Data Processing Agreement

Data Processing Agreement for schools

Between the school, school board or district that uses Mindomo, or the teacher who uses Mindomo with a class (the “school”), and Expert Software Applications SRL, Str. Ciprian Porumbescu 5A, 300236 Timișoara, Romania (“Mindomo”, “we”).

1. Parties and scope

• The school is the controller. Mindomo is the processor.
• This DPA covers the personal data in the accounts and content of the school's students, teachers and staff, and of the students of a teacher's class, for as long as we process it for the school.
• Annex 1 describes the data. Where this DPA and the Terms of Use differ on personal data, this DPA prevails.

2. Instructions

We process the data only to provide Mindomo to the school, its students and its staff, as its admins and teachers configure it, and on its other documented instructions, unless the law requires otherwise; we then tell the school first, unless the law forbids it. We tell the school if we think an instruction breaks data protection law. We never sell the data, never use it for advertising, and never use it to train AI models.

3. Confidentiality

Everyone at Mindomo who can access the data is bound to confidentiality, and accesses it only when needed to provide the service or support.

4. Security

We protect the data with the technical and organizational measures described on our Security page. Mindomo is certified to ISO/IEC 27001 and ISO/IEC 27701.

5. Sub-processors

• The school authorizes the sub-processors in Annex 2. Each is bound by a contract with the same data protection obligations as this DPA.
• We announce a new sub-processor at least 30 days in advance, on this page and by email to the school's admins. The school may object for a reasonable data protection reason; if we cannot address it, the school may end its licence and get the unused part of its fee back.
• Transfers outside the EU rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. Help

We help the school answer requests from students, parents and staff (access, correction, deletion, export), mostly through the tools in Mindomo and its admin console, and with its own assessments, such as a data protection impact assessment. We forward to the school any request we receive about its data, including a parent's.

7. Breaches

We notify the school of a personal data breach that affects its data without undue delay after we become aware of it, with what we know and what we are doing about it, and update it as we learn more.

8. When the licence ends

The school decides what happens to its data. It may ask at any time for an export or for deletion, through support or the admin console. If it gives no instruction when its licence ends, the following applies, and the school chooses it by accepting this DPA:

• Accounts whose users accepted our Terms of Use themselves (teachers, staff, and students who signed up on their own) continue as the users' own accounts, with their content. From the end of the licence, Mindomo is the controller for them, under its Privacy Policy.
• Accounts the school created (with a PIN, a CSV import or a class roster, or through Clever, Skolon or LTI) stay the school's data, unchanged, so a renewal continues where it stopped. We may delete one that nobody has signed in to for 12 months after the licence ended, after notifying the school's admins. We never turn such an account into a personal account on our own: a student who wants to keep using it must first accept our Terms themselves.
• The school can ask instead for all its accounts to be deleted, or only the accounts it created.

9. Audits

We show compliance with this DPA through our ISO/IEC 27001 and 27701 certificates and their audit reports, and by answering the school's reasonable questions. On-site audits take place only where the law requires them, with reasonable notice, at the school's cost.

Annex 1. What we process

• People concerned: the school's students, teachers and staff; parents, where a student names one for approval; other people the school invites.
• Data: account data (name, email address or username, role, age band, class and group membership); the content they create, upload and share; comments, assignments, feedback and grades; Mindomo AI requests and assistant chats, where the school allows Mindomo AI; security logs (IP address, browser, sign-ins).
• Purpose: providing Mindomo to the school, its students and its staff, for education.
• Duration: while the school uses Mindomo, then as §8 describes.
• Location: hosted in Germany, with backups in Germany.

Annex 2. Sub-processors

Services the school connects itself, such as Clever, Skolon, Yilan, its learning platform (LTI), its single sign-on (SAML) or Google Classroom, are the school's own services, not our sub-processors.

When a feature searches the web or searches for images through Microsoft, the search query goes to Microsoft's search service, which may process it outside the EU. For these searches Microsoft is not our sub-processor: it handles the query on its own responsibility, under the Microsoft Privacy Statement.

Annex 3. Country terms for schools

United States

• Mindomo acts as a “school official” with a legitimate educational interest under FERPA, under the school's direct control over the use and maintenance of education records.
• The school authorizes its students' accounts under COPPA, for educational use only, and for no other commercial purpose.
• No advertising to students, no selling of student data, and no profiling of students.
• With a paid licence, we sign a district's or state's own data privacy agreement on request.

Canada

• The school board keeps custody and control of its students' personal information, under Ontario's Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) and the equivalent laws of the other provinces, such as British Columbia's FOIPPA, Québec's Law 25 and Alberta's privacy laws.
• The data is stored in Germany.
• At the end of the contract, we return or delete the data as the board instructs (§8).
• With a paid licence, we sign a board's own agreement on request.

United Kingdom

• UK GDPR and the Data Protection Act 2018 apply, in place of the GDPR where relevant.
• Our representative in the United Kingdom: Silvana Carpineanu, dpo@mindomo.com.
• Transfers from the UK follow UK rules: the UK Extension to the EU-US Data Privacy Framework, or the UK addendum to the standard contractual clauses.

