Data processing agreement

1. Parties and subject

This agreement is between the Customer (the school or group of schools using Turmalina), as controller, and [Company name], NIPC [NIPC], registered office at [registered address] ("Turmalina"), as processor, under Article 28 of the General Data Protection Regulation (GDPR) and Portuguese Law 58/2019.

It is part of the Terms of service and prevails over them on data protection. The Portuguese version prevails.

2. The processing

Nature and purpose: hosting, storing, organising, displaying and sending the data the Customer puts in the service, for the Customer's school management and its communication with families and staff, as well as backups and support.

Duration: for as long as the contract lasts, plus the return and deletion period in this agreement.

Data subjects:

• students, including nursery and pre-school children;
• parents, guardians and other relatives or authorised people;
• the Customer's staff: leadership, teachers, educators, assistants, office, kitchen and others;
• other people whose data the Customer chooses to record.

Categories of data:

• identification and contact details (name, email, phone, address, date of birth, relationship);
• school records: enrolments, classes, timetables, lesson records, absences and excuses, assessment, report cards and behaviour records;
• nursery records: arrivals and departures, meals, naps, nappies and medicines given with a guardian's authorisation;
• canteen: booked meals and dietary needs, including allergies and intolerances;
• financial data: fees, payment notices and payments;
• messages, notices, authorisations and poll answers;
• account and security data: email, password (stored only as a cryptographic hash), two-step verification secret (encrypted), sessions, IP addresses and the audit log.

Some of this data is special-category data (Article 9 GDPR), such as health data (allergies, medicines) or data that may reveal religious beliefs (diets). The Customer must ensure a legal basis for processing it and limit who can see it.

3. Turmalina's obligations

Turmalina:

• processes the data only on the Customer's documented instructions, which are this contract and the Customer's use of the service, unless required by law, in which case it tells the Customer first where the law allows;
• tells the Customer if it believes an instruction breaks data protection law;
• ensures that the people authorised to process the data are bound by confidentiality;
• applies the security measures described below (Article 32 GDPR);
• uses other processors only under the conditions of this agreement;
• helps the Customer answer data subjects' requests (access, rectification, erasure, restriction, portability and objection), mainly through the app's features and, where these are not enough, at the Customer's request;
• helps the Customer meet its obligations on security, breach notification, impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the information available to it;
• at the end of the contract, returns and deletes the data as set out below;
• makes available the information needed to show compliance with this agreement and allows audits, as set out below.

If a data subject contacts us directly about the Customer's data, we pass the request on to the Customer without answering it ourselves, unless the Customer instructs otherwise.

4. The Customer's obligations

• to have a legal basis for the data it puts in the service and to inform data subjects (including about Turmalina as processor);
• to collect the consents needed, for example for images;
• to grant access on a need-to-know basis and remove it when no longer needed;
• not to put data in the service that isn't needed.

5. Security measures

• Encrypted connections (HTTPS/TLS) across the service.
• Database and backups encrypted at rest by the hosting provider, in the European Union.
• Each customer's data kept apart in the database itself (row-level security), enforced on an application database account that has no privilege to get around it.
• Passwords stored with Argon2; two-step verification (TOTP) available to everyone and mandatory per role when the Customer sets it; two-step verification secrets encrypted.
• Access by role and scope (school, class, student), with the minimum each role needs.
• Sessions that expire after 60 minutes of inactivity and after 12 hours; temporary lockout after failed attempts; request rate limits.
• An audit log of relevant actions.
• Automatic database backups.
• Access to production systems limited to the Turmalina staff who need it, with two-step verification on provider accounts.
• No real data is used in development or demos: the demo uses fictional data.

We review these measures regularly and may improve them, without lowering the level of protection.

6. Sub-processors

The Customer gives Turmalina general authorisation to use other processors. The current ones are:

• Salesforce, Inc. (Heroku): hosting of the application, database and backups, in the European Union region (Ireland), on Amazon Web Services infrastructure.
• Sendinblue SAS (Brevo), France: sending the app's emails (recipient, subject and content of each email).
• Google Ireland Limited (Google Workspace): support email, only for data the Customer sends us by email.

We tell the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if we can't agree, it may end the contract before the change takes effect.

We bind each sub-processor by contract to data protection obligations equivalent to those in this agreement and remain liable to the Customer for their performance.

7. Transfers outside the European Union

The data is stored in the European Union. Some sub-processors belong to groups based outside the European Union (for example, in the United States) and may, in limited cases such as technical support, access it from there. Such transfers only happen with the safeguards of Chapter V GDPR, such as an adequacy decision (for example, the EU-U.S. Data Privacy Framework) or the European Commission's standard contractual clauses.

8. Personal data breaches

If we become aware of a personal data breach affecting the Customer's data, we tell the Customer without undue delay and in any case within 48 hours, so that it can notify the CNPD within 72 hours where required.

The notice describes, as far as we know: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. We complete the information as we get it.

9. Return and deletion of data

The Customer can export its data at any time. After the contract ends, the data stays available for export for 30 days and is then deleted within 90 days, including from backups as they expire, unless the law requires us to keep it.

10. Audits

We answer the Customer's reasonable data protection questionnaires. If that isn't enough, the Customer, or an auditor it appoints who is bound by confidentiality, may carry out an audit once a year with at least 30 days' notice, unless there has been a data breach or a request from the supervisory authority. The Customer bears the cost of the audit.

11. Contact

Questions about this agreement: info@turmalina.pt.