Data privacy policy

For end users · Updated 27 October 2026

About this policy

This policy explains how ASIMUT SOFTWARE ApS ("we", "us") processes personal data when you use ASIMUT through a web browser or the iOS and Android apps.

The company provides scheduling, room booking and event management software to educational institutions. We process personal data only on behalf of your institution and according to its instructions. We do not use your data for our own purposes.

Who controls your data?

Your institution is responsible for your personal data (the data controller under the GDPR). It decides what information is stored, who can access it, how long it is retained and the legal basis for processing it.

ASIMUT SOFTWARE ApS acts as a data processor under an agreement with your institution.

We serve institutions worldwide under the applicable data protection laws, including the EU and UK GDPR, Swiss FADP, US FERPA, and relevant privacy legislation in other countries.

Your institution's own privacy policy, if provided, is available through the ASIMUT Help menu. Otherwise, contact your institution's administration or data protection officer.

What data we process

Depending on how your institution uses ASIMUT, personal data may include:

• Identity and contact information: Names, email addresses, institutional identifiers, roles and group memberships.
• Scheduling and attendance: Lessons, rehearsals, performances, room bookings, attendance and absence records.
• User-provided content: Comments, messages and files attached to events or bookings.
• Account and security information: Authentication details, login history, activity logs and administrator actions, including IP addresses and basic device and browser information recorded in security logs.
• App data: Login sessions and app settings stored on your device, and data associated with any device permissions you grant. If your institution uses presence detection, this includes Bluetooth and Wi-Fi readings (see Presence detection in the app). The app does not use GPS.

Personal data is provided by your institution, its staff or yourself, or collected automatically when you use ASIMUT.

ASIMUT is not intended for sensitive personal information such as health, religion or ethnicity. Nor is it intended as a platform for sharing political views, personal opinions and other information unrelated to organizing and planning activities at your institution. Please do not enter such information in free-text fields.

Presence detection in the app

Some institutions ask users to reconfirm their room bookings or report attendance. When you do this, ASIMUT records which room you are in. The room is identified by an ASIMUT Puck installed there, by the Wi-Fi network your device is connected to, as well as by your direct indication of your presence. In each case, your location is only collected at the moment you actively confirm a booking or report attendance.

When you start a confirmation, the app looks for nearby Pucks or reads basic details of the Wi-Fi network your device is connected to. It sends the Puck identifier, signal strength and Wi-Fi details to your institution's ASIMUT server, which determines the room, or only the building. The app does not use GPS, does not scan in the background or when closed, and does not track your location between confirmations.

The result, that you confirmed a booking or were present in a given room at a given time, becomes part of your scheduling data and follows the same retention rules. The raw Bluetooth and Wi-Fi readings are kept in system logs and deleted after the log retention period defined by your institution. This is to allow investigation if errors occur or if misuse is suspected.

Because this reveals which room you are in, we treat it as location data, and your device asks for your permission before the app can use it. Depending on your device, the request may refer to Bluetooth, location or both, even though GPS is not used. You can refuse or withdraw permission at any time in your device settings. This will limit your ability to reconfirm or report attendance. Without it, the app cannot detect your location automatically, but you may be able to reconfirm or report attendance manually, according to the policy of your institution.

How we use your data

We process personal data to:

• Provide schedules, room bookings, attendance management and other ASIMUT functions.
• Confirm your presence in a room when you ask the app to.
• Send operational notifications, including schedule changes and password resets.
• Provide calendar feeds and integrations.
• Maintain security, prevent misuse and provide technical support.

Support, testing and development use pseudonymized copies rather than live personal data.

We do not sell personal data, display advertising, track users across apps or websites, profile users, continuously track your location, or share personal data with AI services. The app contains no third-party advertising or analytics tools.

Processing is based on the legal grounds established by your institution, not on consent to this policy. Optional device permissions can be withdrawn through your device settings.

Service providers and international transfers

We use a limited number of service providers (sub-processors), carefully vetted to conform to ASIMUT software's commitments and policies. Each is bound by a data protection agreement requiring the same level of protection as our agreement with your institution. Your institution authorizes their use and is notified in advance of planned changes:

• Akamai Cloud, operated by Akamai Technologies, Inc., a publicly listed US company incorporated in Delaware and headquartered in Cambridge, Massachusetts.
• UpCloud, operated by UpCloud Oy, a privately held Finnish company headquartered in Helsinki and owned by its founders and European investors.
• Amazon Web Services, operated by Amazon Web Services, Inc., a US company headquartered in Seattle, Washington, and a subsidiary of Amazon.com, Inc.
• Mailgun, operated by Mailgun Technologies, Inc., a US subsidiary of the Swedish company Sinch AB. Mailgun provides email delivery services with separate processing regions in the EU and US.

