# Auftragsverarbeitungsvertrag (AVV) # Data Processor Agreement (Art. 28 GDPR) **HINWEIS**: This is a template only. Your school must have its legal counsel review and customize this agreement before signing with any third-party data processor (e.g., if you outsource hosting). **For self-hosted deployments**: This agreement is NOT required. It only applies if your school contracts with an external party to operate the platform. --- ## 1. Parties **Controller (Auftraggeber):** - School Name: ________________________ - Address: ________________________ - Legal Representative: ________________________ **Processor (Auftragnehmer):** - Service Provider Name: ________________________ - Address: ________________________ - Contact: ________________________ --- ## 2. Scope of Processing The Processor shall process the following personal data on behalf of the Controller: - Student records (names, birth dates, assessments, grades) - Teacher information and activity logs - Parent contact information - Learning progress and behavioral records - Exam monitoring logs - Communication/messaging data **Purpose**: Operation and maintenance of the SchulOS school management platform --- ## 3. Duration This agreement is effective from: ________________________ Term: ________________________ Renewal/Termination terms: ________________________ --- ## 4. Responsibilities of the Processor The Processor shall: 4.1 **Data Minimization** - Process only the data categories strictly necessary for the purpose - Not use data for any other purpose without written consent from the Controller 4.2 **Security** - Implement appropriate technical and organizational measures: - Encryption of data at rest and in transit (TLS 1.2+, AES-256) - Role-based access control (RBAC) - Regular security audits and penetration testing - Incident response procedures - Staff training on data protection 4.3 **Sub-processors** - Not engage sub-processors without prior written authorization from the Controller - Ensure sub-processors are bound by equivalent data protection obligations - Maintain a current list of authorized sub-processors 4.4 **Data Subject Rights** - Assist the Controller in fulfilling data subject requests (access, deletion, portability) - Respond to requests within 10 business days 4.5 **Audit & Inspection** - Allow the Controller and/or its DPO to audit processing activities - Provide auditing certificates (ISO 27001, SOC 2) upon request - Maintain documentation of processing activities 4.6 **Confidentiality** - Ensure all staff with access to personal data are bound by confidentiality - Disclose data only to authorized individuals for the defined purpose --- ## 5. Responsibilities of the Controller The Controller shall: 5.1 **Authorization** - Ensure processing is lawful under applicable law (GDPR, Schulgesetz) - Obtain parental/student consent where required (Art. 8 GDPR for minors) 5.2 **Instructions** - Provide written instructions for all processing activities - Prohibit any processing outside the defined scope 5.3 **Data Quality** - Ensure data is accurate and up-to-date - Obtain informed consent from data subjects (or parents for minors) --- ## 6. Data Breach Notification 6.1 **Processor Notification** If the Processor discovers a data breach or suspected unauthorized processing, it shall notify the Controller within **24 hours** with: - Description of the breach - Categories and approximate number of affected individuals - Likely consequences - Measures taken or proposed to address the breach 6.2 **Controller's Reporting Duty** The Controller is responsible for notifying the relevant supervisory authority (Landesbeauftragte) and affected individuals, as required by GDPR Art. 33-34. --- ## 7. Data Deletion & Return Upon termination of this agreement, the Processor shall, at the Controller's choice: - Delete all personal data and existing copies (unless retention is required by law) - Return all personal data in a structured, commonly used, machine-readable format Deletion shall be completed within **30 days** of termination and certified in writing. --- ## 8. Data Transfer & Location 8.1 **Processing Location** Data shall be processed exclusively within the **European Union/EEA**. 8.2 **International Transfers** Any transfer of data outside the EU/EEA requires: - Prior written consent from the Controller - Compliance with GDPR Chapter 5 (adequacy decisions or appropriate safeguards) - Standard Contractual Clauses (SCCs) if required --- ## 9. Term & Termination 9.1 **Term** This agreement remains effective for the duration of the service contract. 9.2 **Termination** Either party may terminate with **30 days written notice** if the other party materially breaches this agreement and fails to remedy within 15 days. 9.3 **Data Handling Upon Termination** Upon termination, the Processor shall delete or return all personal data as directed by the Controller (Section 7). --- ## 10. Liability The Processor shall indemnify the Controller for: - Breaches of this agreement or applicable data protection law - Unauthorized processing or disclosure of data - Failure to implement required security measures Liability is limited to direct damages and shall not exceed annual fees under the service contract. --- ## 11. Signatures **Controller (School)** Name: ________________________ Title: ________________________ Signature: ________________________ Date: ________________________ **Processor (Service Provider)** Name: ________________________ Title: ________________________ Signature: ________________________ Date: ________________________ --- ## Appendix A: Data Categories & Retention Periods | Data Category | Retention Period | Legal Basis | |---|---|---| | Student grades & assessments | 1-2 years | Schulgesetz | | Final reports | Permanent | Schulgesetz | | Disciplinary records | 3-10 years | Varies by Bundesland | | Audit logs | 1-2 years | GDPR compliance | --- ## Appendix B: Authorized Sub-Processors The Processor is authorized to engage the following sub-processors: 1. Cloud Infrastructure: ________________________ (unless otherwise specified) 2. Backup & Disaster Recovery: ________________________ 3. Security Monitoring: ________________________ **Note**: The Processor shall notify the Controller of any new sub-processors at least 30 days in advance, giving the Controller the right to object. --- **Generated**: ISO 8601 timestamp **Source**: SchulOS Module L - Compliance Framework **REMINDER**: This is a template. Consult legal counsel to customize for your jurisdiction and service provider.