Sample AVV for schools and educational institutions

This order processing agreement regulates the processing of personal data on behalf of the educational institution (controller) by the operator of Typr (processor).

§ 1 Subject and duration

(1) The processor processes personal data on behalf of the controller as part of the use of the Typr platform (typr.fun).

(2) Processing takes place for an indefinite period of time and ends when the user contract is terminated or the school account is deleted.

(3) Type and purpose of processing: Providing an online learning platform for learning 10-finger keyboard typing. Processing includes storage and evaluation of learning progress.

§ 2 Type of personal data

The following categories of personal data are processed:

Display name (assigned by the teacher or taken over from the order in the Marktplatz Lernapps)
Username (automatically generated)
Password as a one-way hash; in addition, the start password generated by Typr in plain text so that the teacher can print the access details – it is deleted as soon as the child changes the password themselves
Class membership; when taken over from the Marktplatz Lernapps or when signing in via the Bildungsportal, additionally the sector-specific personal identifier (bPK) and the school code to assign the account
Sign-in name of the school's Microsoft 365 account (usually the school email address) – only if the educational institution requests sign-in with the school account; it is used solely to match the account at sign-in, no emails are sent to it
Learning progress data: typing speed (APM), accuracy, lessons completed, practice time
Game data: points, badges, practice streaks and – if the teacher allows duels – duel results
Typing error statistics: which key was pressed instead of which – the basis for the automatic practice recommendations
Typing tests and exams: typed text, number of errors, speed, grade
Messages between the teacher and the student
Usage data: time of last activity, last page viewed, sign-ins (time, IP address, browser identifier), time zone and language region of the browser

The following will not be processed: Dates of birth, addresses, telephone numbers or other directly identifying data of students; email addresses only in the form of the school account sign-in name mentioned above.

§ 3 Categories of data subjects

Students of the educational institution
Teachers of the educational institution

§ 4 Obligations of the processor

The processor undertakes:

To process personal data exclusively on documented instructions from the controller (Art. 28 para. 3 lit. a GDPR)
To ensure that the persons authorized to process have committed themselves to confidentiality (Art. 28 Para. 3 lit. b GDPR)
To take all technical and organizational measures required in accordance with Art. 32 GDPR
To support the person responsible in fulfilling the rights of those affected (Art. 15-22 GDPR).
To delete or return all data after completion of processing
To provide the controller with all information necessary to demonstrate compliance

§ 5 Technical and organizational measures

Encrypted data transmission (TLS/HTTPS)
Passwords are stored as one-way cryptographic hashes (scrypt); the exception is the start password of student accounts until it is first changed (see § 2)
Hosting on servers within the European Union
Regular security updates and backups
Access control: student data can only be viewed by the teachers to whom the class or the license is assigned
CSRF protection and brute force protection at login
No sharing of data with third parties (unless disclosed as part of the privacy policy)

§ 6 Sub-processors

The following sub-processors are used:

Service	Provider	Purpose	Location
Hosting	Hosteurope GmbH	Server provision	Germany/France (EU)

No external payment service providers are integrated for school accounts. There is no payment processing via the platform.

§ 7 Deletion and return

(1) After termination of the contractual relationship, the processor deletes all personal data unless there is a statutory retention requirement.

(2) The deletion can be initiated at any time by the teacher via the class administration (delete student account). The data will be completely deleted within 30 days.

(3) Confirmation of data deletion can be issued upon request.

§ 8 Contact

Processor:

Emanuel Schmacher e.U.
Sielach 76
9133 Sittersdorf
Austria
UID number: ATU62078959
Email: support@typr.fun
Website: typr.fun

The above email address is available to complete an individual AVV or if you have any questions.

Order processing agreement (AVV)