Data Processing Addendum (DPA)

DRAFT — to be reviewed by a lawyer before publication. Last updated: 2026-10-24

This Addendum forms part of the Terms of Service between the customer (the tutor or school — "Controller") and SPÓŁKA GŁÓWNA ("Processor"). It applies automatically when the customer enters personal data of students, parents or other people into TutorHabitat. It is written to meet Art. 28 GDPR. UK GDPR processor terms and the UK International Data Transfer Addendum are not included because the service is not directed at the United Kingdom; they will be added if we later target the UK. Jurisdiction-specific processor terms (CCPA/CPRA and other US state laws, FERPA, Quebec Law 25, LGPD) are set out in Schedule 2 TO DRAFT before launching in the USA: CCPA/CPRA service-provider terms (Cal. Civ. Code §1798.100(d), CCPA Regs §7051) and prevail for data of residents of those jurisdictions.

1. Subject, duration, nature and purpose

• Subject: hosting and processing of data the Controller enters into the service.
• Duration: for the term of the customer's account, plus up to 30 days for deletion.
• Nature and purpose: storage, display and sharing in lessons; live voice/video calls relayed through our servers; scheduling, reminders and billing records. Recording, transcription and the AI tutor run only after the parent, legal guardian or adult student consents in the service; a student aged 13 or over may object to recording, and the Processor then disables recording for that student.

2. Categories of data subjects and data

• Data subjects: students (including minors), parents/guardians, payers, the Controller's staff.
• Data: live audio/video streams relayed in real time (not stored unless recording is on); names, contact details, school year and subjects, schedule and lesson history, amounts and payments recorded by the Controller, lesson content (boards, chat, notes, materials, homework), consent records; AI usage log (time, function, room, student and user identifiers, token counts, credits; no question or answer text), kept for 12 months (rolling), then reduced to monthly totals per function (number of calls, cost, number of active rooms) with student, room and user identifiers removed; with consent — voice recordings (deleted after transcription), transcripts, AI conversations.
• COPPA (students living in the USA under 13): the COPPA notice, the parent's e-mail used for it, the case file and the signed consent form are not processed on the Controller's behalf: the Processor handles them as operator under COPPA and as controller (see the Privacy Policy). The Controller's instruction is limited to marking the student and supplying the parent's e-mail. Lesson data stays processor data, but a COPPA refusal or deletion request is carried out by the Processor as operator — including deletion of the personal information collected from the child — even where the Controller is the GDPR controller of the lesson record; the deletion is logged in the Controller's change history.
• Special categories: not intended. The Controller should not enter health or other special-category data; if it does, it is responsible for the legal basis.

3. Processor's obligations

The Processor will:

1. process the data only on the Controller's documented instructions (the service settings and these Terms are the instructions), unless the law requires otherwise — in which case it informs the Controller unless prohibited; if the Processor considers that an instruction infringes GDPR or other applicable data protection law, it will immediately inform the Controller and may suspend that instruction until it is confirmed or changed;
2. ensure that people with access are bound by confidentiality; the Processor's staff open the Controller's workspace only to provide support the Controller asked for, to keep the service secure, or where the law requires, and each such access is recorded in the Controller's change history with its time and as access by the service operator (not the content viewed); the Controller can read the entry in the change history; access ends when the task ends. Personnel of the Processor access the Controller's personal data only from the EEA, over encrypted connections; access from the USA would be a change that triggers a new transfer impact assessment and prior notice to the Controller;
3. apply the security measures in Annex 1;
4. use sub-processors only as set out in section 4;
5. help the Controller respond to data subjects' requests (export, correction, deletion tools in the service; support on request);
6. help the Controller with security, breach notification, impact assessments and prior consultation, taking into account the information available to the Processor;
7. notify the Controller of a personal data breach without undue delay, and where feasible within 48 hours of becoming aware of it;
8. at the end of the service, at the Controller's choice return the data (export, available for 30 days after closure) or delete it, unless the law requires storage;
9. make available the information needed to demonstrate compliance and allow audits and inspections by the Controller or an auditor it mandates. The Processor first provides documentation and reports; the Controller may audit once per year on 30 days' notice, and additionally after a personal data breach or where a supervisory authority requires it. Auditors are bound by confidentiality; audits must not unreasonably disrupt the service.

