Beta version, effective 15 November 2026. · Wersja beta, obowiązuje od 15 listopada 2026.

Data Processing Agreement

Beta. Effective 15 November 2026. Version 2026-11-beta.

Between the tutor or school ("Controller") and Green State Labs, which runs Tutorfold ("Processor"; contact hello@tutorfold.com), under Article 28 GDPR.

1. Subject and duration. The Processor processes personal data of the Controller's students, their parents and the Controller's staff for as long as the Controller uses Tutorfold, and deletes it within 30 days after the school is closed; encrypted backups are kept up to 12 months, then deleted, unless the law requires keeping it.

2. Nature and purpose. Hosting the school website and student app; scheduling and video classes; chat, homework and files; recording, transcription and AI notes when the Controller switches them on; invoices and payments; e-mails and push notifications on the Controller's behalf.

3. Categories of data. Names, contact details, dates of birth, level and learning data, class notes and transcripts, chat messages and files, payment records. Data of children when the Controller teaches minors.

4. Instructions. The Processor acts only on the Controller's documented instructions (the settings and actions in Tutorfold).

5. Confidentiality and security. Staff are bound by confidentiality. Measures: encryption in transit, per-school separation enforced in code and tested, encrypted backups, access logging in the owner console, least-privilege access, encrypted storage of third-party keys.

6. Sub-processors. The Controller authorises the sub-processors listed in the Privacy Policy. New sub-processors are announced 30 days ahead; the Controller may object and leave.

7. Assistance. The Processor helps the Controller answer data-subject requests (export, correction, deletion) and with breach notifications, and notifies a personal-data breach without undue delay (target: within 24 hours of becoming aware).

8. Transfers outside the EEA. Only with appropriate safeguards (EU Standard Contractual Clauses or adequacy decisions).

9. Audits. The Processor makes available the information needed to show compliance.

10. End. On termination the Processor deletes or returns the data as the Controller chooses.