Order processing agreement (AVV)

Sample AVV for schools and educational institutions

This order processing agreement regulates the processing of personal data on behalf of the educational institution (controller) by the operator of Typr (processor).

§ 1 Subject and duration

(1) The processor processes personal data on behalf of the controller as part of the use of the Typr platform (typr.fun).

(2) Processing takes place for an indefinite period of time and ends when the user contract is terminated or the school account is deleted.

(3) Type and purpose of processing: Providing an online learning platform for learning 10-finger keyboard typing. Processing includes storage and evaluation of learning progress.

§ 2 Type of personal data

The following categories of personal data are processed:

• Display name (assigned by the teacher)
• Username (automatically generated)
• Password (stored encrypted, disposable hash)
• Learning progress data: typing speed (APM), accuracy, lessons completed, Exercise duration

The following will not be processed: Email addresses, dates of birth, addresses, telephone numbers or other directly identifying data of students.

§ 3 Categories of data subjects

• Students of the educational institution
• Teachers of the educational institution

§ 4 Obligations of the processor

The processor undertakes:

• To process personal data exclusively on documented instructions from the controller (Art. 28 para. 3 lit. a GDPR)
• To ensure that the persons authorized to process have committed themselves to confidentiality (Art. 28 Para. 3 lit. b GDPR)
• To take all technical and organizational measures required in accordance with Art. 32 GDPR
• To support the person responsible in fulfilling the rights of those affected (Art. 15-22 GDPR).
• To delete or return all data after completion of processing
• To provide the controller with all information necessary to demonstrate compliance

§ 5 Technical and organizational measures

• Encrypted data transmission (TLS/HTTPS)
• Passwords are stored exclusively as one-way cryptographic hashes (scrypt)
• Hosting on servers within the European Union
• Regular security updates and backups
• Access control: Only the assigned teacher can view student data
• CSRF protection and brute force protection at login
• No sharing of data with third parties (unless disclosed as part of the privacy policy)

§ 6 Sub-processors

The following sub-processors are used:

No external payment service providers are integrated for school accounts. There is no payment processing via the platform.

§ 7 Deletion and return

(1) After termination of the contractual relationship, the processor deletes all personal data unless there is a statutory retention requirement.

(2) The deletion can be initiated at any time by the teacher via the class administration (delete student account). The data will be completely deleted within 30 days.

(3) Confirmation of data deletion can be issued upon request.

§ 8 Contact

Processor:

Emanuel Schmacher e.U.
Email: support@typr.fun
Website: typr.fun

The above email address is available to complete an individual AVV or if you have any questions.