Data Processing Agreement

This data processing agreement applies between:

Jointly referred to as the "Parties".

• GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation.
• Personal data: all information relating to an identified or identifiable natural person, as referred to in Article 4(1) GDPR.
• Processing: any operation relating to personal data, such as collection, recording, storage, alteration, consultation, disclosure or erasure.
• Data subject: the natural person to whom the personal data relates — primarily teachers and participants.
• Data breach: a breach of security that, accidentally or unlawfully, leads to the destruction, loss, alteration, unauthorised disclosure of or access to personal data.
• Sub-processor: a third party engaged by the Processor to process personal data on behalf of the Controller.

This agreement governs the processing of personal data by LectaMe in connection with the provision of the LectaMe platform — an AI-supported presentation and interaction platform for education and training.

The agreement takes effect when the Client starts using LectaMe (by creating an account or organising a session in which participant data is processed) and remains in force for as long as LectaMe processes personal data on behalf of the Client.

The agreement terminates automatically when LectaMe no longer processes any personal data for the Client, or upon written termination by either of the Parties subject to the notice period set out in the main agreement.

• Client is the controller for processing carried out in connection with their teaching or training activities using LectaMe.
• LectaMe is the processor for processing carried out on behalf of the Client.
• For processing that LectaMe carries out for its own business purposes (such as account management, security, invoicing, own marketing), LectaMe is itself the controller. This agreement does not cover that; see the privacy policy.

LectaMe processes personal data solely on the basis of documented instructions from the Client. This agreement, the terms and conditions and the privacy policy together form those instructions, along with the settings the Client configures in the application (for example, the choice to turn AI features or analytics on or off).

LectaMe informs the Client if it considers that an instruction infringes the GDPR.

Within LectaMe's mentoring and development environments, data subjects record data for the purpose of their own professional development: reflections, coaching conversations, observations and agreements with a mentor. In the system this data has the privacy scope private or coaching and is technically separated from the formal space in which assessment takes place.

Data recorded within LectaMe as coaching data is processed solely for the purpose of professional development and mentoring. It is not disclosed to managers, HR, assessors or other representatives of the Client, and is not used for formal personnel assessment, unless the data subject has deliberately moved that data to the formal space themselves.

• Creating and editing presentations, including any AI-generated content at the teacher's request.
• Organising and facilitating live sessions in which participants join via a session code or QR code.
• Recording and presenting participants' answers and responses to the teacher, for formative purposes.
• Management and authentication of the Client's accounts and those of their staff.
• Logging and monitoring for security and stability purposes.
• Supporting the guidance and professional development of students or employees: learning goals, practice assignments, portfolio and evidence, feedback, coaching conversations, planning, work placements, exams and exemptions — insofar as the Client uses the module in question.
• Recording self-assessments and mentor assessments against work processes from a qualification or competence framework, and deriving progress and points of attention from them.

• Teachers and administrators of the Client who have an account.
• Participants (typically students or course participants) who join a live session via a session code.
• Guests who create presentations without an account under the responsibility of the Client.
• Students with an account who work on their learning goals, portfolio and professional development within the Client's guidance and development environment.
• Mentors from outside the educational institution such as practice supervisors and work supervisors at a training company, who follow a student on invitation, within the limits of their role and permission level.

LectaMe is niet ontworpen voor de structurele verwerking van bijzondere persoonsgegevens (artikel 9 AVG) of strafrechtelijke gegevens (artikel 10 AVG). De Opdrachtgever zorgt ervoor dat gebruikers binnen de eigen organisatie geen medische gegevens, diagnoses, religieuze overtuiging, etniciteit, seksuele gerichtheid of vergelijkbare gegevens invoeren in presentatie-inhoud, AI-prompts of sessiegegevens, tenzij daar vooraf een rechtmatige basis en passende maatregelen voor zijn ingericht.

LectaMe toont waar relevant in de interface waarschuwingen aan gebruikers om geen persoonsgegevens, patiëntgegevens of vertrouwelijke informatie in AI-prompts op te nemen.

