Data privacy
How Dugga protects your data.
Last updated: 1 October 2026
Privacy and security matter to us, especially because many of the people who use Dugga are students. Dugga Digital Assessment is built with data protection at its core, and we comply with the EU General Data Protection Regulation (GDPR) and, for our customers in the United Kingdom, the UK GDPR and the Data Protection Act 2018.
Our role
When a school, college, university or other organisation uses Dugga, it is the controller of its users’ personal data, and Dugga processes the data on its behalf as a processor, under a Data Processing Agreement. This means that the school decides how personal data is used, and we only process it on the school’s instructions. If you are a student or teacher with questions about how your data is used, please contact your school first.
Our commitments
Data stored in the EU: Personal data in Dugga is stored in Microsoft Azure data centres within the EU, in the Netherlands, Ireland and Sweden.
Strong security: Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Users sign in through single sign-on, and role-based access control ensures that everyone only sees what their role requires.
Aligned with ISO 27001: Our information security management is aligned with ISO/IEC 27001 and is reviewed through annual internal audits.
Only what is needed: We only process the personal data needed to provide the service. We never sell personal data or use it for advertising or marketing profiling.
AI without personal data: Our AI Exam Engine helps teachers create exam questions without processing any personal data, and the teacher always reviews and approves the questions.
Trusted sub-processors: We only use carefully selected sub-processors, each bound by a written data processing agreement. Where a provider is based outside the EU/EEA, we ensure appropriate safeguards.
Fast breach notification: If a personal data breach occurs, we notify the affected school without undue delay and no later than within 24 hours.
Deletion when the agreement ends: When an agreement ends, personal data is deleted within 90 days, unless the school has decided otherwise.
Open about availability: You can follow the availability of the service at any time on our status page, https://status.dugga.com.
Documents
Privacy Policy: How we process personal data, as processor and as controller. https://dugga.com/privacy-policy
Data Processing Agreement: Available to customers and prospective customers on request at privacy@dugga.com.
Contact
Questions about your personal data should primarily be sent to your school. For questions about Dugga’s processing of personal data, contact us at privacy@dugga.com, or our Data Protection Officer at dpo@dugga.com.
Dugga AB
Organization number 559006-5198
Sankt Eriksgatan 58, 112 34 Stockholm, Sweden
+46 (0)8 30 70 80 · office@dugga.com