Who processes the data
OneClickSchool is the electronic school register that the school provides to its students and families. The data controller is the school that gave you your credentials: it decides which data is used and for how long, as explained in its privacy notice for students and families.
SIGMA SISTEMI SRL, Via Vittorio Veneto 19A, Capriate San Gervasio (BG), Italy, VAT no. IT02453640167, develops the app and the technical services that make it work, and processes the data on behalf of the school as data processor.
For register data and for your account, contact your school's office or its data protection officer. For questions about the app: info@sigma-sistemi.it, certified email pec.sigma-sistemi@legalmail.it, phone +39 02 90980299.
What the app is for
Students and parents use it to follow school life: grades, absences, notes, homework, lesson topics, calendar, documents such as the report card, school notices, parent-teacher meetings and fees. A parent with more than one child at the same school can switch between them. Accounts are not created in the app: the school creates them.
Choosing the school
On first launch you type the school code. The app looks it up in Sigma Sistemi's list of schools, hosted on Microsoft Azure in European Union data centres (Italy and Ireland), which returns the address of the school's server. From then on the app talks only to the school.
Signing in
- With the username and password provided by the school: the app sends them to the school's server, which checks them.
- With SPID or CIE (Italian digital identity), where the school has enabled it: the app opens the browser on Sigma Sistemi's sign-in service, hosted on Microsoft Azure in Italy, which goes through the gateway of the Italian Ministry of Education and Merit and your identity provider. The school receives your tax code, first and last name, and your email if the provider supplies it: they are used only to recognise the account. The sign-in service passes them through without storing them. A SPID or CIE sign-in stays valid on the phone for up to 30 days after last use.
Data handled by the app
The app shows the data the school keeps in the register and sends it the data you enter:
- grades, absences, late entries and early exits, with justifications. You write the reason for an absence yourself: there is no need to include health details;
- notes, lesson topics with the teachers' names, homework and attachments, teaching plans, calendar;
- documents such as the report card, the competence certificate, the guidance advice, certificates and the statement of school expenses, with the parent's acknowledgement where required;
- the class results board, when the school publishes it;
- school notices, with read confirmations and replies;
- parent-teacher meeting bookings: the school sends the family a confirmation email;
- fees: statement of account, receipts, invoices, canteen credit and purchases;
- the payer's data, i.e. first and last name, email and tax code, if you enter them for payments.
The school also records the first time each document is opened, to know the family has seen it. All this data stays in the school's systems, and the school decides how long to keep it.
Payments
Where the school offers it, parents can pay fees online with Nexi XPay: the app passes Nexi the data needed for the payment started, i.e. amount, description and the identifying details of the payer and the student, and opens Nexi's payment page in the browser. Card details are entered only on Nexi's page: neither the app, nor the school, nor Sigma Sistemi can see them. Nexi processes payment data under its own privacy policy.
Notifications
If you turn them on, the school alerts you to new notices with a notification. Notifications go through Firebase Cloud Messaging, a Google service: Google receives a code identifying the phone and the short text of the notification, i.e. the notice title. You can turn them off in your profile in the app or in the phone settings. "Sign out" deletes the notification code.
On the phone
- The username and the SPID or CIE sign-in are kept in the phone's secure storage. The password is kept there only if you choose "Remember credentials".
- The app also keeps the chosen school, the last student viewed with their class, a random installation code and the theme.
- PDFs and attachments stay in the app's temporary storage. With "Save" or "Share" you make a copy wherever you choose.
- "Sign out" deletes the saved password, the SPID or CIE sign-in and the notification code. Uninstalling the app deletes everything.
Error reports
If the app crashes or a request to the server fails, it sends a technical report to Sentry, a service of Functional Software, Inc. that collects app errors, with the data stored in the European Union (Germany). The report contains the point in the program where the error occurred, the latest screens opened, the phone model, the operating system and app versions, the student's code and name, the school name and, if a request failed, the data sent and the server's response.
It is used only for maintaining and supporting the app, to find and fix errors, not to track who uses the app. Reports are deleted automatically after at most 90 days.
Viewing PDFs
To display PDFs the app downloads the pdf.js viewer from cdnjs, a Cloudflare service. Cloudflare receives the IP address and the device type, never the document, which stays in the app.
Support
If you write to support from the app, your message and email reach Sigma Sistemi through the school's mail system, with a copy to you, and are used only to reply to you.
What the app does not do
- It shows no advertising and uses no analytics or tracking tools.
- It does not use location, contacts, photos, camera, microphone or calendar.
- Links to online meetings, enrolment and lesson materials open in the browser, outside the app.
Who sees the data
The data is not sold or transferred. It is seen by school staff, according to the school's rules, and by Sigma Sistemi only when needed for support. Microsoft (Azure), Google (Firebase Cloud Messaging), Functional Software (Sentry) and Cloudflare also process data on behalf of the school, as described above. Nexi, for payments, and the Italian Ministry of Education and Merit with the SPID and CIE identity providers, for sign-in, process data under their own privacy policies.
How long
Register data is kept by the school for the period required by school regulations and stated in its privacy notice. On the phone it stays until you sign out or uninstall the app. Error reports are deleted automatically, as stated above.
Students under 18
Student accounts, including those of minors, are created by the school for school purposes. The app asks for no consent for other purposes and contains no advertising.
Your rights
You can ask the school for access to the data, rectification, erasure, restriction of processing or portability, or object to the processing (Articles 15-22 of Regulation (EU) 2016/679). If you write to info@sigma-sistemi.it, we will forward the request to the school. To delete your account, contact the school. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).