208 lines
6.5 KiB
Markdown
208 lines
6.5 KiB
Markdown
# Auftragsverarbeitungsvertrag (AVV)
|
|
# Data Processor Agreement (Art. 28 GDPR)
|
|
|
|
**HINWEIS**: This is a template only. Your school must have its legal counsel review and customize this agreement before signing with any third-party data processor (e.g., if you outsource hosting).
|
|
|
|
**For self-hosted deployments**: This agreement is NOT required. It only applies if your school contracts with an external party to operate the platform.
|
|
|
|
---
|
|
|
|
## 1. Parties
|
|
|
|
**Controller (Auftraggeber):**
|
|
- School Name: ________________________
|
|
- Address: ________________________
|
|
- Legal Representative: ________________________
|
|
|
|
**Processor (Auftragnehmer):**
|
|
- Service Provider Name: ________________________
|
|
- Address: ________________________
|
|
- Contact: ________________________
|
|
|
|
---
|
|
|
|
## 2. Scope of Processing
|
|
|
|
The Processor shall process the following personal data on behalf of the Controller:
|
|
|
|
- Student records (names, birth dates, assessments, grades)
|
|
- Teacher information and activity logs
|
|
- Parent contact information
|
|
- Learning progress and behavioral records
|
|
- Exam monitoring logs
|
|
- Communication/messaging data
|
|
|
|
**Purpose**: Operation and maintenance of the SchulOS school management platform
|
|
|
|
---
|
|
|
|
## 3. Duration
|
|
|
|
This agreement is effective from: ________________________
|
|
Term: ________________________
|
|
Renewal/Termination terms: ________________________
|
|
|
|
---
|
|
|
|
## 4. Responsibilities of the Processor
|
|
|
|
The Processor shall:
|
|
|
|
4.1 **Data Minimization**
|
|
- Process only the data categories strictly necessary for the purpose
|
|
- Not use data for any other purpose without written consent from the Controller
|
|
|
|
4.2 **Security**
|
|
- Implement appropriate technical and organizational measures:
|
|
- Encryption of data at rest and in transit (TLS 1.2+, AES-256)
|
|
- Role-based access control (RBAC)
|
|
- Regular security audits and penetration testing
|
|
- Incident response procedures
|
|
- Staff training on data protection
|
|
|
|
4.3 **Sub-processors**
|
|
- Not engage sub-processors without prior written authorization from the Controller
|
|
- Ensure sub-processors are bound by equivalent data protection obligations
|
|
- Maintain a current list of authorized sub-processors
|
|
|
|
4.4 **Data Subject Rights**
|
|
- Assist the Controller in fulfilling data subject requests (access, deletion, portability)
|
|
- Respond to requests within 10 business days
|
|
|
|
4.5 **Audit & Inspection**
|
|
- Allow the Controller and/or its DPO to audit processing activities
|
|
- Provide auditing certificates (ISO 27001, SOC 2) upon request
|
|
- Maintain documentation of processing activities
|
|
|
|
4.6 **Confidentiality**
|
|
- Ensure all staff with access to personal data are bound by confidentiality
|
|
- Disclose data only to authorized individuals for the defined purpose
|
|
|
|
---
|
|
|
|
## 5. Responsibilities of the Controller
|
|
|
|
The Controller shall:
|
|
|
|
5.1 **Authorization**
|
|
- Ensure processing is lawful under applicable law (GDPR, Schulgesetz)
|
|
- Obtain parental/student consent where required (Art. 8 GDPR for minors)
|
|
|
|
5.2 **Instructions**
|
|
- Provide written instructions for all processing activities
|
|
- Prohibit any processing outside the defined scope
|
|
|
|
5.3 **Data Quality**
|
|
- Ensure data is accurate and up-to-date
|
|
- Obtain informed consent from data subjects (or parents for minors)
|
|
|
|
---
|
|
|
|
## 6. Data Breach Notification
|
|
|
|
6.1 **Processor Notification**
|
|
If the Processor discovers a data breach or suspected unauthorized processing, it shall notify the Controller within **24 hours** with:
|
|
- Description of the breach
|
|
- Categories and approximate number of affected individuals
|
|
- Likely consequences
|
|
- Measures taken or proposed to address the breach
|
|
|
|
6.2 **Controller's Reporting Duty**
|
|
The Controller is responsible for notifying the relevant supervisory authority (Landesbeauftragte) and affected individuals, as required by GDPR Art. 33-34.
