Legal Terms

Duckling is operated by Duckling Media ApS, a social benefit corporation registered in Denmark (CVR 43764810), at Overgaden oven Vandet 98, DK-1415 Copenhagen, Denmark. Duckling, we and us mean this organisation. You means you, a member, storyteller, or visitor.

These terms cover your membership, your use of the Duckling platform and web player, and your participation in the community and its Ponds, the spaces within Duckling where stories are gathered and shared.

You can join Duckling and create a free account if you are 13 or older, which makes you a member of Duckling. If you are under 18 and want a paid membership, please make sure a parent or guardian is happy for you to do so. When you create an account, you are responsible for keeping your login details safe and for what happens under your account. Tell us promptly if you think someone else has gained access.

Creating an account in the app is free and makes you a member of Duckling. You can also become a paid member of the community to unlock more. The tiers and what each includes are described at the point of sign-up. Prices include applicable VAT.

The terms below apply to paid memberships:

• Renewal. Subscriptions renew automatically at the end of each period unless you cancel. We will make cancellation easy and findable.
• Cancelling. You can cancel any time. Cancellation takes effect at the end of the period you have already paid for, so we do not lock you in.
• Your statutory right to withdraw. As a consumer in the EU, you have 14 days to withdraw from a new subscription. Because membership gives you immediate access to digital content and services, by starting to use Duckling within those 14 days you ask us to begin right away and accept that the withdrawal right ends once we have. We will state this clearly at checkout.
• Refunds. Beyond your statutory rights, we handle refund requests fairly and case by case. Just ask.

You keep full ownership and copyright of everything you create and publish on Duckling. Nothing here transfers your work to us.

To make the platform work, you grant Duckling a non-exclusive, worldwide licence to host, display, and distribute your story, within Duckling and across any Ponds you choose to publish it to, for as long as you keep it published, always with attribution to you. For stories you make public, this licence also lets us feature them on Duckling’s own social media channels and newsletters, to bring readers to your work and to the community.

A few honest points:

• When you unpublish or delete a story, we stop distributing it. Because Ponds can cross-publish (carry the same story in more than one Pond) and federate (connect with other communities beyond Duckling), copies that have already been shared elsewhere may take time to clear, and some may persist outside our control. We will be transparent about this rather than promise what we cannot deliver.
• You confirm that you have the rights to everything you publish, that it is your own work or properly cleared, and that it respects the rights, privacy, and dignity of the people in it.

The Storyteller Pact is the heart of how this community behaves, and accepting it is part of joining. We assume good faith and build for trust, not surveillance.

Some things we cannot host, whatever the spirit: content that is illegal, that violates someone else’s rights, or that is built to harm or deceive. Each Pond governs its own culture under a Pond Charter; we step in only rarely, and as a last resort.

We build Duckling with care and run it as a long-term home for documentary storytelling, not a disposable product.

That said, we offer the platform as is. We cannot promise it will always be perfect, uninterrupted, or free of error, and we will sometimes change or pause features as the project grows. We are responsible for the things we control and for keeping our commitments to you. We are not liable for losses outside our reasonable control, and, to the extent the law allows, our total liability to you is limited to what you have paid us in the previous 12 months. None of this limits the rights you have as a consumer that cannot be waived, or our liability for anything the law does not allow us to exclude.

We collect the minimum we need to run Duckling and we do not sell your data. How we handle personal data is set out in our Privacy Policy, written to meet GDPR. That document governs privacy; this one does not override it.

If you use Duckling as an organisation, for example a school bringing students onto the platform, our Data Processing Agreement sets out how we process personal data on your behalf.

We may update these terms as Duckling evolves. For any meaningful change, we will give you reasonable notice (at least 30 days) before it takes effect, so you can decide whether to stay.

You can leave Duckling whenever you like. When you do, we will help you export your stories and we will delete your personal data in line with our Privacy Policy. We may suspend or close an account if someone seriously or repeatedly breaks these terms or the Storyteller Pact, but we will talk to you first wherever we reasonably can.