4. Sub-processors

The Controller gives general authorisation to use the sub-processors listed in Sub-processors. The Processor will announce new or replaced sub-processors at least 30 days in advance (e-mail to the account owner and the sub-processors page). The Controller may object on reasonable grounds; if no solution is found, the Controller may terminate the affected service; the Processor will ask the seller (PAYMENT_PROVIDER, the Merchant of Record) to refund prepaid fees for that service pro rata under the seller's buyer terms. The Processor does not itself refund sums paid to the seller. The Processor imposes the same data protection obligations on each sub-processor and remains responsible for them.

Controller's own AI key. If the Controller connects an API key of its own AI provider, AI requests of its workspace are sent to that provider under the Controller's own agreement with it. Where the Controller has that direct agreement, the provider acts under it and is not a sub-processor of the Processor; the Controller is responsible for that agreement and its data protection terms. By connecting the key the Controller designates the provider; the Processor transmits only on the Controller's instruction, sends only the minimised fields allowed by the AI-consent rules, and does not determine purposes. Before the key is used for lesson data, the Controller must confirm in the service that the provider's terms or settings prohibit training on its content; otherwise the Processor does not send lesson data with the key. The Processor stores the key encrypted and deletes it when the Controller disconnects it. The Processor is itself the controller of the account, billing, technical logs, the help assistant and the stored key. CHECK: role analysis

5. International transfers

Data is hosted in the EU. The Processor is established in the USA. Data is hosted in the EU, and the Controller's transfer to the Processor is covered by the Standard Contractual Clauses (Commission Decision 2021/914, Module 2 controller-to-processor), incorporated as Schedule 3 TO ATTACH: SCC text with annexes filled from this Addendum; Clause 17 governing law and Clause 18 courts: {{EU_MEMBER_STATE}}, together with the transfer impact assessment. The Processor does not rely on the EU–US Data Privacy Framework. Onward transfers to sub-processors outside the EEA (see Sub-processors) follow Clause 8.8 of those SCCs: the sub-processor is certified under the EU–US Data Privacy Framework or bound by equivalent SCC terms. The AI tutor is not enabled for EEA lesson data until such a tool is signed for that provider. The Processor does not rely on Art. 49(1)(a) for routine AI transfers. CHECK: tools actually signed

6. Consents collected through the service

The service provides consent pages (recording, AI tutor) in the user's language and keeps a record of who consented, when, to which text version and in which language. The Controller decides whether to use these features and remains responsible for the legal basis; the Processor provides the tools.

7. Liability and precedence

Liability follows the Terms of Service, except that for claims under this Addendum the cap is the greater of the fees paid in the 12 months before the claim or EUR_DPA_MIN_CAP (this also applies during a free beta or trial). If this Addendum conflicts with the Terms on data protection, this Addendum prevails.

Annex 1 — Security measures

• Encryption in transit (HTTPS/TLS) for all connections; live voice and video calls relayed through our own servers in the EU (Jitsi, TURN), not third-party meeting services.
• Access control: accounts with roles; students access a lesson room through a private link; the customer's administrator test mode (viewing the service as one of the customer's users) is available only to the customer's own administrators, is read-only, is logged and expires after 1 day.
• Passwords stored as salted hashes; session cookies HttpOnly and SameSite.
• Recordings deleted right after transcription; transcription machines rented per job, wiped (deleted) after the queue is empty.
• Daily backups, stored in the EU. BEFORE LAUNCH: off-site backup copy and a tested restore procedure
• Least-privilege API keys for providers; secrets kept outside the code repository.
• Logging of security-relevant events: web server and system logs kept 7 days (IP addresses truncated in web server logs only; system logs may contain full IP addresses); other security logs up to 30 days.
• Staff confidentiality and minimal access; staff access customer data only from the EEA over encrypted connections; operator access to a customer workspace (support, security) is recorded in that customer's change history.
• Workspace isolation: a customer's request can reach only the workspace of the logged-in account. Each account runs in its own process and data directory. Operator staff open a workspace only for support the customer asked for, to keep the service secure, or where the law requires, and each such access is recorded in that customer's change history as access by the service operator.
• Customers' own AI keys encrypted at rest (AES-256-GCM, key derived from the workspace secret), never returned to the browser, deleted on disconnect.
• AI usage log without the text of questions or answers (time, function, room, identifiers, tokens, credits), visible and exportable (CSV) by the customer's administrator; kept for 12 months (rolling), then reduced to monthly totals per function (number of calls, cost, number of active rooms) with student, room and user identifiers removed; the totals remain linked to the customer account and are deleted with it.