Last updated: April 7, 2026
1. Introduction
Undralingur ehf. (“Wonderling”, “Undralingur”, “we”) provides its reading platform to schools, municipalities, school districts, and individual teachers (collectively “Educators”) for educational use. This privacy policy explains how personal data is handled when the Services are used in an educational context.
This policy applies to Educators and their students. If you use Wonderling/Undralingur as an individual subscriber, please refer to our Privacy Policy for Individuals, available on our website.
Our platform is designed to work without collecting personally identifiable information from students. Student accounts are anonymous — no names, email addresses, or other personal identifiers are required. The only potential personal data is an optional profile tag, which the Educator controls and may choose to keep anonymous (e.g., a number instead of a name).
2. Roles and Responsibilities
When the Services are used through an Educator:
The Educator is the data controller — the Educator determines the purposes and means of processing student data, including whether to identify students by name or use anonymous identifiers.
Undralingur is the data processor — we process student data solely on behalf of and under the instructions of the Educator.
This policy, together with the Data Processing Terms below, constitutes the data processing agreement between the Educator and Undralingur as required by GDPR Article 28. By using the Services, the Educator accepts these terms.
3. How Students Access the Services
Students access the Services through access codes provided to the Educator by Undralingur. Student accounts are anonymous — no email address, password, or third-party sign-in is required or collected.
Educators may assign identifying tags (such as a student’s name or a number) to student profiles. The Educator decides whether these tags contain personal data. Undralingur does not require identifiable information for student profiles to function.
4. What Data Is Processed?
Student accounts are anonymous by default. No email address, name, or other personal identifier is required to use the Services. The only potential personal data is the profile tag, and whether that contains identifiable information is entirely the Educator's choice.
4.1 Student Profile Data
Profile tag (name or identifier, as set by the Educator)
Avatar selection
Language preference
Reading settings (text level, reading speed, display preferences)
4.2 Reading Activity
Per student profile:
Books accessed and pages read
Reading time and duration
Reading progression
4.3 Speech Features
The platform may offer speech-based reading exercises that use the device microphone. These features:
Require explicit Educator consent before activation
Can be revoked at any time
Record audio only during active reading exercises
Send audio to our own servers (hosted in the EU) for analysis
Do not store recordings — audio is processed and immediately deleted
Are not used for biometric identification
4.4 Educator Contact Data
If the Educator provides contact details (name, email, phone number) for administration purposes, we process this data as a data controller based on our legitimate interest in managing the business relationship.
5. Optional Analytics and Crash Reporting
The Services include anonymous usage analytics and crash reporting to improve the platform. These are anonymous by design — no student personal data is linked to analytics identifiers.
Educators may opt out of:
Analytics collection — anonymous reading patterns and usage data
Crash reporting — anonymous technical error data
To opt out, contact us at personuvernd@undralingur.is Opting out does not affect the functionality of the Services.
6. Security
Data is transmitted using HTTPS encryption
Our database enforces access controls so users can only access their own data
Student accounts require a valid access code for content access
Crash reporting is configured with personal data collection (PII) disabled
We use reputable, industry-standard security solutions
No system can be guaranteed to be 100% secure. If you believe the security of an account has been compromised, please contact us immediately.
7. Sub-processors
We use the following categories of sub-processors to provide the Services:
Category | Hosting Location |
|---|---|
Cloud database and authentication | EU |
Backend API hosting | EU |
Analytics (if not opted out) | EU |
Crash reporting (if not opted out) | US |
For transfers to the United States, we ensure an equivalent level of protection through the EU–U.S. Data Privacy Framework.
In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to applicable data protection law and the Educator’s rights under these terms.
We will notify the Educator before adding or replacing sub-processors. The Educator may object to a new sub-processor within 14 days of notification. If the objection cannot be resolved, the Educator may terminate the agreement.
8. Data Retention
Student data is retained for as long as the Educator’s access code is active, and after expiry until the Educator requests deletion or anonymization.
Educator contact data is retained for as long as we have an active business relationship, and for up to 24 months after the relationship ends.
Accounting and invoicing data is retained in accordance with Icelandic bookkeeping obligations.
Upon request, we will anonymize or delete student data within 30 days.
9. Student and Educator Rights
Students
As student accounts are anonymous by default, GDPR data subject rights (access, rectification, erasure, etc.) apply only where the Educator has chosen to assign identifiable tags to student profiles. In such cases, the Educator as data controller is the first point of contact for data subject requests. We will assist the Educator in fulfilling such requests.
Educators
Educators may at any time:
Request access to data processed on their behalf
Request data export in a reasonable format
Request deletion or anonymization of student data
Opt in or out of analytics and crash reporting
To make a request, contact us at personuvernd@undralingur.is.
10. Data Processing Terms
The following terms apply to Undralingur’s processing of personal data on behalf of the Educator, in accordance with GDPR Article 28.
10.1 Scope of Processing
Undralingur processes student data solely for the purpose of providing the reading platform Services as described in this policy. We do not process student data for any other purpose, including marketing or profiling.
10.2 Undralingur’s Obligations
Undralingur shall:
Process personal data only on documented instructions from the Educator (as defined in this policy and the Terms of Use)
Ensure that persons authorized to process personal data are bound by confidentiality obligations
Implement appropriate technical and organizational security measures
Assist the Educator in responding to data subject requests
Assist the Educator in ensuring compliance with security, breach notification, and data protection impact assessment obligations
At the Educator’s choice, delete or anonymize all personal data after the end of the service, unless retention is required by law
Make available to the Educator all information necessary to demonstrate compliance with these obligations
10.3 Sub-processors
Undralingur uses the sub-processors listed in Section 7. The Educator grants general authorization for these sub-processors. We will notify the Educator before changes as described in Section 7.
10.4 Data Breach Notification
In the event of a personal data breach affecting student data, Undralingur will notify the Educator without undue delay and no later than 48 hours after becoming aware of the breach. Notification will include the nature of the breach, categories of data affected, and measures taken or proposed to address it.
10.5 Audits
The Educator may request information to verify Undralingur’s compliance with these data processing terms. Undralingur will cooperate with reasonable audit requests, provided they are scheduled with reasonable notice and do not disrupt operations.
10.6 Data Export
Upon request, Undralingur will provide the Educator’s data in a reasonable, machine-readable format within 30 days.
11. Communication
Undralingur does not communicate directly with students. All communication regarding the Services is directed to the Educator’s contact person.
12. Changes
We may update this privacy policy to reflect changes in our services or applicable law. Educators will be notified of material changes via email or through our platform at least 14 days before changes take effect.
13. Governing Law
This policy and the data processing terms are governed by the laws of Iceland. Disputes shall be brought before the District Court of Reykjavik.
14. Contact Information
Undralingur ehf.
Address: Undralingur ehf., Hlíðasmári 8, 201 Kópavogur, Iceland
Privacy enquiries: personuvernd@undralingur.is
General enquiries: hallo@undralingur.is
15. Complaints
If an Educator or data subject has concerns about how we process personal data, please contact us at personuvernd@undralingur.is.
Complaints may also be filed with the Icelandic Data Protection Authority (Personuvernd).
