This Data Processing Agreement ("DPA") is entered into between:
ICO Registration: ZC133810
TBS Education Ltd Oy is registered with the UK Information Commissioner's Office (ICO) as a fee-paying data controller and processor. The registration is publicly verifiable on the ICO register at ico.org.uk.
The Processor processes personal data on behalf of the Controller for the purpose of operating The Business School classroom simulation, generating session scores, and producing AI-assisted post-session feedback reports. This DPA remains in force for the duration of the Controller's licence and continues to apply to any retained data thereafter.
The Processor will process personal data only for the documented purposes set out in this DPA and the Controller's instructions. Processing includes: storing teacher account information; capturing pseudonymous student session data; generating scores and reports; and supporting the Controller in fulfilling data-subject requests.
| Category | Detail |
|---|---|
| Teacher data | Name, email, school name, session history |
| Student data | Self-selected nickname only, no real name, email, DOB, photo or other identifier collected |
| Gameplay data | In-session decisions and team scores |
| Technical data | IP address (server logs, 30-day retention); browser/device headers; session timestamps |
The Controller authorises the Processor to engage the following sub-processors. The Processor will give the Controller at least 30 days' notice of any intended addition or replacement, allowing the Controller to object on reasonable data-protection grounds.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Netlify, Inc. | Frontend hosting, edge CDN, serverless functions | Global edge network; primary EU edge nodes | Standard Contractual Clauses (UK Addendum) under UK GDPR Art. 46 |
| Neon, Inc. | Postgres database (sessions, scores, teacher accounts) | AWS US East 1 (current), EU region migration planned May 2026 | Standard Contractual Clauses (UK Addendum); AES-256 at rest; TLS 1.2+ in transit |
| OpenAI | AI inference for end-of-session feedback reports (Claude API) | EU and US regions | Standard Contractual Clauses (UK Addendum); no student identifiers sent |
The Processor will ensure that any person authorised to process personal data is committed to confidentiality and is appropriately trained.
Taking into account the nature of the processing, the Processor will assist the Controller, by appropriate technical and organisational measures, in fulfilling Controller's obligation to respond to requests for exercising data-subject rights under UK GDPR Articles 15-22.
The Processor will notify the Controller of any personal data breach without undue delay, and in any event within 72 hours of becoming aware, providing the information required under UK GDPR Art. 33.
The Processor will make available to the Controller all information necessary to demonstrate compliance with this DPA. The Processor will allow for reasonable audits, conducted by the Controller or another auditor mandated by the Controller, on at least 30 days' written notice.
At the choice of the Controller, the Processor will delete or return all personal data after the end of the provision of services, and delete existing copies, unless retention is required by law.
This DPA is governed by the laws of England and Wales for UK Controllers, and by Finnish law for non-UK Controllers. Disputes are subject to the exclusive jurisdiction of the competent courts of London for UK Controllers, and Helsinki District Court for non-UK Controllers.