Data processing agreement.

This agreement governs personal-data processing when an academy, centre or teacher contracts AulaWise to manage student data. It is incorporated into the terms of institutional use of AulaWise from the moment the customer activates or uses the service for that purpose.

The customer is the controller: it decides why and how student data is entered. Àlex Pedrol i González, the self-employed owner of AulaWise (Spanish tax ID 46762843W), acts as processor solely to provide the contracted service.

AulaWise processes data for the duration of the service and only on the customer's documented instructions: hosting it, displaying it in the dashboard, calculating statistics, preparing reports and maintaining the technical security and availability of the application.

AulaWise does not sell student data, use it for advertising or use it to train its own models. If an instruction breaches applicable law, AulaWise will inform the customer before processing the data unless a legal obligation prevents this.

Data subjects may include teachers, students and, if entered by the customer, contact details of families or guardians. Data categories may include name, surname, optional email, class, results, attendance, goals, reports, teacher observations and technical account metadata.

The customer must only enter data needed for academic tracking. AulaWise must not be used to process health data, diagnoses, disciplinary information, family circumstances or other particularly sensitive data unless strictly necessary and supported by an appropriate legal basis.

AulaWise limits access to data to people or systems that need it to provide the service and which are subject to confidentiality duties. It uses authentication, access controls, encryption in transit and infrastructure providers with security measures appropriate to the service.

The customer must protect its users' credentials, grant access only to authorised people and promptly report any unauthorised use it identifies.

The customer authorises the sub-processors needed to provide AulaWise: Clerk for authentication, Supabase for database storage, Vercel for application hosting, Resend for service emails, and OpenAI only where a teacher expressly activates AI-assisted assessment generation.

AulaWise will impose data-protection obligations on sub-processors appropriate to their role. If a sub-processor materially affecting student data needs to be added, AulaWise will update this list and notify the customer with reasonable notice, except where urgent security or service-continuity needs apply.

AI-assisted report generation is optional and is activated only at a teacher's request. To create the draft, AulaWise sends OpenAI the student's display name and strictly necessary academic data, such as results, attendance, trends and papers to strengthen; it does not send the student's email address or the teacher's internal notes.

AI does not automatically decide a pass, progression to another level or access to courses. The teacher must review and approve the text before sharing it and remains responsible for professional judgement and the use of the report.

Taking account of the nature of the processing, AulaWise will assist the customer in responding to access, correction, deletion and other data-subject rights requests. If AulaWise receives a request directly, it will refer it to the customer where appropriate.

If AulaWise identifies a personal-data breach affecting customer data, it will notify the customer without undue delay and share the available information so the customer can assess its notification obligations. On reasonable request, AulaWise will provide the information needed to demonstrate compliance with this agreement.

Some providers may process data outside the European Economic Area. In those cases, AulaWise and its providers will apply the required safeguards, such as standard contractual clauses, adequacy decisions or other mechanisms recognised by applicable law.

The customer can request updated information about providers involved in processing by writing to hello@aulawise.com.

At the end of the service, the customer can request an export of its data before closing the account. AulaWise will then delete or return personal data in accordance with the customer's instructions, unless law requires part of it to be retained for longer.

Technical backups may persist for a limited time until secure replacement or deletion in accordance with providers' security cycles.

For questions about this agreement or to request the documentation needed for a centre, write to hello@aulawise.com.

This text sets out AulaWise's general processing terms. In a specific institutional relationship, the customer may need to complete its identifying details and specific commercial conditions.