6.5 KiB
Auftragsverarbeitungsvertrag (AVV)
Data Processor Agreement (Art. 28 GDPR)
HINWEIS: This is a template only. Your school must have its legal counsel review and customize this agreement before signing with any third-party data processor (e.g., if you outsource hosting).
For self-hosted deployments: This agreement is NOT required. It only applies if your school contracts with an external party to operate the platform.
1. Parties
Controller (Auftraggeber):
- School Name: ________________________
- Address: ________________________
- Legal Representative: ________________________
Processor (Auftragnehmer):
- Service Provider Name: ________________________
- Address: ________________________
- Contact: ________________________
2. Scope of Processing
The Processor shall process the following personal data on behalf of the Controller:
- Student records (names, birth dates, assessments, grades)
- Teacher information and activity logs
- Parent contact information
- Learning progress and behavioral records
- Exam monitoring logs
- Communication/messaging data
Purpose: Operation and maintenance of the SchulOS school management platform
3. Duration
This agreement is effective from: ________________________ Term: ________________________ Renewal/Termination terms: ________________________
4. Responsibilities of the Processor
The Processor shall:
4.1 Data Minimization
- Process only the data categories strictly necessary for the purpose
- Not use data for any other purpose without written consent from the Controller
4.2 Security
- Implement appropriate technical and organizational measures:
- Encryption of data at rest and in transit (TLS 1.2+, AES-256)
- Role-based access control (RBAC)
- Regular security audits and penetration testing
- Incident response procedures
- Staff training on data protection
4.3 Sub-processors
- Not engage sub-processors without prior written authorization from the Controller
- Ensure sub-processors are bound by equivalent data protection obligations
- Maintain a current list of authorized sub-processors
4.4 Data Subject Rights
- Assist the Controller in fulfilling data subject requests (access, deletion, portability)
- Respond to requests within 10 business days
4.5 Audit & Inspection
- Allow the Controller and/or its DPO to audit processing activities
- Provide auditing certificates (ISO 27001, SOC 2) upon request
- Maintain documentation of processing activities
4.6 Confidentiality
- Ensure all staff with access to personal data are bound by confidentiality
- Disclose data only to authorized individuals for the defined purpose
5. Responsibilities of the Controller
The Controller shall:
5.1 Authorization
- Ensure processing is lawful under applicable law (GDPR, Schulgesetz)
- Obtain parental/student consent where required (Art. 8 GDPR for minors)
5.2 Instructions
- Provide written instructions for all processing activities
- Prohibit any processing outside the defined scope
5.3 Data Quality
- Ensure data is accurate and up-to-date
- Obtain informed consent from data subjects (or parents for minors)
6. Data Breach Notification
6.1 Processor Notification If the Processor discovers a data breach or suspected unauthorized processing, it shall notify the Controller within 24 hours with:
- Description of the breach
- Categories and approximate number of affected individuals
- Likely consequences
- Measures taken or proposed to address the breach
6.2 Controller's Reporting Duty The Controller is responsible for notifying the relevant supervisory authority (Landesbeauftragte) and affected individuals, as required by GDPR Art. 33-34.
7. Data Deletion & Return
Upon termination of this agreement, the Processor shall, at the Controller's choice:
- Delete all personal data and existing copies (unless retention is required by law)
- Return all personal data in a structured, commonly used, machine-readable format
Deletion shall be completed within 30 days of termination and certified in writing.
8. Data Transfer & Location
8.1 Processing Location Data shall be processed exclusively within the European Union/EEA.
8.2 International Transfers Any transfer of data outside the EU/EEA requires:
- Prior written consent from the Controller
- Compliance with GDPR Chapter 5 (adequacy decisions or appropriate safeguards)
- Standard Contractual Clauses (SCCs) if required
9. Term & Termination
9.1 Term This agreement remains effective for the duration of the service contract.
9.2 Termination Either party may terminate with 30 days written notice if the other party materially breaches this agreement and fails to remedy within 15 days.
9.3 Data Handling Upon Termination Upon termination, the Processor shall delete or return all personal data as directed by the Controller (Section 7).
10. Liability
The Processor shall indemnify the Controller for:
- Breaches of this agreement or applicable data protection law
- Unauthorized processing or disclosure of data
- Failure to implement required security measures
Liability is limited to direct damages and shall not exceed annual fees under the service contract.
11. Signatures
Controller (School)
Name: ________________________ Title: ________________________ Signature: ________________________ Date: ________________________
Processor (Service Provider)
Name: ________________________ Title: ________________________ Signature: ________________________ Date: ________________________
Appendix A: Data Categories & Retention Periods
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Student grades & assessments | 1-2 years | Schulgesetz |
| Final reports | Permanent | Schulgesetz |
| Disciplinary records | 3-10 years | Varies by Bundesland |
| Audit logs | 1-2 years | GDPR compliance |
Appendix B: Authorized Sub-Processors
The Processor is authorized to engage the following sub-processors:
- Cloud Infrastructure: ________________________ (unless otherwise specified)
- Backup & Disaster Recovery: ________________________
- Security Monitoring: ________________________
Note: The Processor shall notify the Controller of any new sub-processors at least 30 days in advance, giving the Controller the right to object.
Generated: ISO 8601 timestamp Source: SchulOS Module L - Compliance Framework
REMINDER: This is a template. Consult legal counsel to customize for your jurisdiction and service provider.