handled, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Contact your school's administrator or us directly at support@hejpomelo.se to exercise your rights.
Cookies
We use one technically necessary cookie to keep you logged in. No tracking cookies or third-party cookies are used.
Automated decision-making
Pomelo does not make any automated decisions that affect users. All aggregation and compilation of results is done to give teachers and school management a basis for decisions – not to make decisions automatically.
Any questions?
Contact us at support@hejpomelo.se if you have questions about how we handle personal data.