Data Processing Agreement — EduRegie

Template. This is a professionally drafted base agreement based on the standard GDPR data processing agreement structure (Art. 28 GDPR). Have this reviewed by a lawyer before actually signing it with a school — in particular, the liability clause (Article 9) deserves a tailored look per customer.

Between:

[School name], with registered office in [place], hereinafter: "Controller"

and

Elhoucine Automation, established in Almere, Chamber of Commerce (KVK) 70739862, hereinafter: "Processor"

together also: "Parties".

1. Subject and duration

1.1 This data processing agreement is an annex to the agreement between the Parties for the use of EduRegie (hereinafter: the "Service") and governs the processing of personal data that the Processor carries out on behalf of the Controller.

1.2 This agreement applies for the duration of the underlying agreement and terminates automatically upon its termination, without prejudice to obligations that by their nature continue (including confidentiality and the deletion/return obligation of Article 8).

2. Subject, nature and purpose of the processing

2.1 The Processor processes personal data solely for the purpose of: registering staff absence, determining timetable impact, advising on and recording substitution choices, informing schedulers and team leaders, and generating management statistics — all on behalf of the Controller.

2.2 Categories of data subjects: staff (teachers, education support staff) and, indirectly and solely operationally (never substantively regarding the reason for absence), students insofar as timetable changes are shown to them.

2.3 Categories of personal data: name, contact details (work email address, phone number), role/team, absence status and period, reporting channel, timetable impact, substitution actions, and operational handover notes.

2.4 Explicitly excluded from processing: diagnosis, reason for illness, complaints, medical treatment or medication, medical documents, or any other special category of personal data within the meaning of Art. 9 GDPR. The Controller ensures that such data is never entered into free-text fields of the Service; the Processor does not provide any input option for this in the regular user portal.

3. Instructions

3.1 The Processor processes personal data solely on the basis of written (including electronic) instructions from the Controller, as laid down in the underlying agreement, unless a legal obligation requires the Processor to process the data.

3.2 The Processor informs the Controller without delay if, in its opinion, an instruction conflicts with the GDPR or other applicable privacy legislation.

4. Confidentiality

4.1 The Processor obliges everyone who has access to the personal data under its authority to maintain confidentiality, unless that person is already bound by a statutory duty of confidentiality.

5. Security

5.1 The Processor takes appropriate technical and organizational measures to ensure a level of security appropriate to the risk. See the Security Annex (beveiligingsbijlage.md) for the concrete measures.

5.2 The Controller assesses whether the measures described in the Security Annex offer an appropriate level for the nature of the processed data, and notifies the Processor in writing if additional measures are deemed necessary.

6. Engaging sub-processors

6.1 The Controller gives the Processor general permission to engage sub-processors, provided they are listed on the Sub-processor List (subverwerkerslijst.md).

6.2 The Processor informs the Controller at least [30] days before a new sub-processor is engaged or replaced, so that the Controller can object on reasonable, GDPR-related grounds.

6.3 The Processor imposes the same obligations on every sub-processor as set out in this agreement, and remains fully liable to the Controller for the acts and omissions of the sub-processor.

7. Data breach notification obligation

7.1 The Processor notifies the Controller of a (suspected) data breach concerning the personal data it processes without undue delay, and in any case within 48 hours of becoming aware of it — so that the Controller can itself comply in time (within 72 hours of its own awareness) with the statutory notification obligation to the Data Protection Authority.

7.2 The notification contains at least: the nature of the data breach, the (suspected) categories and number of data subjects and data records, the measures taken and proposed, and contact details for further questions. See also the Incident Procedure (incidentprocedure.md).

8. Assistance, deletion and return

8.1 The Processor provides the Controller with reasonable assistance with requests from data subjects (access, rectification, erasure, restriction, portability, objection), with carrying out a DPIA, and with consultation with the supervisory authority.

8.2 Upon termination of the agreement, the Processor deletes or returns — at the Controller's choice — all personal data within [30] days, unless a statutory retention obligation requires otherwise. See also the Data Retention Policy (dataretentiebeleid.md).

9. Liability

9.1 Liability between the Parties for damage arising from this data processing agreement is governed in accordance with the liability clause in the underlying main agreement.

Template note: insert here the actual liability clause from the general terms and conditions/pilot contract, or formulate a specific provision in consultation with a lawyer.

10. Audit

10.1 The Processor provides the Controller, upon request, with the information reasonably necessary to demonstrate compliance with the obligations of this agreement, and permits audits by or on behalf of the Controller, with reasonable prior notice and no more than once per year (except in the case of a concrete suspicion of a data breach).

Signature