Data processing addendum

This addendum forms part of the terms of service between Telegrade ("the processor") and the institution that created a workspace ("the controller"). It applies to the personal data the controller puts into its workspace.

1. Roles and instructions

The controller decides what data is entered and why. The processor processes it only to provide the service, on the controller's documented instructions, which include the settings the controller chooses in its workspace (roles, retention policies, legal holds, integrations). The processor tells the controller if an instruction appears to break the law.

2. Confidentiality and access

Only staff who need to can access the processor's systems. Staff of the platform must use multi-factor authentication and can open a workspace only with a time-limited support grant that records who, why and until when; the controller can see every such access in its audit view.

3. Security measures

The processor maintains, at least, the following measures:

• Isolation of every workspace at the database level, enforced on every query.
• Encryption of data in transit, encryption of stored data, and encryption of files with a key that belongs to the workspace and can be destroyed when the workspace is closed.
• Malware scanning of every upload before it can be opened.
• An audit ledger of changes that cannot be edited, and an access ledger of sensitive reads.
• Strict browser security headers on every application, and secrets kept in a managed vault, never in code.
• Backups managed by the hosting provider within the workspace's region.

Penetration testing by an external party, disaster-recovery drills and a public status page are planned and will be added to this list when they are in place.

4. Subprocessors

The processor uses the providers listed on the subprocessors page and gives notice of changes there. The controller may object to a new provider within thirty days of the notice; if the objection cannot be resolved, the controller may end the subscription without penalty.

5. Data subject requests

The processor gives the controller tools to answer requests from data subjects: a request workflow with deadlines, an export of a person's data, correction through the workspace, and erasure that pseudonymises the person while education records stay attributable. Requests that reach the processor directly are passed to the controller without delay.

6. Assistance

The processor assists the controller with security incidents, impact assessments and consultations with supervisory authorities, with the information the processor holds. The processor notifies the controller of a personal data breach affecting its workspace without undue delay after becoming aware of it.

7. Transfers

A workspace's data is processed in the region the controller chose. Where a transfer outside that region is required by a subprocessor and a transfer mechanism is needed, the parties rely on the European Commission's standard contractual clauses or the United Kingdom's addendum to them, which the processor provides on request.

8. Return and deletion

The controller can export its workspace at any time. When the subscription ends, the processor provides an export, then purges the workspace, destroys its encryption keys and keeps a destruction record, except where a legal hold or a legal obligation requires longer retention.

9. Audits

The processor provides the controller with the information needed to show compliance with this addendum and, where that is not enough, allows an audit by the controller or an auditor it mandates, on reasonable notice and no more than once a year unless a supervisory authority requires otherwise.

10. Term

This addendum lasts as long as the processor processes personal data for the controller.