How schools accept this DPA

• Every school and teacher, on any plan, free or paid: this DPA applies when an admin accepts the Terms of Use for the school, or when a teacher uses Mindomo with a class. Nothing needs to be signed.
• With a paid licence, we also provide a countersigned copy of this DPA, or sign the school's, district's or board's own agreement. Ask support@mindomo.com.

Data Processing Agreement for businesses

Between the company, team or other organization that uses Mindomo for its members (the “organization”), and Expert Software Applications SRL, Str. Ciprian Porumbescu 5A, 300236 Timișoara, Romania (“Mindomo”, “we”). Schools use the version for schools.

1. Parties and scope

• The organization is the controller. Mindomo is the processor.
• This DPA covers the personal data in the accounts and content of the organization's members (employees, contractors and the other people it adds to its team), for as long as we process it for the organization.
• Annex 1 describes the data. Where this DPA and the Terms of Use differ on personal data, this DPA prevails.
• For the organization's purchases and invoices, and for its admins' contact details as our customer, Mindomo is a controller, under its Privacy Policy.

2. Instructions

We process the data only to provide Mindomo to the organization and its members, as its admins configure it, and on its other documented instructions, unless the law requires otherwise; we then tell the organization first, unless the law forbids it. We tell the organization if we think an instruction breaks data protection law. We never sell the data, never use it for advertising, and never use it to train AI models.

3. Confidentiality

Everyone at Mindomo who can access the data is bound to confidentiality, and accesses it only when needed to provide the service or support.

4. Security

We protect the data with the technical and organizational measures described on our Security page. Mindomo is certified to ISO/IEC 27001 and ISO/IEC 27701.

5. Sub-processors

• The organization authorizes the sub-processors in Annex 2. Each is bound by a contract with the same data protection obligations as this DPA.
• We announce a new sub-processor at least 30 days in advance, on this page and by email to the organization's admins. The organization may object for a reasonable data protection reason; if we cannot address it, the organization may end its licence and get the unused part of its fee back.
• Transfers outside the EU rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. Help

We help the organization answer requests from its members (access, correction, deletion, export), mostly through the tools in Mindomo and its admin console, and with its own assessments, such as a data protection impact assessment. We forward to the organization any request we receive about its data.

7. Breaches

We notify the organization of a personal data breach that affects its data without undue delay after we become aware of it, with what we know and what we are doing about it, and update it as we learn more.

8. When the licence ends, or a member leaves

The organization decides what happens to its data. It may ask at any time for an export or for deletion, through support or the admin console. If it gives no instruction when its licence ends, the following applies, and the organization chooses it by accepting this DPA:

• Accounts whose users accepted our Terms of Use themselves continue as the users' own accounts, with their content outside the team's shared folders. From the end of the licence, Mindomo is the controller for them, under its Privacy Policy.
• Any account the organization created itself stays the organization's data, unchanged, so a renewal continues where it stopped. We may delete one that nobody has signed in to for 12 months after the licence ended, after notifying the organization's admins.
• The organization can ask instead for all its accounts to be deleted, or only the accounts it created.

When a member leaves the team while the licence runs, the content they created in the team's shared folders stays with the team if an admin removes them; a member who leaves on their own may take it with them when they continue on a paid plan of their own, and otherwise it stays with the team. The full rule is in Part B of the Terms of Use.

9. Audits

We show compliance with this DPA through our ISO/IEC 27001 and 27701 certificates and their audit reports, and by answering the organization's reasonable questions. On-site audits take place only where the law requires them, with reasonable notice, at the organization's cost.

Annex 1. What we process

• People concerned: the organization's employees, contractors and other members, and the people it invites to work with them.
• Data: account data (name, email address, role, group membership); the content they create, upload and share; comments and tasks; Mindomo AI requests and assistant chats, where the organization allows Mindomo AI; security logs (IP address, browser, sign-ins).
• Purpose: providing Mindomo to the organization and its members.
• Duration: while the organization uses Mindomo, then as §8 describes.
• Location: hosted in Germany, with backups in Germany.

Annex 2. Sub-processors

Services the organization connects itself, such as its single sign-on (SAML), are the organization's own services, not our sub-processors.

When a feature searches the web or searches for images through Microsoft, the search query goes to Microsoft's search service, which may process it outside the EU. For these searches Microsoft is not our sub-processor: it handles the query on its own responsibility, under the Microsoft Privacy Statement.

Annex 3. Country terms for businesses

United Kingdom

• UK GDPR and the Data Protection Act 2018 apply, in place of the GDPR where relevant.
• Our representative in the United Kingdom: Silvana Carpineanu, dpo@mindomo.com.
• Transfers from the UK follow UK rules: the UK Extension to the EU-US Data Privacy Framework, or the UK addendum to the standard contractual clauses.

United States

• Where a US state privacy law such as the California Consumer Privacy Act applies to the organization, Mindomo acts as its “service provider” or “processor”: we use the data only to provide Mindomo to the organization, and do not sell or share it, or combine it with data from other sources for our own purposes.

How organizations accept this DPA

• Every organization, on any plan, free or paid: this DPA applies when an admin accepts the Terms of Use for the organization. Nothing needs to be signed.
• With a paid licence, we also provide a countersigned copy of this DPA, or sign the organization's own data processing agreement. Ask support@mindomo.com.