Data Processing Agreement

EduDash processes the personal data the Controller enters into the Service only to provide the Service. This Agreement lasts as long as the Controller’s account exists and until the data is deleted.

• Data subjects: students (including children under 16), parents, the Controller’s staff and teachers.
• Types of data: name, contact details (phone, email), profile photo, classes and schedules, attendance, tasks, answers, grades, exams, certificates, notes, messages, emails and files.
• Special-category data (health and similar) must not be entered into the Service.

• Have a lawful basis to process the data;
• obtain parental consent for students under 16;
• tell students and parents that their data is stored in EduDash;
• enter only the data that is needed and be responsible for its accuracy.

• Process the data only on the Controller’s instructions (including instructions given through the Service’s features);
• ensure everyone with access to the data is bound by confidentiality;
• apply appropriate technical and organisational security measures (encrypted connections, row-level access rules, backups, least-privilege access);
• help the Controller answer data subjects’ requests;
• notify the Controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it;
• never use the data for advertising, profiling or its own purposes.

The Controller gives general authorisation to use these sub-processors: Supabase (database and files, Frankfurt, EU), Vercel (hosting), Cloudflare (network), Resend (email), and a payment provider for paid packages. At least 14 days before adding a new sub-processor we update this page and notify by email; the Controller may object or close the account. Each sub-processor is bound by obligations as protective as those in this Agreement.

Transfers outside the EEA take place only under a lawful mechanism (EU–US Data Privacy Framework, Standard Contractual Clauses).

The Controller can delete data in the Service at any time. When the account is closed, data is deleted within 30 days and fully removed from backups within 90 days, except data the law requires us to keep. Before closing, the Controller may ask for a copy of the data.

On the Controller’s reasoned written request, EduDash provides the information needed to show compliance with this Agreement.

If this Agreement conflicts with the Terms of Service on personal data matters, this Agreement prevails. Liability is governed by section 12 of the Terms of Service.

Contact: contact@edudash.net