Under GDPR (Article 28), schools that use GraidLens to process student data must have a signed data processing agreement (DPA) with GraidLens as processor.
Model Data Processing Agreement 4.0
For Dutch schools we use the Model Data Processing Agreement 4.0 of the Dutch Privacy Covenant for Education (Privacyconvenant Onderwijs), drawn up jointly by schools and suppliers. We fill in the privacy annex and the security annex per school.
We send the completed agreement on request; a downloadable version will follow.
Who needs a data processing agreement?
Every school, department, or institution that uses GraidLens to process personal data about students (including pseudonymised labels) should have a signed data processing agreement. Individual teachers using a personal subscription for their own classes typically act as a private individual, but should check their school's data policy.
What the data processing agreement covers
Categories of data
Exam photos, scores, student labels.
Purpose & legal basis
Why and on what basis we process data.
Security measures
Technical and organisational safeguards.
Sub-processors
Which parties process data on our behalf — included in the agreement itself.
Retention & deletion
Obligations around retention periods.
Your rights
As data controller for your school.
Requesting a data processing agreement
To request a signed data processing agreement for your school or institution, email dpa@graidlens.eu with your school name and country. We'll send a draft within 5 business days.
Sub-processors
The sub-processors — with purpose, data processed and location for each party — are listed on the Privacy & sub-processors page (in Dutch) and are also part of the data processing agreement. Stored data is kept on servers in the EU. AI processing for grading can take place outside the EU; the safeguards for that transfer are on the same page.
Improving recognition models
GraidLens doesn't use personal data to train or evaluate AI models, with one exception that's explicitly turned on or off per teacher. When that setting is on, GraidLens retains the 'AI reading → teacher correction' pairs from transcriptions to improve handwriting recognition. This processing runs on pseudonymised text (names, email addresses, and long number sequences are removed), contains no grades, is manually reviewed before use, and is used exclusively internally and offline for a model managed by GraidLens itself — never shared with or used to train a third party's model. The school (data controller) can exclude this processing for all its teachers by indicating so when requesting the data processing agreement; individual teachers manage it via their account settings. Our AI provider does not use data submitted via its API to train models.