Data Processing Agreement (DPA) v2.0 — March 2026

1. Parties

Data Processor: SIBSTIL DOORS SRL, Str. Oștirii, Nr. 6, Sc. B, Et. 7, Ap. 73, Mun. Sibiu, România. J32/358/2009, CIF: RO25411699. Email: support@typiq-app.com
Data Controller: The school or educational institution named in the license agreement (details to be completed upon contract signing).

2. Subject Matter, Duration and Nature of Processing

This DPA governs the processing of personal data of students by the Processor on behalf of the Controller in connection with the Typiq typing education software. The DPA is effective for the full duration of the active Classroom or School license and expires upon license termination.

3. Categories of Data and Processing Purposes

Data we do NOT process: real names (unless voluntarily provided by school), email addresses of students, dates of birth, photographs, medical or special category data, financial data, or any data beyond what is listed above.

4. Data Subject Rights — EU Data Act

Under the EU Data Act (Regulation 2023/2854, applicable since September 12, 2025), data subjects (students or their guardians) have the right to access data generated through use of the Software. The Controller is responsible for facilitating these requests. The Processor will provide data export functionality (CSV) to enable the Controller to fulfill data portability requests within 30 days.

5. Controller Obligations

• Obtain all necessary consents from parents or guardians for students under 16 (GDPR Art. 8), or the applicable age in the relevant jurisdiction (e.g., under 13 for COPPA in the USA)
• Inform students and parents about data processing as required by GDPR Art. 13
• Ensure only authorized staff access the admin dashboard
• Notify the Processor immediately of any data breach involving student data
• Comply with applicable national education data protection regulations

6. Processor Obligations (GDPR Art. 28)

• Process personal data only on documented instructions from the Controller
• Ensure all authorized personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures (GDPR Art. 32)
• Not engage sub-processors without prior written authorization from the Controller
• Assist the Controller in fulfilling data subject rights requests (access, erasure, portability)
• Delete or return all personal data within 30 days of license termination
• Notify the Controller within 24 hours of becoming aware of a personal data breach (in line with CRA requirements and GDPR Art. 33)
• Make available all information necessary to demonstrate compliance with this DPA

7. Sub-processors

The Controller authorizes the use of the above sub-processor. Any changes to sub-processors will be communicated 30 days in advance, giving the Controller the right to object.

8. International Transfers

All student data is processed and stored on EU-based servers (Hetzner, Germany). No student data is transferred outside the EU/EEA.

9. Security Measures (GDPR Art. 32)

• HTTPS encryption for all data in transit
• Authentication required for admin dashboard access
• Role-based access controls (teacher vs. administrator)
• Data stored on EU servers with physical and logical access controls
• Regular security reviews
• Incident response procedure in place (see Security Policy)

10. Audit Rights

The Controller has the right to audit compliance with this DPA upon 30 days' written notice, no more than once per year. Audits will be conducted in a manner that minimizes disruption to Processor's operations.

11. Governing Law

This DPA is governed by Romanian law and EU GDPR. Disputes shall be resolved in the courts of Sibiu, Romania, unless mandatory local law provides otherwise.

12. Signatures

DPA inquiries: support@typiq-app.com