ProsteProste Homework

Draft — the final text will be approved before the public launch.

Data processing agreement (DPA)

Concluded by acceptance in the app — at sign-up or, with sign-in through Google, before the account is first used — between the teacher or tutor who creates the account (the "Controller") and IBEX Maciej Kuś, ul. Szlifierska 5/6, 58-309 Wałbrzych, Poland (the "Processor"), under Article 28(3) GDPR.

1. Subject matter and duration

The Controller entrusts the Processor with processing the personal data of the Controller's students for the use of the ProsteProste service. The agreement lasts as long as the account exists and ends when it is deleted; the deletion obligations last until they are fulfilled.

2. Nature and purpose of processing

Storing, organising and making data available to the Controller and — through links the Controller generates — to students and parents, in order to run review assignments and show progress. The Processor does not process the data for any other purpose, in particular not for advertising, marketing profiling or training artificial intelligence models.

3. Types of data and categories of data subjects

  • Data subjects: the Controller's students (children) and, indirectly, their parents using the read-only link.
  • Data: the nickname chosen by the Controller, group membership, assignments, access links, answers in exercises (the word or sum practised, game type, correctness and answer rating, response time, hint use, device time and time saved) and the review schedule computed from them.
  • No special categories of data are processed. The Controller does not enter children's full names or contact details.

4. Processor's obligations

  • Processes the data only on the Controller's documented instructions — using the service's features is the instruction — including with regard to transfers to a third country, unless required to do so by Union or Member State law to which the Processor is subject.
  • Ensures that persons authorised to process the data are bound by confidentiality.
  • Applies the security measures in section 5.
  • Immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

5. Security measures (Article 32 GDPR)

  • Encrypted connections (HTTPS) end to end; the application server is reachable only through Cloudflare's network.
  • Data minimisation: nicknames only, no contact details of children.
  • Random, 128-bit, revocable access links; each teacher sees only their own resources.
  • Passwords stored as argon2 hashes and password reset links only as hashes; limits on sign-in and sign-up attempts; protection against cross-site requests (CSRF).
  • No third-party scripts or tools and no cookies on children's screens.
  • Daily backups, encrypted at rest and kept for 30 days (the newest three always, none longer than 35 days), with a monthly restore test.
  • Production access only for authorised persons, with least-privilege tokens rotated every 6 months.

6. Sub-processors

The Controller gives general authorisation for the Processor to engage other processors (Article 28(2) and (4) GDPR). At the date of the agreement they are:

  • ⟦VPS provider and data centre country⟧ — application and database server,
  • Cloudflare, Inc. — traffic proxying (the app, the website and the media files from media.prosteproste.pl), attack protection, backup storage (Cloudflare R2); transfers to the United States under the EU–US Data Privacy Framework (Article 45 GDPR) or, where applicable, standard contractual clauses (Article 46(2)(c) GDPR),
  • ⟦Anthropic — the AI assistant (Claude) that operates the service, with possible access to logs and the database: whether it is a sub-processor is decided by the legal consultation⟧.

No student data is received by ⟦Amazon Web Services EMEA SARL (Amazon SES, eu-west-1) — confirm the provider and the entity (G4)⟧ (sending password reset e-mails to the Controller) or by Google (the Controller's sign-in with Google, if chosen).

The Processor informs the Controller by e-mail at least ⟦14 days — proposed⟧ before adding or replacing a sub-processor; the Controller may object and delete the account. Sub-processors are bound by data protection obligations no weaker than this agreement.

7. Assisting the Controller

The Processor helps the Controller meet its obligations towards data subjects (access, rectification, erasure, restriction, portability), mainly through the service's features: renaming a nickname, deleting a student and deleting the account, and otherwise on request to info@ibex.pl. It also assists with the obligations under Articles 32–36 GDPR, taking into account the nature of processing and the information available to it.

8. Personal data breaches

The Processor notifies the Controller of a personal data breach without undue delay (Article 33(2) GDPR) and no later than ⟦48 hours — proposed⟧ after becoming aware of it, with the information needed to assess the breach and, where required, to report it to the supervisory authority.

9. Deletion of data

  • When the account is deleted, the student and parent links stop working at once, and the Processor permanently erases the students' data by the daily clean-up — usually within a day, and within 30 days at the latest.
  • The data of a student removed from the group (archived) by the Controller is permanently erased 90 days after archiving; "Delete data now" erases it at once.
  • Data disappears from backups as they expire: after 30 days, 35 days at the latest.
  • Before deleting the account, the Controller may take the information it needs from the service's views or ask for a summary.

10. Information and audits

The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR and allows for audits, including inspections, at an agreed time and scope and at the Controller's expense.

11. Controller's obligations

The Controller ensures a legal basis for processing the students' data, informs parents that it uses the service and enters nicknames only.

12. Final provisions

The agreement is concluded in electronic form (Article 28(9) GDPR) by ticking the consent box in the app. For personal data matters it takes precedence over the terms of service. It is governed by ⟦governing law — proposed: Polish law⟧.