One module is an explicit exception, and it was designed that way. My Growth invites the data subject to reflect on wellbeing, balance, habits, goals and personal experiences. An answer to that may reveal information about a person's physical or mental health. The Parties therefore assume that special categories of personal data within the meaning of article 9 GDPR may be processed within My Growth. A prohibition would not be credible while the module deliberately asks about wellbeing; instead the processing is regulated along the conditions in this article.

My Growth is OFF by default. The module is activated per institution only, after the Client has established in writing on which legal basis under article 6 GDPR it processes, which exception under article 9(2) GDPR it invokes, and whether a data protection impact assessment (DPIA) is required. Activation is technical and per organisation; without that action the module does not exist for the Client's data subjects.

All LectaMe staff and all external persons engaged by LectaMe who may gain access to personal data are bound by confidentiality under their employment or service contract or an additional confidentiality declaration.

LectaMe takes appropriate technical and organisational measures to ensure a level of security appropriate to the risk. In broad terms, these include:

• Access management, authentication and role-based authorisation.
• Encryption of connections and encryption of storage at the platform level.
• Logging and monitoring of security-relevant events.
• Backup and recovery provisions.
• Regular updates and patching of components.
• Incident response procedures.
• Assessment of suppliers and sub-processors.
• Data minimisation and purpose limitation in the design of features.
• Periodic evaluation of the measures.

A high-level explanation can be found on the security page. Additional details can be shared under confidentiality arrangements with schools and organisations that need them for their own assessment.

The Client hereby gives general written authorisation for the engagement of the sub-processors listed below. The procedure in Article 14 applies to changes.

LectaMe informs the Client at least 30 days before a planned change to the sub-processors (addition, replacement or change of location). Within that period, the Client may object with reasons. In the event of a well-founded objection, the Parties will seek a reasonable solution; if that is not possible, the Client may terminate the agreement.

Primary storage takes place within the EEA. For sub-processors where processing may (partly) take place outside the EEA, we apply safeguards such as the EU-US Data Privacy Framework and/or Standard Contractual Clauses. The applicable safeguard per sub-processor is shown in the table above.

LectaMe supports the Client in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) by, where possible, making the necessary data accessible or exportable via the platform's management functions.

For requests that the Client cannot handle themselves, LectaMe provides reasonable assistance with the requested information.

LectaMe supports the Client in carrying out a data protection impact assessment (DPIA) and in any prior consultation of the supervisory authority, insofar as this can reasonably be expected of LectaMe.

LectaMe reports a possible data breach to the Client without undue delay after LectaMe becomes aware of it. The Client then assesses, as the controller, whether notification to the supervisory authority (in principle within 72 hours of the Client becoming aware) and to the data subjects is necessary.

LectaMe documents all data breaches and the measures taken in response.

Upon request, LectaMe provides the Client with reasonably available information enabling the Client to verify compliance with this agreement. An audit by or on behalf of the Client is possible on the basis of written notice, with due regard to reasonable preparation time and business continuity, and subject to confidentiality arrangements. Any costs of an audit are borne by the Client, unless the audit reveals a material shortcoming.

After termination of the service, LectaMe deletes the personal data from active systems within 30 days, unless statutory retention obligations require otherwise. At the Client's request, an export is made available in a common format prior to deletion.

Rotating backups that are still persistent at the time of deletion are removed in accordance with our hosting provider's backup schedule; during that period, data stored in them remains encrypted and inaccessible for production use.

LectaMe's liability under this agreement aligns with the liability provisions in our terms and conditions, except insofar as mandatory law provides otherwise (such as Article 82 GDPR).

In the event of a conflict between this data processing agreement, the terms and conditions and the privacy policy, the following order of precedence applies:

1. This data processing agreement (for processing matters).
2. The terms and conditions.
3. The privacy policy (as an explanation of the processing).

Questions about this data processing agreement? Email privacy@lectame.com or legal@lectame.com. If you have complaints about the processing of personal data, you can also contact the Autoriteit Persoonsgegevens.