Privacy Policy

1. Who we are

Intra 2.0 is built and hosted by:

• Sp/f Kodio
• Heiðavegur 100, 600 Saltangará, Faroe Islands
• Company reg. (V-tal): 612111
• Phone: +298 20 00 00
• Email: kodio@kodio.fo
• Data protection: gdpr@kodio.fo

Kodio is usually the processor for content and personal data that a customer organisation (company, institution, or kindergarten) puts into Intra 2.0. The customer is the controller of that data. Kodio may also be the controller for limited data needed to run the platform, such as sign-in, technical logs, and customer support.

2. What this policy covers

This policy covers Intra 2.0 at app.intra.fo and the iOS and Android apps that use the same service. It applies to staff, leadership, parents/guardians, and pickup users who have an account.

This page is not the data-processing agreement with the customer. Processing of customer data follows that agreement and applicable data-protection law.

3. Personal data we process

We process only what is needed to run Intra 2.0 for the organisation. That can include:

Account and identity. Name, email, profile photo, and sign-in details managed through Clerk, plus organisation membership, role, and audience (staff, parent, or pickup).

Staff directory. Name, email, phone, job title, department, workplace, optional Facebook URL, and photo.

Children and attendance. Name, preferred name, birthdate, room, ID card, photo and photo consent, allergies, notes, guardians, pickup persons, and attendance/absence records (Protokoll). Children do not get their own Intra 2.0 account.

Communications and content. Chat messages, news posts, comments, documents, tasks, calendar and vacation information, meal enrolment, and in-app notifications.

Device and notifications. Web-push subscriptions and, when the mobile app is used, push tokens so we can deliver notifications. We do not collect advertising identifiers and we do not sell personal data.

Technical usage. IP address, browser or device information, and anonymous page views / Core Web Vitals through Vercel Analytics and Speed Insights. This is not used for advertising.

4. Purpose and legal basis

We process personal data to:

• provide, secure, and administer Intra 2.0 for the organisation
• sign users in and manage access
• send email and the push notifications you enable
• provide customer and technical support
• keep the service reliable, measure stability, and fix faults

Processing is based on Faroese data-protection law, in particular the contract with the organisation, legitimate interests in operating and protecting the service, and consent where that applies — for example optional Google Calendar overlay, child photo consent, and push notifications.

5. Children

Intra 2.0 is not directed at children as users. The app and website are for staff, leadership, and adults connected to the organisation.

If the organisation is a kindergarten or similar, staff may record children’s information as part of daily operations. That processing is done on behalf of the organisation as controller. We do not use children’s data for advertising, profiling, or sale.

6. Who receives the data

We do not sell personal data. Data is only shown to other people in the organisation according to the permissions the organisation sets. We use subprocessors to run the service:

• Clerk — sign-in, identity, and optional Google sign-in
• Neon — database (EU)
• Vercel — hosting, file storage, Analytics, and Speed Insights
• Pusher — realtime delivery
• Expo — mobile push notifications
• Giphy — GIF search in chat if you search for or send a GIF
• Google — optional calendar overlay and, if the organisation enables it, Google Chat notifications

Some providers are outside the Faroe Islands, including in the EU or the United States. When data is transferred, we use the contractual and security measures that are normally used for such transfers. The service is intended to run in Europe (Vercel `fra1` / Neon `eu-central-1`).

7. How long we keep data

We keep personal data while the organisation uses Intra 2.0, or for as long as needed for the purpose and legal obligations. After the customer agreement ends, data is deleted or returned according to the agreement with the organisation.

Personal fields on older attendance events (who recorded the event and free-text notes) are automatically anonymised after 12 months.

8. Security

Traffic is encrypted in transit (HTTPS). Access is limited to signed-in users in the correct organisation, and Intra controls permissions. We do not sell data and we do not use it for third-party advertising.

9. Your rights

Under Faroese data-protection law you may request access, rectification, erasure, restriction, objection and, in some cases, data portability. You may also withdraw consent where processing is based on consent.

Start with your organisation’s administrator, because the organisation is the controller for most of the content. You can also write to gdpr@kodio.fo. We will then confirm your identity and which rights you want to use.

You can permanently delete your Intra 2.0 account in the iOS or Android app (Profile → Delete account) or on the web at app.intra.fo/account/delete. Deletion removes your sign-in, memberships, device tokens, and profile data. Organisation content you authored (for example posts or chat) is kept without your name.

You may complain to the Faroese Data Protection Authority, Dátueftirlitið.

10. Cookies and similar technology

Intra 2.0 uses cookies and similar storage for sign-in (Clerk), selected preferences, and to keep the service working. We do not use advertising cookies or cross-site tracking for marketing.

11. Changes

We may update this policy when Intra 2.0 changes. The latest version is always on this page, with the date at the top.

12. Contact

Privacy and personal-data questions: gdpr@kodio.fo. Other enquiries: kodio@kodio.fo or +298 20 00 00.