Data Processing Agreement
How AdapEdu (processor) handles data on behalf of your school (controller).
Last updated: 13 September 2026
Where a school or organisation subscribes to the Enterprise plan, AdapEdu processes personal data on the school's behalf. This page summarises the key terms of our Data Processing Agreement (Art. 28 GDPR). Contact [email protected] for an executed copy.
1. Parties and roles
The school is the data controller and decides the purposes and means of processing. AdapEdu is the data processor and acts only on the controller's documented instructions.
2. What we process
Categories of personal data: account and contact details of staff, and student roster data including accommodation profiles that may be special category data. Processing is limited to providing, operating and supporting the AdapEdu service.
3. Processor obligations
AdapEdu will process data only on documented instructions, keep it confidential, implement appropriate technical and organisational measures, and assist the controller with its GDPR obligations, including data subject rights and security.
4. Sub-processors
AdapEdu may engage sub-processors to deliver infrastructure, analytics and support - currently EU/EEA hosting providers and BuddyStat (privacy-conscious analytics). Sub-processors are bound by written agreements meeting the requirements of Art. 28 GDPR, and the controller is informed of any changes.
5. Security
AdapEdu applies appropriate technical and organisational measures, including encryption, role-based access and audit trails, appropriate to the risk and in line with Art. 32 GDPR.
6. Data subject rights
AdapEdu will assist the controller in responding to requests from data subjects exercising their rights under the GDPR, using appropriate technical and organisational measures.
7. Breach notification
AdapEdu will notify the controller without undue delay of any personal data breach affecting data processed under the agreement, so the controller can meet its notification obligations.
8. Retention and deletion
Data is retained only as long as needed for the agreed purposes and is deleted or returned at the end of the agreement, at the controller's choice, unless EU/EEA law requires longer storage.
9. Liability and term
The DPA remains in effect for as long as AdapEdu processes data for the school and survives termination where needed to comply with the law. Contact {email} to obtain the full executed agreement.
To request an executed copy of the DPA, email [email protected]
Data & privacy