Data processing agreement draft

2. Subject matter and duration

The subject matter is evaluating the access signal from the institution's gates and the presence, attendance, notification and emergency functions built on it. The duration is the term of the contract.

3. Categories of data

Identity data, access event records, class and guardian relationships, contact details and application usage logs.

Data subject groups: students, guardians, staff, visitors and contractor personnel.

4. Prohibition of biometric data

The parties agree that no biometric data is processed in any version. The schema has no such field, the endpoint rejects it and the adapter drops it.

5. Security measures

Transfer and storage are encrypted, access is role-based, administrative actions are written to an immutable audit trail and card numbers travel as a salted digest scoped to the institution.

6. Sub-processors

The use of a sub-processor is notified to the institution in advance and the sub-processor is bound by the same obligations.

7. Assisting with data subject requests

EGEROBOT provides technical assistance so the institution can meet access, rectification, erasure and objection requests it receives.

8. Breach notification

When a data breach becomes known, the institution is notified without delay; the notification includes the number of affected records and the measures taken.

9. Return and destruction

On termination the data is returned or destroyed at the institution's choice; destruction is recorded and deactivation does not count as destruction.

10. Audit

The institution may audit compliance at reasonable intervals; the scope of the audit is agreed in writing beforehand.

11. Hosting location

The institution may choose local hosting. Where the cloud is chosen, the hosting location is notified to the institution in writing.

12. The nature of this text

This text is a draft and does not replace the contract to be signed; it is finalised together with the institution's legal team.