Data Controller vs. Data Processor
The General Data Protection Regulation (GDPR) distinguishes between organizations that control personal data and those that process it on behalf of others.
- The School as the Data Controller: The subscribing educational institution determines which students, parents, and staff are registered in the system, how their attendance is tracked, and how their grades are processed. The School is responsible for obtaining any necessary consent.
- School Stacker as the Data Processor: Stemlen Technologies operates the Platform, storing and processing data purely under the instructions of the subscribing School. We do not use student or parent data for advertising or unauthorized profiling.
Data Subject Rights & Support
Under the GDPR, individuals (students, parents, teachers, and staff) have specific rights regarding their personal data. School Stacker provides school administrators with self-service tools inside the Admin Portal to address these rights directly:
1. Right to Access & Portability
Administrators can export a student's complete academic ledger, attendance history, and profile records in standard JSON or CSV formats, allowing parents to transfer records to another school.
2. Right to Rectification
School clerks and teachers can edit profiles, modify grades, and update contact numbers immediately through their respective portals if records are inaccurate.
3. Right to Erasure ("Right to be Forgotten")
If a student leaves the institution, administrators can soft-delete or permanently purge their profile from the active tenant database. Purging permanently removes all related records from our cloud storage networks.
Our Sub-Processors
We use trusted third-party hosting partners and gateway services that comply with strict confidentiality and security clauses:
| Sub-Processor | Service Provided | Data Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud Infrastructure & Storage | India & EU Regions |
| Cashfree Payments | Fee Transaction Processing | India |
| Twilio / SMS Gateways | Emergency Notifications & Alerts | Global Nodes |
Data Protection Officer & EU Representative
We have designated a Data Protection Officer (DPO) to oversee our privacy practices and coordinate compliance requests.
If you are an EU citizen and have questions regarding your data processing, or if you want to submit a formal Data Subject Access Request (DSAR), please contact us:
- Email: legal@stemlen.com
- Mail: Data Protection Officer, Stemlen Technologies, Block A, 5th Floor, Madhapur, Hyderabad, TS 500081, India.