Come to us first. Most things are solved with a conversation: contact@duckling.co.

These terms are governed by Danish law, and any dispute falls to the Danish courts. If you are a consumer in the EU, you keep the mandatory protections of the country you live in, and you can also use the EU’s online dispute resolution platform.

Duckling Media ApS · Overgaden oven Vandet 98, DK-1415 Copenhagen, Denmark · contact@duckling.co

Free your story.

The Processor shall process personal data solely for the purposes set out in the Agreement and in accordance with the Controller’s documented instructions. The processing is undertaken to enable the Processor to provide a social media network in an app or website, which allows users to share multimedia stories, set up groups and interact with each other with likes, comments and similar means.

The Processor will process personal data only in accordance with the Controller’s Privacy Policy and Legal Terms, which may be amended from time to time. The Processor will not use personal data for any other purposes unless required to do so by applicable law.

The Processor shall process personal data for the duration of the provision of services under this Agreement. Upon termination of the services delivered to the Processor, the Processor will retain user data as necessary for its legitimate business purposes and compliance with applicable laws. However, Duckling shall return or securely delete the personal data upon request from individual users, provided such a request is made in accordance with the data subject’s rights under applicable data protection laws.

The Processor will collect, store, and process personal data as part of the service delivery. The processing activities may include data hosting, analytics, user authentication, recommendations, verification, and the blocking of content and users. The purpose of the processing is to enable the Processor to provide the services outlined in this Agreement.

The Processor may only grant access to personal data processed on behalf of the Controller to individuals who are subject to the Processor’s authority, have committed to confidentiality, or are bound by an appropriate statutory duty of confidentiality, and only to the extent necessary. The list of individuals granted access must be reviewed regularly. Based on this review, access to personal data may be revoked if it is no longer necessary, and such data must no longer be accessible to these individuals. Upon request from the Controller, the Processor must be able to demonstrate that the individuals under its authority are subject to the aforementioned confidentiality obligations.

The types of personal data to be processed may include:

• Contact details: name, email address and telephone number.
• Demographic information: school, age, gender.
• Usage data: user interactions such as likes and views.

The personal data to be processed pertains to the following categories of data subjects:

• Content creators who create stories and upload media on the Duckling platform.
• Content viewers who view or otherwise interact with stories and media on the Duckling platform.
• Supporters, teachers and mentors who offer learning and guidance on the platform.

The Controller acknowledges that it is responsible for ensuring that the personal data provided to the Processor is processed in compliance with applicable data protection laws. The Controller has the following obligations and rights:

• Ensure that all personal data shared with the Processor is lawfully collected and processed.
• Provide clear instructions to the Processor regarding data processing.
• Monitor the Processor’s compliance with data protection laws.
• Ensure the data subjects’ rights, such as the right of access, rectification and erasure, are upheld.

Under Article 32 of the GDPR, the Controller and the Processor must implement appropriate technical and organisational measures to ensure a security level proportionate to the risks posed to users’ rights and freedoms. These risks include unauthorised access, data breaches, identity theft, and profiling that could infringe on users’ privacy, digital autonomy, and civil liberties.

To mitigate these risks, the Processor must:

• Encrypt and pseudonymise critical private data to prevent unauthorised access.
• Ensure continuous confidentiality, integrity, and availability of user data.
• Implement robust access controls.
• Establish a rapid recovery system to restore data availability in case of cyberattacks or system failures.
• Conduct regular security audits and penetration testing to identify vulnerabilities.
• Maintain a transparent notification policy, informing users within 72 hours in case of a data breach.
• Store user data on GDPR-compliant servers, ensuring strict adherence to data protection laws.
• Restrict data processing to the minimum necessary and prevent the use of user data for unauthorised profiling or targeted advertising.
• Train all employees and subcontractors on data protection best practices to reduce human errors leading to breaches.

The Processor must also regularly assess evolving risks and, if necessary, introduce additional protective measures to uphold the digital rights, safety, and civil liberties of users, ensuring that no data processing activities expose them to discrimination, surveillance, or undue manipulation.