Cloudflare normally provides DNS services for ASIMUT, which does not entail processing application data. It is only engaged as a sub-processor on a case-by-case basis if required to protect against security attacks, such as DDoS attacks, and only with your institution's prior approval.

• Cloudflare, operated by Cloudflare, Inc., a publicly listed US company headquartered in San Francisco, California.

Each institution's ASIMUT system runs on a separate virtual server instance in a datacenter location agreed with the institution. Generally, institutions in the US are hosted on Akamai Cloud, while institutions in the EU/EEA are hosted on UpCloud. For institutions elsewhere, the hosting location and provider are agreed individually, taking into account geographical proximity, available infrastructure and applicable data protection requirements.

Mailgun delivers emails sent by ASIMUT, using its EU processing region for institutions in the EU/EEA. For other institutions, either its EU or US region is used, depending on the agreed configuration.

Data from institutions in the EU/EEA is generally hosted and processed within the EU/EEA. If the agreed configuration requires processing outside the EU/EEA, international transfers are carried out in accordance with your institution's instructions and applicable data protection legislation. Where the GDPR applies, transfers outside the EU/EEA are subject to appropriate legal safeguards, such as an adequacy decision, the EU-U.S. Data Privacy Framework for participating US organizations, or the EU Standard Contractual Clauses.

We disclose personal data to public authorities only where required by law and inform your institution where legally permitted. Your institution can request the full, current list of sub-processors and the locations where its data is hosted.

Security

ASIMUT software operates under a documented information security framework, independently assessed annually since 2018 by BDO Risk Assurance under an ISAE 3000 Type 2 engagement. This provides independent assurance over the design and operational effectiveness of security and data protection controls, and is comparable in approach to a SOC 2 Type 2 audit, commonly used in the US and Canada. The latest assurance report is available to client institutions upon request. Service providers are required to provide annually audited ISO 27001 certifications of datacenter locations.

Security measures include:

• Separate dedicated virtual servers for each institution.
• Encrypted connections (TLS) and encrypted backups.
• Restricted administrative access with strong authentication and access logging.
• Staff confidentiality obligations and annual security training.
• Defined procedures for incident management and personal data breaches.

We notify your institution without undue delay if a personal data breach requires notification.

Data retention and account deletion

Your institution determines how long personal data is retained and manages the creation and deletion of user accounts. You cannot create an ASIMUT account through the app. Personal data is kept for as long as your institution uses ASIMUT, unless your institution has configured retention periods.

ASIMUT supports configurable retention periods for personal records, events and activity logs. Until data is permanently deleted, it can be restored at your institution's request. Once permanently deleted, it cannot be recovered from the live system. Encrypted backups are kept for 90 days before permanent deletion.

When an institution stops using ASIMUT, we return or delete all its data, including backups, according to its instructions.

How to request deletion

To request deletion of your ASIMUT account or personal data, contact your institution's ASIMUT administrator or data protection officer.

Your institution is responsible for processing the request. ASIMUT support is ready to assist your institution if required. If you contact us directly, we will help direct your request to the appropriate point of contact.

When your account is deleted, your institution may still be required to keep certain records, such as attendance, scheduling, booking history and security logs, for legal, academic or security reasons. These records are kept according to your institution's retention rules and are then deleted.

Uninstalling the app does not delete your institutional account or records stored on your institution's ASIMUT server.

Your rights

Depending on applicable law, you may have rights to:

• Access and obtain a copy of your personal data.
• Correct inaccurate information.
• Request deletion or restriction of processing.
• Object to certain processing activities or request data portability.

Under FERPA, eligible students and parents have specific rights concerning educational records.

Contact your institution to exercise your rights. ASIMUT SOFTWARE ApS assists institutions with responding to requests.

You may also complain to the relevant data protection authority. ASIMUT SOFTWARE ApS is established in Denmark, where its supervisory data protection authority is the Danish Data Protection Agency (Datatilsynet).

Children

ASIMUT is designed for higher education and is not directed at children. Institutions providing access to users under 18 are responsible for meeting applicable legal requirements.

Changes to this policy

We update this policy when necessary and notify institutions of significant changes. The date above indicates the latest revision.

Contact

For questions about your personal data or deletion requests, contact your institution first.

For questions about how ASIMUT SOFTWARE ApS processes personal data:

Company information