Data Processing Agreement

aiforschool.net · AI Safe Lens · Version 1.3 · Published 6 August 2026, revised 7 September 2026

This is the agreement required by Article 28(3) of Regulation (EU) 2016/679 (GDPR). It is a standalone document, incorporated by reference into the School Licence, and applies whenever we handle personal data on the School's behalf.

It can be reviewed, signed, and updated separately from the licence, so a school's data protection officer can be sent this document alone.

1. Roles

The School is the data controller.
AI SAFE LENS (Diana Szyperska, NIE Y7285659D, Manilva, Málaga, Spain) is the processor.

2. Subject matter, nature and purpose

We process a small amount of staff personal data so that the School's staff can reach the licensed materials, attend training, and receive certificates of completion. That is the entire purpose.

3. Duration

For the length of the School Licence, plus the retention periods in section 8.

4. Categories of data subject

Members of staff at the School whom the School enrols.

5. Types of personal data

Data	Why we hold it
Staff name	to issue a certificate of completion
Staff work email address	to send access links and renewal notices
Course or session attendance	to know who has earned a certificate
Certificate records (name, course, date)	so a lost certificate can be reissued
Billing contact name and email	invoicing and renewal

No pupil personal data is processed. The School must not send us pupil names, pupil work, assessment records, or any other pupil data. If pupil data reaches us by accident we will tell the School without undue delay and delete it.

No special category data under Article 9 is processed.

6. Our obligations

We will:

(a) process personal data only on the School's documented instructions, including on transfers outside the EEA, unless EU or Spanish law requires otherwise, in which case we will tell the School first unless the law forbids it. This agreement and the School Licence are the School's documented instructions.
(b) ensure anyone authorised to process the data is bound by confidentiality. At present that is Diana Szyperska alone.
(c) implement the Article 32 security measures set out in section 9.
(d) engage sub-processors only under section 7.
(e) assist the School in responding to data subject requests (access, rectification, erasure, restriction, portability, objection), taking into account the nature of the processing. Given the small volume, we will respond within 5 working days.
(f) assist the School with Articles 32 to 36, including personal data breach notification and any data protection impact assessment.
(g) on the School's choice, delete or return the personal data at the end of the agreement, and delete existing copies, except where EU or Spanish law requires retention (see section 8).
(h) make available the information needed to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections, by the School or an auditor it appoints, on reasonable notice and no more than once a year unless there has been a breach.

Breach notification: we will notify the School without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting the School's data, with the detail the School needs for its own Article 33 notification.

7. Sub-processors

The School gives general authorisation for the sub-processors below. We will give 30 days' notice before adding or replacing one, and the School may object on reasonable data protection grounds. If we cannot resolve an objection, the School may cancel the remainder of its licence and receive a pro-rata refund.

Sub-processor	Purpose	Location	Transfer mechanism
Cloudflare, Inc.	website hosting, access gating, edge delivery, and aggregate website analytics (Cloudflare Web Analytics: no cookies, no cross-site identifiers, no profile of any visitor)	US, global edge	EU Standard Contractual Clauses, incorporated into the Cloudflare Data Processing Addendum (v6.4, 3 April 2026). Cloudflare publishes its own sub-processor list at cloudflare.com/gdpr/subprocessors, with 30 days' notice of changes
Resend (Plus Five Five, Inc.)	automated purchase confirmation and access-link emails only. Email address only. No names, no attendance data, no certificate records, no correspondence	US	Article 28 Data Processing Addendum, plus EU-US Data Privacy Framework certification and the UK Extension
Proton AG	correspondence, certificates and any email we send by hand, from [email protected]	Switzerland	European Commission adequacy decision for Switzerland. No transfer safeguards required

We hold no self-managed database. Access to materials is granted by a cryptographically signed token, so we store no separate user account records of our own.

Analytics. We measure how the site is used in aggregate, to see which materials schools reach for. Should we later use a separate analytics provider for this, it is added as a sub-processor under the 30 days' notice in this section, with the same right to object.

7a. Independent controllers

Some parties involved in delivering the service determine their own purposes and means for the personal data they hold, and so act as controllers in their own right rather than on our instructions.

Stripe provides payment processing. Under Stripe's own Data Processing Agreement, Stripe Payments Europe Ltd (Ireland), Stripe Technology Company and the relevant Stripe regulated entity are joint controllers of payment data, which they process to meet their own legal obligations for payment services, fraud prevention, anti-money laundering and know-your-customer requirements. Stripe relies on the 2021 EU Standard Contractual Clauses (Modules 1 and 2) through its Data Transfers Addendum and is certified under the EU-US Data Privacy Framework.

The School's billing contact details are therefore governed by Stripe's own privacy terms alongside this agreement. A data subject request concerning payment data may need to be directed to Stripe. We will help identify where a request belongs.

7b. International transfers

Cloudflare and Resend are US-headquartered, so personal data covered by this agreement is transferred outside the EEA, under the mechanisms named in section 7. Proton is Swiss and covered by an adequacy decision. We do not claim that no data leaves the EEA.

We limit exposure by limiting the data. The personal data reaching a US provider is a single email address, sent so an automated purchase confirmation and access link can be delivered. Names, certificate records and all correspondence are handled through Proton in Switzerland. There is no pupil data and no special category data anywhere on the site, no advertising trackers, no cookies set for analytics, and no personal data inside the access tokens themselves. Site analytics are aggregate counts of page views, held by Cloudflare, which identify no visitor.

8. Retention

Data	Kept for
Access and login records	duration of the school licence, then 30 days
Certificate records	3 years after issue, so a certificate can be reissued
Billing records	6 years, as required by Spanish tax law (Ley General Tributaria)

Everything else is deleted within 30 days of the school licence ending.

9. Security measures (Article 32)

All traffic over HTTPS with HSTS enforced for one year.
Paid materials are protected by a signed-token gate; a valid token is required for access.
Access tokens carry no personal data. They contain a product identifier, a payment reference, and an expiry, never an email address or a name.
Secrets are held encrypted in Cloudflare environment settings, never in the code repository.
A content security policy restricts what the site may load. The site uses no third-party analytics or advertising trackers.
All access can be revoked at once by rotating the signing secret.
Independently scanned for security posture; most recent grade A (88%), 24 July 2026.

10. Liability and law

This agreement is governed by Spanish law. Liability follows the School Licence.

Contact for data protection matters: Diana Szyperska, [email protected].

← Back to aiforschool.net