Taking into account the nature of the processing, the Processor shall assist the Controller as far as possible, by implementing appropriate technical and organisational measures, in fulfilling the Controller’s obligation to respond to requests regarding the exercise of data subjects’ rights as outlined in Chapter III of the GDPR.

This includes assisting the Controller, to the extent possible, in ensuring compliance with:

• The obligation to provide information when collecting personal data from the data subject.
• The obligation to provide information if personal data is not collected from the data subject.
• The right of access.
• The right to rectification.
• The right to erasure, the right to be forgotten.
• The right to restriction of processing.
• The obligation to notify regarding rectification or erasure of personal data or restriction of processing.
• The right to data portability.
• The right to object.
• The right not to be subject to a decision based solely on automated processing, including profiling.

The Processor shall further assist the Controller, taking into account the nature of the processing and the information available to the Processor, in fulfilling the following:

The Processor shall notify the Controller of any personal data breach within 24 hours of becoming aware of the breach, if possible, to enable the Controller to comply with its obligation to report the breach to the competent supervisory authority, Datatilsynet in Denmark, without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights or freedoms of natural persons, in accordance with Article 33 GDPR.

The Controller’s obligation to notify the data subject of a personal data breach without undue delay when the breach is likely to result in a high risk to the rights and freedoms of natural persons.

The Controller’s obligation to conduct an impact assessment regarding the intended processing activities’ consequences for personal data protection, a Data Protection Impact Assessment.

The Controller’s obligation to consult the competent supervisory authority, Datatilsynet in Denmark, prior to processing if a Data Protection Impact Assessment indicates that the processing would result in a high risk in the absence of measures taken by the Controller to mitigate the risk.

The Processor shall notify the Controller without undue delay upon becoming aware of a personal data breach.

Where possible, the Processor’s notification to the Controller shall occur no later than 72 hours after becoming aware of the breach, to enable the Controller to fulfil its obligation to report the breach to the competent supervisory authority in accordance with Article 33 of the GDPR.

The Processor shall assist the Controller in reporting the breach to the competent supervisory authority. This means the Processor shall help provide the following information, which, according to Article 33(3), must be included in the Controller’s report to the supervisory authority:

• The nature of the personal data breach, including, where possible, the categories and approximate number of affected data subjects, as well as the categories and approximate number of affected personal data records.
• The likely consequences of the personal data breach.
• The measures taken or proposed by the Controller to address the personal data breach, including, where relevant, measures to mitigate its possible adverse effects.

The Processor may engage sub-processors for specific tasks. The sub-processor shall be bound by the same data protection obligations as the Processor.

The Processor must notify the Controller of the use of new sub-processors by email or in-app notification, unless the Controller has specifically opted out of this type of communication.

Duckling must have Data Processing Agreements in place with sub-contractors, and ensure the agreement explicitly defines data protection obligations under the GDPR, or other applicable laws, as well as responsibilities regarding security, compliance, and breach notification.

Duckling Media ApS is currently using the following sub-processors:

• Stripe: Duckling uses Stripe for payments and billing.
• Google Cloud: Duckling uses Google Cloud for storage of data.
• Twilio: Duckling uses Twilio for authentication via SMS, so that a user signing up can verify their account with a text message.
• GitHub: Duckling uses GitHub to host the source code the platform is built from.
• Netlify: Duckling uses Netlify to build and serve the website.

Each Party shall be liable for any damages caused by its failure to comply with applicable data protection laws. The Processor shall indemnify the Controller against any claims arising from the Processor’s breach of this Agreement.

This Agreement shall be governed by the laws of Denmark, and any disputes shall be resolved in the competent courts of Copenhagen, Denmark.

By onboarding the Duckling platform and opting in to the Legal Terms, the Controller acknowledges and accepts the terms of this Data Processing Agreement. This acceptance signifies a commitment to comply with all obligations set forth in this Agreement and to process personal data in accordance with the applicable data protection laws.

Duckling Media ApS

CVR: DK43764810
Overgaden oven Vandet 98, DK-1415 Copenhagen, Denmark