Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") describes how Pluddy("Processor") processes personal data on behalf of language schools ("Controller") that use the Service at www.pluddyonline.com.

It is intended to meet the requirements of GDPR Article 28. For a countersigned PDF tailored to your school, email hello@pluddyonline.com.

1. Roles

• Controller: the school (or education provider) that decides the purposes and means of processing student, teacher, and school-admin account data in its workspace.
• Processor: Pluddy, which provides hosting, authentication, curriculum tooling, and AI-assisted practice features under the school's instructions.

2. Subject matter and duration

Processing covers account administration, learning progress, uploaded teaching materials, and AI tutoring interactions for the duration of the school's subscription or pilot, plus any retention period required for legal, security, or backup purposes after offboarding.

3. Nature and purpose of processing

• Create and manage user accounts (students, teachers, school admins)
• Store and index school-uploaded materials for curriculum-aligned practice
• Generate tutoring responses, drills, and progress analytics
• Bill the school (active seats, invoices) and provide support

4. Types of personal data

• Identity and contact: name, email, role
• Learning data: CEFR level, scores, vocabulary/progress summaries, chat/practice context
• School content: PDFs and derived lesson content tied to the school
• Technical logs needed for security and reliability

Special-category data is not intentionally collected.

5. Categories of data subjects

Students, teachers, school administrators, and (where applicable) billing contacts.

6. Processor obligations

Pluddy shall:

• Process personal data only on documented instructions from the Controller
• Ensure persons authorised to process data are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Assist the Controller with data-subject requests and GDPR obligations where reasonable
• Delete or return personal data after the end of services, subject to legal retention
• Make available information necessary to demonstrate compliance with Article 28

7. Sub-processors

The Controller authorises the use of the following categories of sub-processors:

• Supabase — database, auth, and file storage (prefer EU region where configured)
• Vercel — application hosting and edge delivery
• Google Gemini (Google Cloud)— AI inference for tutoring and material extraction, under Google's Data Processing Addendum / SCCs. Under paid API terms, Google does not use customer prompts/outputs to train generative models.
• Email delivery providers (e.g. Brevo / Resend) — transactional mail

Material changes to sub-processors will be communicated to school billing contacts where practicable. Objection rights may be exercised by writing to hello@pluddyonline.com.

8. International transfers

App and school data are preferentially hosted in the EU. AI processing via Google Gemini may occur outside the EEA under Google's DPA / Standard Contractual Clauses. Pluddy does not claim that all processing remains inside the EU.

9. Security

• Access control and role-based portals (student / teacher / school admin / platform)
• Encryption in transit (TLS); encryption at rest via cloud providers
• Service-role credentials kept server-side; school AI keys not exposed to browsers
• Token budgets and rate limits to reduce abuse

10. Assistance with data-subject rights

Schools can export roster metadata and request offboarding from School Admin → Settings. Individual users may delete their own account from Settings. For full archives or complex erasure, contact hello@pluddyonline.com.

11. Breach notification

Pluddywill notify the Controller without undue delay after becoming aware of a personal-data breach affecting the school's workspace, with information reasonably available to assist the Controller's own notification duties.

12. Return or deletion

On written request after contract end, Pluddy will delete or return Controller data within a commercially reasonable period (target: 30 days), except where retention is required by law or for dispute resolution / security logs.

13. Governing law

Unless otherwise agreed in a signed order form, this DPA is governed by the laws of Poland, without prejudice to mandatory GDPR provisions.

14. Contact

Processor contact: hello@pluddyonline.com