Legal
Data processing agreement
The Art. 28 GDPR agreement. In legal review — here is what it will cover and what is already verifiable.
This document is not final
It is being reviewed by a lawyer and is not published as an agreement. If you need it now, write to us and we will send the current draft, marked as a draft.
Ask us for itWhat the agreement will cover
The processing agreement required by Art. 28(3) GDPR: subject matter and duration, nature and purpose, categories of data and of people, the controller's instructions, confidentiality, security measures, sub-processors, assistance with data-subject rights, breach notification, deletion at the end, and audit rights.
German-speaking institutions receive an Auftragsverarbeitungsvertrag in German. Others receive a DPA in English. They are the same obligation and not the same document — a German school presented with an English DPA will ask for an AVV, and rightly.
What is already true and verifiable
- Your institution is the controller; we are the processor. We do not decide what is recorded about a student.
- Four sub-processors, listed publicly with purpose and region. Three are in the EU. The fourth is the AI provider, and no lesson record reaches it.
- Data is in
europe-west3, Frankfurt. - Deletion is built in and runs daily, on a window you set, and it raises an alert if it leaves anything behind.
- Export and erasure for a single person are functions in the product, so you can act on a request without waiting for us.
Why it is not published
An Art. 28 agreement is the document a school's data protection officer reads most carefully, and one drafted without a lawyer would fail that reading. We would rather send you a draft marked as a draft than publish it as though it were signed.