How to Exercise GDPR Rights

Who can do this with default capabilities?


Freckle is committed protecting and securing data for all our teachers, parents and students including compliance with General Data Protection Regulation and the rights as listed for EU citizens in these data privacy and protection laws.

GDPR Overview


Under GDPR, EU data subjects are entitled to exercise the following rights:

  • Right of Access: Find out what kind of personal information is held about you and get a copy of this information.
  • Right of Rectification: Ask for your information to be updated or corrected.
  • Right to Data Portability: Receive a copy of the information which you have provided under contract so that you can provide that information to another organization.
  • Right to Restrict Use: Ask for your personal information to stop being used in certain cases, including if you believe that the personal information about you is incorrect or the use is unlawful.
  • Right to Object: Objecting to use of your information (where a party is processing it on legitimate interest basis) and to have your personal information deleted.
  • Right to Erasure: In certain circumstances, you may also have your personal information deleted.


Data controllers determine how personal data is processed, data processors process personal data on behalf of a data controller, and data subjects are persons whose personal data is collected or used.

Data controllers within or outside of the EU are required to respond to requests from EU data subjects who ask to exercise their GDPR rights.

  • Teachers & administrators are data controllers of the student data they collect, while Freckle is the data processor of this data.
  • Freckle is a data controller of very limited data about students—we may use things like cookie data and IP address for specific purposes as described in our Privacy Policy.
  • For data subjects like teachers and parents, Freckle is the data controller of personal data like name, email address, and digital identifiers like a cookie ID or IP address, among other things. We describe in detail the data we collect and how we use it in our Privacy Policy.

Teacher & Administrator Accounts

Managing Your Personal Data

Teacher & administrator accounts can be either individual teacher (or parent) accounts or as part of school or district accounts with multiple teachers. Freckle teachers & administrators can view, edit, delete, and download a lot of personal data directly.

These topics can help you manage your personal data:

Managing Student Data

Teacher & administrator accounts are required to respond to requests from EU data subjects who ask to exercise their GDPR rights. As a data processor, Freckle is not responsible for handling these requests on behalf of teachers or administrators.

These topics can help you manage student data:

Student Accounts

Student accounts are manually created by teachers or administrators or automatically by school management systems through which administrator grants access to Freckle to auto-create student accounts. You should contact the teacher or administrator who is responsible for editing, deleting, or giving you a copy of your student data.

If you're unable to get in touch with the teacher or administrator for your account, please try to retrieve the following information before contacting us:

  • Student username and class code
  • Name of the teacher who administers the student account
  • Name and address of school that the student belongs to

Since Freckle is not the data controller of student data, we can't directly handle these requests, but we'll do our best to identify and put you in contact with the teacher or administrator in question.

Site Visitors

A site visitor can be anyone that visits a Freckle webpage. Site visitors can delete personal data we might have stored about them at any time by clearing cookies and unsubscribing from marketing emails.

GDPR Requests

If you're unable to exercise your GDPR rights as an EU citizen using the information above, please contact us.

We respond to requests within 30 days. However, it may take longer to complete the request. We'll be sure to let you know these details over email. We use any information you give us in your request only to fulfill the request and delete it within 12 months.