|
|
|
|
---
|
|
|
|
## 7. Data Deletion & Return
|
|
|
|
Upon termination of this agreement, the Processor shall, at the Controller's choice:
|
|
|
|
- Delete all personal data and existing copies (unless retention is required by law)
|
|
- Return all personal data in a structured, commonly used, machine-readable format
|
|
|
|
Deletion shall be completed within **30 days** of termination and certified in writing.
|
|
|
|
---
|
|
|
|
## 8. Data Transfer & Location
|
|
|
|
8.1 **Processing Location**
|
|
Data shall be processed exclusively within the **European Union/EEA**.
|
|
|
|
8.2 **International Transfers**
|
|
Any transfer of data outside the EU/EEA requires:
|
|
- Prior written consent from the Controller
|
|
- Compliance with GDPR Chapter 5 (adequacy decisions or appropriate safeguards)
|
|
- Standard Contractual Clauses (SCCs) if required
|
|
|
|
---
|
|
|
|
## 9. Term & Termination
|
|
|
|
9.1 **Term**
|
|
This agreement remains effective for the duration of the service contract.
|
|
|
|
9.2 **Termination**
|
|
Either party may terminate with **30 days written notice** if the other party materially breaches this agreement and fails to remedy within 15 days.
|
|
|
|
9.3 **Data Handling Upon Termination**
|
|
Upon termination, the Processor shall delete or return all personal data as directed by the Controller (Section 7).
|
|
|
|
---
|
|
|
|
## 10. Liability
|
|
|
|
The Processor shall indemnify the Controller for:
|
|
- Breaches of this agreement or applicable data protection law
|
|
- Unauthorized processing or disclosure of data
|
|
- Failure to implement required security measures
|
|
|
|
Liability is limited to direct damages and shall not exceed annual fees under the service contract.
|
|
|
|
---
|
|
|
|
## 11. Signatures
|
|
|
|
**Controller (School)**
|
|
|
|
Name: ________________________
|
|
Title: ________________________
|
|
Signature: ________________________
|
|
Date: ________________________
|
|
|
|
**Processor (Service Provider)**
|
|
|
|
Name: ________________________
|
|
Title: ________________________
|
|
Signature: ________________________
|
|
Date: ________________________
|
|
|
|
---
|
|
|
|
## Appendix A: Data Categories & Retention Periods
|
|
|
|
| Data Category | Retention Period | Legal Basis |
|
|
|---|---|---|
|
|
| Student grades & assessments | 1-2 years | Schulgesetz |
|
|
| Final reports | Permanent | Schulgesetz |
|
|
| Disciplinary records | 3-10 years | Varies by Bundesland |
|
|
| Audit logs | 1-2 years | GDPR compliance |
|
|
|
|
---
|
|
|
|
## Appendix B: Authorized Sub-Processors
|
|
|
|
The Processor is authorized to engage the following sub-processors:
|
|
|
|
1. Cloud Infrastructure: ________________________ (unless otherwise specified)
|
|
2. Backup & Disaster Recovery: ________________________
|
|
3. Security Monitoring: ________________________
|
|
|
|
**Note**: The Processor shall notify the Controller of any new sub-processors at least 30 days in advance, giving the Controller the right to object.
|
|
|
|
---
|
|
|
|
**Generated**: ISO 8601 timestamp
|
|
**Source**: SchulOS Module L - Compliance Framework
|
|
|
|
**REMINDER**: This is a template. Consult legal counsel to customize for your jurisdiction and service provider.
|