Access, correction and deletion

Information about privacy rights and responsibilities when using 321school in schools. The school owner assesses requests about student data, and Fjord Service assists according to documented instructions and the agreed scope.

Review draft v0.12. Content revised: November 12, 2026.

1. Contact the school or school owner

Students and parents normally contact the school or school owner about personal data from teaching activities. Fjord Service can be contacted at post@321skole.no.

• The school owner is responsible for assessing rights and responding. Fjord Service assists the school owner as processor under the agreement.
• Requests about personal private accounts or customer-relationship data can be sent directly to Fjord Service.

2. Identity and secure disclosure

Before disclosure, the recipient's identity and any authority to act for the student must be established. Provide only what is needed to identify the correct student and work.

• Include the relevant Space, task and period if known. Do not send passwords, student answers or secret access links in ordinary email.
• Where there is reasonable doubt about identity, further necessary information may be requested. The school can help locate the correct work when a student has used several devices or technical user IDs.

3. Access, correction and deletion

You can request access to your personal data, correction of inaccurate data and deletion where the conditions are met. Other privacy rights may also apply, depending on the processing.

• Access includes information about processing and a copy of personal data. Disclosure must also protect other students' rights.
• The school owner assesses whether data must be corrected, supplemented or deleted. Legally required retention, such as archiving duties, can limit the right to deletion.

4. Retention, files and copies

The draft agreement proposes target periods to be agreed with the school owner: student work and related audio/files during active teaching, deleted within 90 days of the agreed end; operational/error logs 30 days and security logs 90 days. School instructions, earlier deletion and return are agreed in annex D. Specific incident evidence may be retained separately with a documented basis and review date. Enforcement has not been fully verified in operation; procedures, export, copies and provider periods are completed separately.

• Firestore backups have 14-day retention. The Auth/file backup area has a lifecycle rule that makes copies eligible for deletion after 14 days and seven-day soft delete after actual deletion. The actual deletion time depends on when the lifecycle rule runs. Backup retention is separate from the student-work and log deadlines in Annex D.
• Removal from a Space, account deactivation and archiving are different from deleting content.
• Deletion must cover relevant attachments, file references and handling of copies. Old Firebase token links and signed links may require separate handling; membership removal does not necessarily revoke them.

5. Response deadlines and complaints

Privacy-rights requests must be answered without undue delay, normally within one month of receipt. Any lawful extension must be explained and notified within the original deadline.

• Fjord Service's practical assistance deadlines are agreed with the school owner. The agreement does not change statutory deadlines towards students and parents.
• Exercising privacy rights is generally free of charge. The school owner must respond and explain any refusal. You may complain to Datatilsynet, the Norwegian Data Protection Authority.

Practical arrangements

This overview describes the framework for handling requests. Practical procedures for secure disclosure, export, deletion, copies and documenting completed actions must be specified and confirmed in the data processing agreement and annexes.

Udir: students' privacy rights Datatilsynet: your rights