Data processing agreement

This agreement, made under Article 28 of Regulation (EU) 2016/679 (GDPR) and the equivalent provisions of the UK GDPR, forms part of the terms of service and is accepted when you sign up for ClaseAlDía.

1. Parties

• Controller: the customer, the tutor or centre that signs up for the Service.
• Processor: the owner of ClaseAlDía, identified in the legal notice.

2. Subject matter

The processor processes personal data on the controller’s behalf solely to provide the Service: hosting and processing the pupil and family data the controller enters, managing timetables, attendance, notices and fees, and sending emails on the controller’s behalf.

3. Duration

This agreement lasts as long as the controller holds an account on the Service and until data has been returned or deleted under clause 11.

4. Nature and purpose of the processing

Hosting, storage, retrieval, organisation, communication by email, export and erasure of data, according to the Service’s features and the controller’s instructions.

5. Types of data and categories of data subject

• Types of data: identification and contact details of pupils and families (name, surname, year of birth, email address, phone number); enrolment and timetable data; attendance records and related notes; fee and payment data (amount, description, status, date, method); notices sent and notes the controller enters.
• Data subjects: pupils, including children, and their relatives or guardians, as well as the tutors or users the controller adds.
• The controller undertakes not to enter special categories of data (health, religion and so on) unless essential and then at its own responsibility, and to avoid doing so in note fields.

6. Obligations of the processor

• Process the data only on the controller’s documented instructions, which are those in this agreement and in the controller’s use of the Service. If it considers that an instruction infringes data protection law, it will tell the controller.
• Not use the data for its own purposes or disclose it to third parties, except to authorised sub-processors or where the law requires.
• Ensure that people with access to the data are bound by confidentiality.
• Apply the security measures in clause 8.
• Make available the information needed to demonstrate compliance with this agreement and allow reasonable audits, on notice and without disrupting the Service.

7. Sub-processors

The controller gives general authorisation to engage the following sub-processors:

Stripe is involved only in collecting the controller’s own subscription payments and receives no pupil or family data. The processor will tell the controller of any addition or replacement of sub-processors in reasonable time, so that it can object; if the objection is well founded and there is no alternative, the controller may cancel the Service. The processor will impose equivalent obligations on sub-processors and remains liable to the controller for their performance. International transfers rely on standard contractual clauses (with the UK Addendum or the UK International Data Transfer Agreement where relevant) or on the EU–US Data Privacy Framework and its UK Extension.

8. Security measures

• Encryption of communications (HTTPS).
• Passwords stored with a salted hash, with no way to recover them.
• Role-based access control: tutors can reach only their own groups and cannot see fees.
• Family-portal links with random identifiers the controller can regenerate.
• Limits on login attempts and on sending.
• The controller can export and delete the data itself.

9. Assisting the controller

Taking into account the nature of the processing, the processor will help the controller respond to data subjects’ rights (access, rectification, erasure, objection, restriction and portability). The Service lets the controller do most of these things directly (edit, export, mark as left or permanently delete). If the processor receives a request from a data subject, it will pass it to the controller without delay. It will also give reasonable help with data protection impact assessments and prior consultations where they apply.

10. Personal data breaches

The processor will notify the controller without undue delay and within 72 hours at most of becoming aware of a personal data breach, with the information available: nature, data and people affected, likely consequences and measures taken or proposed. Notifying the supervisory authority (the AEPD, the ICO, the Data Protection Commission or another, as applicable) and the data subjects, where required, is the controller’s responsibility.

11. Return and deletion of data

When the agreement ends, the controller can export its data from the app, including in read-only mode. The controller can delete its centre at any time, which permanently erases the data. If it does not, the processor may delete the data after a reasonable period following the end of the Service, on notice, unless the law requires it to be kept.

12. Obligations of the controller

• Have a legal basis for processing the data and have informed the data subjects.
• Obtain the consent of parents or guardians of children where the law that applies to the controller requires it.
• Enter only the data that is necessary and keep it up to date.
• Manage its users’ access and look after the family-portal links.

13. Governing law and language

This agreement is governed by the GDPR, Spanish Organic Law 3/2018 (LOPDGDD) and other applicable Spanish law and, to the extent the controller is subject to it, the UK GDPR and the Data Protection Act 2018. This translation is provided for convenience; if there is any discrepancy, the Spanish version prevails.