1. Who is responsible for the data
- The school is the controller of the personal data of students, parents and teachers entered into the application.
- MyIB processes this data on behalf of the school and only on its instructions, as a processor (Article 28 GDPR). Company details are in our privacy policy.
- We provide a data processing agreement (DPA) on request, before the pilot starts. Write to kontakt@myib.pl or book a demo.
2. Where the application runs
- The application interface (app.myib.pl) and the myib.pl website are static files served by Vercel Inc. No student data is stored in this layer.
- The API server (server.myib.pl) and the PostgreSQL database run in Docker containers on a VPS. All application data is stored there. The server provider and location are named in the data processing agreement.
- Application e-mails (invitations, password resets, deadline reminders) are sent through the SMTP server of an e-mail delivery provider (see section 9).
3. Encryption and backups
- All traffic to myib.pl, app.myib.pl and server.myib.pl uses HTTPS (TLS). The HSTS header makes browsers use an encrypted connection.
- Passwords are never stored in plain text – only bcrypt hashes are kept. Invitation links are stored only as SHA-256 hashes.
- The API server sets security headers (including Content-Security-Policy, X-Frame-Options and nosniff) and accepts requests only from allowed origins (CORS).
- Encryption at rest and the database backup policy (frequency, retention, location) are described in the data processing agreement.
4. Accounts and sign-in
- Accounts are created by the school administrator – one by one or by importing a CSV file. The file is checked first without saving anything, and the import is applied completely or not at all.
- New users receive an e-mail with a one-time link to set their password, valid for 72 hours.
- Users sign in with a username or e-mail address and a password. A session is a signed token valid for 12 hours by default; after that the user signs in again.
- A password reset requires a code sent to the e-mail address of the account.
- Rate limits on sign-in, password resets and form submissions make password guessing and abuse harder.
- Single sign-on (e.g. Google, Microsoft) is not available at the moment.
5. Roles and permissions
- Student – submits and changes their subject choice (until the choice window closes) and sees the history of their choices.
- Parent – sees the choices of the child linked to their account.
- Teacher (group tutor) – sees the progress and choices of the students in their group and comments on choices.
- School administrator (e.g. the DP coordinator) – configures subjects and choice rules, manages accounts, sees statistics, reports and the audit log.
- MyIB operator (super administrator) – sets up schools in the system and provides technical support.
Each school’s data is kept separate: the server checks the user’s role and school on every request, not only in the interface.
6. What data we store and why
| Data | Purpose |
|---|---|
| Username, e-mail address, first and last name (optional), password hash, role and school | Sign-in, permissions, invitations and reminders |
| Group (class) membership, link between a parent account and a child account | Teacher and parent views |
| Subject choices: subject, subject group, SL/HL level | The core purpose: collecting and validating choices, planning groups |
| Teachers’ comments on a student’s choice | Discussing the decision with the student |
| Information about reminders sent (type, date, deadline) | Never sending the same reminder twice |
| Audit log of choice changes: who changed what and when (subject IDs and levels, no comment text), IP address truncated to the network, shortened browser identifier | Accountability for changes (Article 5(2) GDPR) |
The application does not collect grades, national ID numbers, home addresses or phone numbers of students. It does not use Google Analytics or any other analytics, tracking or advertising tools.
7. Retention and deletion
- Audit log entries are kept for 3 years by default. Older entries are removed by an automatic daily job; the period can be adjusted to the school’s policy.
- The school administrator can delete user accounts of their school.
- Deleting a school from the system removes all of its data from the database in cascade: subjects, groups, choices, comments, reminders, the audit log and account assignments to the school.
- When the cooperation ends, we return the school’s data (export) and delete it within the period set in the data processing agreement – this also applies to backups.
8. Data export
- CSV: subject statistics (including groups below the minimum), the list of a group’s students and subjects, the audit log.
- PDF: a report for school leadership with a summary of choices. The list of students without a complete choice is included only when the administrator selects it.
- Students can see the history of their own choices in the application (right of access, Article 15 GDPR).
9. Subprocessors
| Provider | Scope |
|---|---|
| Vercel Inc. | Hosting of the static files of myib.pl and of the app.myib.pl interface (no database) |
| VPS provider (named, with the location, in the data processing agreement) | API server and PostgreSQL database with the application data |
| Mailtrap (e-mail delivery provider) | Sending application e-mails: invitations, password resets, deadline reminders |
| Google Ireland Ltd. | Only the myib.pl website and only with the visitor’s consent (Google Analytics 4). Not used in the application. |
We provide the current list of subprocessors together with the data processing agreement and inform the school in advance about intended changes (Article 28(2) GDPR).
10. Reporting security issues
Report vulnerabilities and suspected incidents to security@myib.pl. If a personal data breach affects a school, we notify the school without undue delay (Article 33(2) GDPR).