Data Processing Agreement (art. 28 GDPR) — template

GDPR art. 28 · Template 13-10-2026

Download template (.docx) · Print or save as PDF

Parties

Controller (the School): {{SCHOOL_NAME}}, tax ID {{SCHOOL_TAX_ID}}, address {{SCHOOL_ADDRESS}}, represented by {{REPRESENTATIVE}} ({{ROLE}}). Data protection contact: {{SCHOOL_DPO_EMAIL}}.

Processor (Simulath): Amparo Corredor, tax ID (NIF) 22554493A, address Av. Rei en Jaume I, 3, Valencia (Spain), trading as Simulath. Contact: info@simulath.com.

1. Subject matter

The Processor provides the School with the Simulath educational simulator service (virtual classes, labs such as ElectraLab, AI tutor and teacher dashboard) and processes personal data on the School’s behalf only as needed to provide the service.

2. Duration

For as long as the School’s license or pilot is in force. Clause 11 applies at the end.

3. Nature and purpose

Enrolling students in classes with a code and pseudonym; recording progress and lab activity; AI tutor answers; aggregate information for the teacher. Purpose: teaching support as decided by the School. Simulath does not use the data for its own purposes, advertising or commercial profiling.

4. Data and data subjects

Data subjects: students (including minors) and teachers of the School. Data: student pseudonym, class, labs used, progress, attempts, activity dates, technical session identifier; messages to the AI tutor and technical simulation context; teacher email and classes. No special categories of data (art. 9 GDPR). The School will tell students not to enter their full name or personal data in the chat.

5. School’s obligations

Determine the legal basis and inform students and families (arts. 13-14 GDPR); provide only necessary data; give documented instructions; oversee the processing.

6. Processor’s obligations

a) Process data only on the School’s documented instructions, including on international transfers, and inform the School if an instruction infringes the law. b) Ensure confidentiality of authorized persons. c) Apply the security measures in clause 7. d) Comply with the sub-processing conditions (clause 8). e) Assist the School with data-subject requests (clause 9). f) Assist the School with arts. 32-36 GDPR (security, breaches, impact assessments). g) Delete or return data at the end (clause 11). h) Make available the information needed to demonstrate compliance and allow reasonable audits with prior notice. i) Keep a record of processing activities as processor (art. 30(2) GDPR).

7. Security measures

HTTPS/TLS for all traffic; HSTS; Secure and HttpOnly session cookies; access restricted to the owner; students without email or password (pseudonym); backups {{BACKUP_FREQUENCY}}; incident log.

8. Sub-processors

The School gives general authorization for the sub-processors below. The Processor will inform the School at least 30 days before adding or replacing one, and the School may object. Each sub-processor will be bound by equivalent obligations.

9. Data-subject rights

If a student, family or teacher contacts the Processor, it will inform the School within 10 business days and help it respond (e.g. exporting or deleting a class’s or a pseudonym’s data).

10. Personal data breaches

The Processor will notify the School without undue delay and at the latest within 48 hours of becoming aware of a breach, with the information in art. 33(3) GDPR available at that time.

11. End of processing

At the School’s choice, the Processor will return the data (CSV export) or delete it within 30 days of the end of the service, unless retention is legally required, and will confirm in writing on request.

12. International transfers

Some sub-processors are in the US. Transfers rely on the EU-US Data Privacy Framework (where certified) or Standard Contractual Clauses (art. 46 GDPR).

13. Artificial intelligence

The AI tutor always discloses that it is an AI, does not grade or make decisions about students, and pedagogical decisions remain with the teacher. Messages to the tutor are sent to OpenAI to generate the answer.

14. Governing law

This agreement is governed by the GDPR and Spanish law. It prevails over other agreements between the parties on data protection matters.

Annex I — Authorized sub-processors

Signatures

For the School: ____________________ Date: __________

For the Processor: Amparo Corredor ____________________ Date: __________