GDPR Art. 28
Data Processing Agreement, ready to sign
Skoleelev ApS is the processor, the school is the controller. The agreement is delivered as a PDF together with the contract — updated for 2026 with AI chokepoint and prompt audit in Annex C.
Contact us to receive the DPAAnnex B — Sub-processors
| Sub-processor | Purpose | Region | Note |
|---|---|---|---|
| Elestio (LeapSwitch Networks Ltd.) | Managed self-hosted Supabase stack (PostgreSQL, auth, storage, edge functions) — operations, upgrades, backup orchestration | Ireland (HQ) / EU operations | ISO 27001, DPA signed, no access to plaintext PII |
| Hetzner Online GmbH | Physical hosting of database, application and files + encrypted S3 backup | DE — fsn1 Falkenstein (primary), nbg1 Nuremberg (replica), FI — hel1 Helsinki (Hetzner Object Storage, S3-compatible — encrypted daily backup of DB + Storage files + serverless funktion logs, 30-day retention) | ISO 27001, BSI C5, EU-owned |
| OpenAI (Enterprise) | Text AI (gpt-4o, gpt-4o-mini, o3-mini) | EU residency | store:false + scrub + hashed pseudo-user |
| Google AI Studio (Gemini) | Image & multimodal AI | EU residency | store:false + scrub |
| Stripe Payments Europe | Payment (no pupil PII) | EU (Ireland) | PCI-DSS Level 1 |
| Resend / Postmark | Transactional email | EU | DPA + EU sub-processor list |
Note: Supabase is open-source software that we self-host via Elestio on Hetzner's EU infrastructure — Supabase Inc. is not a sub-processor, and no pupil data leaves our self-hosted environment. The school is informed at least 30 days before any new sub-processor is added and may object.
Annex C — Technical and Organisational Measures (TOMs 2026)
- AI PII chokepoint (aiSafeFetch) — scrubs CPR, NHS/NI, email and pupil names; blocks with HTTP 422 on detection
- AI prompt audit (ai_prompt_audit, 180-day retention) — access control: school_admin sees own pupils; the platform administrator sees only pseudonymised metadata (hashed user id, function, model), never prompt content with PII
- Default-deny PII for Skoleelev staff — production support sees only a pseudonymised user directory (UUID + role + school prefix). Identifying a pupil requires an audited break-glass the system with a written reason (min. 20 chars), a parental-consent check for under-13s, and automatic parent/DPO notification (child_data_breakglass_notice)
- Sensitive access log — every read of psychologist/health/SEN/safeguarding via SECURITY DEFINER function
- Row-Level Security (access control) on every table; views are security_invoker=true; the platform administrator has no blanket FOR ALL policy on pupil-data tables
- Impersonation requires a written reason and is blocked for under-13s without parental consent (parental consent gate)
- Two-factor (TOTP, RFC 6238) mandatory for the platform administrator and school_admin with 3-login grace period
- AES-256 at rest; TLS 1.3 in transit; HSTS + CSP; signed links for private buckets
- Cross-region live replica (Falkenstein → Nürnberg) + daily snapshots; RPO < 1 minute
- child_data_consents — 6 consent types for under-13s; useChildAgeGate blocks AI personalisation without consent
- admin_audit_log (24 months) + daily pg_cron rotation
- Breach notice < 24h to the school (GDPR Art. 33)