Data Processing Addendum

1. Definitions

"Data Protection Laws" means all laws that apply to the processing of personal data under the Agreement, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the Nigeria Data Protection Act 2023, and US state privacy laws such as the CCPA. "Customer Data" means personal data you or your guardians and students submit to TutorWrap: student, guardian, session, goal, report and evidence data. "Subprocessor" means a third party we engage to process Customer Data. "Restricted Transfer" means a transfer of Customer Data to a country that Data Protection Laws treat as not providing adequate protection. Other terms (controller, processor, personal data, processing, data subject, personal data breach) have the meanings in the GDPR.

2. Roles and scope

For Customer Data you are the controller (or, if you process it for a school or agency, a processor) and we are your processor. The subject matter, duration, nature and purpose of processing, and the categories of data subjects and data, are set out in Annex 1. This DPA does not cover data for which we are the controller, such as your account and billing details, which the Privacy Policy covers.

3. Your instructions

We process Customer Data only on your documented instructions, which are: the Agreement, this DPA, and the settings and actions you take in TutorWrap (for example adding a guardian, choosing a channel, logging a session, enabling the check-in, or pressing Suggest). We will tell you if we believe an instruction breaches Data Protection Laws. Instructions outside the service's features need a written agreement between us.

You are responsible for the lawfulness of Customer Data and of your instructions: in particular for having a lawful basis and any required consent to record information about students and to contact guardians on each channel, for giving data subjects the information they are entitled to, and for not submitting special category data unless the law allows it.

4. Confidentiality and security

We ensure that people authorised to process Customer Data are bound by confidentiality. We implement and maintain the technical and organisational measures in Annex 2, and may update them provided the overall level of protection does not decrease. Taking into account the nature of the processing and the information available to us, we will help you meet your obligations on security, breach notification, data protection impact assessments and consultation with authorities.

5. Subprocessors

You give us general authorisation to engage the Subprocessors listed on our Subprocessors page (Annex 3), and to add or replace Subprocessors. We will give you at least 15 days' notice of any addition or replacement by email to your account address and by updating that page. If you object on reasonable data protection grounds within that period and we cannot resolve the objection, you may terminate the Agreement and we will refund any prepaid fees for the remaining period. We impose data protection obligations on each Subprocessor that are no less protective than this DPA, prohibit any AI provider from using Customer Data to train or improve models, and remain liable for their performance.

6. Data subject requests

TutorWrap gives you the tools to answer most requests yourself: viewing, correcting and deleting students and guardians, exporting your student list, revoking progress links and honouring opt-outs. If a data subject contacts us directly about Customer Data we will, where lawful, tell you and not respond except to direct them to you, unless you ask us to act or the request is one we can reasonably action across every account that holds the data (for example a guardian asking to be removed everywhere). We will provide reasonable assistance with requests you cannot answer with the tools, at no charge unless the effort is excessive.

7. Personal data breach

We will notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Data, by email to your account address, with the information we have at the time and updates as we learn more, so that you can meet your own notification duties. Our notification is not an admission of fault.

8. Audit

On request, no more than once a year unless required by a regulator or following a breach, we will provide the information reasonably necessary to demonstrate compliance with this DPA, including this DPA, Annex 2, our Privacy Policy and written answers to a reasonable security questionnaire. If that is not sufficient under Data Protection Laws, you may conduct, at your cost and on 30 days' notice, an audit limited to the processing of Customer Data, during business hours, under confidentiality, and without disrupting the service or accessing other customers' data.

9. Return and deletion

You can export your student list at any time and request a copy of other Customer Data by email. When the Agreement ends, or you delete your account, we delete Customer Data from live systems within 30 days and from backups within a further 35 days, unless the law requires us to keep it, in which case we keep it confidential, process it only for that purpose and delete it when the requirement ends.

10. International transfers

Customer Data is hosted in Germany, with evidence photos and backups in the EU. Some Subprocessors process Customer Data in the United States (see Annex 3). For Restricted Transfers from the EEA we rely on the Standard Contractual Clauses adopted by the European Commission (Module 2, controller to processor, or Module 3 where you are a processor), with the UK International Data Transfer Addendum for UK transfers and the Swiss amendments for Swiss transfers, or on the EU-US, UK-US and Swiss-US Data Privacy Framework where the recipient is certified. The clauses are incorporated by reference, populated with the details in Annex 1, with Option 2 general authorisation for Subprocessors, 15 days' notice, the governing law and courts of Ireland (EU) or England and Wales (UK), and Annex 2 as the security measures. For transfers of Nigerian personal data we rely on the mechanisms permitted under the Nigeria Data Protection Act 2023. If a mechanism we rely on is invalidated we will promptly adopt an alternative.

11. US state privacy laws

Where US state privacy laws apply, we act as your service provider or processor. We will not sell or share Customer Data, retain, use or disclose it outside the direct business relationship with you or for any purpose other than providing the service, or combine it with personal data from other sources except as permitted. We will notify you if we can no longer meet these obligations, and you may take reasonable steps to stop and remediate unauthorised use.

12. Liability and precedence

Each party's liability under this DPA is subject to the limits and exclusions in the Agreement, except that nothing limits liability to data subjects under Data Protection Laws. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Data; the Standard Contractual Clauses prevail over both for the transfers they govern.

Annex 1. Details of processing

Annex 2. Technical and organisational measures

• Access control: every database query is scoped to the owning tutor's id, enforced in server code and covered by tests; sign-in via Clerk with password or Google OAuth; administrative access to the server by SSH key only, limited to named operators; the database has no public network port.
• Encryption: TLS for all traffic; encrypted storage for backups; secrets held in the deployment platform, never in code.
• Data minimisation: private notes are excluded from every outbound message and from AI prompts by construction, with automated tests; AI prompts are built from an allow-list of fields; analytics properties are allow-listed; logs and error reports are scrubbed of names, contact details, notes and message content before storage.
• Guardian access: progress links are long random tokens stored only as hashes, revocable on request, rate-limited and not indexed; media links expire after ten minutes; guardian pages carry no analytics.
• Media: photos are re-encoded on upload (removing metadata), size-limited, stored in a private bucket in the EU, and deleted on a retention schedule.
• Consent and opt-out: per-channel consent timestamps; STOP, START and HELP keyword handling; unsubscribe links in every email; bounce handling.
• Availability and recovery: containerised deployment with health checks and automatic restart; nightly database backups to a separate EU object store, encrypted at rest, with 7 daily and 4 weekly copies; restore tested; uptime and worker monitoring with alerts.
• Integrity: idempotent webhooks; the job queue lives in the database so queued messages survive restarts without duplication.
• Monitoring: error monitoring with session replay disabled and personal data scrubbed; audit of deploys via version control; alerts to the operations channel.
• Organisational: a small team with a named operator responsible for security; least-privilege provider tokens, rotated when exposed; providers bound by data processing terms; breach procedure in section 7.

Annex 3. Subprocessors

The current list is maintained on the Subprocessors page at tutorwrap.com/subprocessors and reproduced here as at the date above.