School data-processing agreement

Parties and application

This agreement is between the school, district or other educational organisation identified in the service order (the school, as controller) and:

KUBO acts as processor for the school-managed records described below. This agreement applies when incorporated into the school’s service contract or otherwise accepted in writing by both parties, together with a completed service schedule. Publishing this page or a student signing in does not create a signed agreement or replace an existing school contract. Contact yourfriends@kubo-robot.com to arrange it.

Processing covered

The services are classroom administration in the Educator Portal and learning activities in KUBO Play. Processing includes receiving and organising records, authenticating users, storing and retrieving progress and work, presenting authorised reports, supporting the service and returning or deleting records. It continues for the agreed service period and the limited return/deletion period in the service schedule.

• People: students, educators, school administrators and other staff whose information the school supplies or authorises.
• Data: names or nicknames, school/class membership, school sign-in identifiers and access codes, service identifiers, assigned work, saved solutions and maps, progress, gameplay events and timestamps, results and associated support records.
• Purpose: deliver, maintain, secure and support the school’s educational service under its instructions. Special-category information is not required and the school must not submit it without a separate lawful arrangement.

KUBO’s own business-contact, contracting, billing and legal-compliance records are described separately in the privacy policy. This distinction does not allow KUBO to repurpose student records for its own commercial activities.

Instructions and confidentiality

The school determines the educational purposes, lawful basis, authorised users and retention instructions, and provides the notices required for its role. Its documented instructions comprise the service contract, this agreement, the schedule and authorised service requests. KUBO processes covered data only on those instructions, including for international transfers, unless EU or Member State law requires otherwise. In that case KUBO will inform the school before processing unless that law prohibits notice. KUBO will promptly inform the school if an instruction appears to infringe applicable data-protection law.

KUBO ensures that people authorised to handle covered data are bound by confidentiality and receive access only as needed for their role. KUBO will not sell covered student information, use it for targeted advertising or unrelated commercial profiling, or use it to train general-purpose AI models. Any new processing purpose requires an appropriate lawful arrangement; a general update to this webpage is not permission.

Security and incidents

KUBO must implement technical and organisational measures appropriate to the risks, including access controls, protection of credentials, secure transmission, operational security and recovery procedures. The schedule records the measures applicable to the deployment, including access review, encryption, backup protection, recovery testing, patching and secure deletion. Measures must provide ongoing confidentiality, integrity, availability and resilience, and be regularly assessed for effectiveness under GDPR Article 32.

KUBO will notify the school without undue delay after becoming aware of a personal-data breach affecting covered data. It will provide available information about the incident, affected records and people, likely effects and mitigation, with updates as facts become available, and assist the school with required notifications. This does not transfer the school’s notification duties to KUBO or reduce KUBO’s own duties.

Subprocessors and transfers

The school gives general written authorisation for the subprocessors identified in its agreed schedule. KUBO must inform the school of intended additions or replacements in advance, giving it sufficient opportunity to object on data-protection grounds before the change affects its data. An unresolved objection must be addressed through an agreed alternative or the affected service must not use that provider for the school’s data. KUBO must impose equivalent data-protection obligations by contract and remains responsible to the school for the subprocessor’s performance. The schedule identifies each provider’s legal name, function, data involved and processing locations.

The standard hosting provider is Hetzner Online GmbH, covering hosting, databases, backups and transactional email. The school’s agreed schedule must identify the actual hosting and backup locations for each service and any other providers receiving covered data. Do not infer processing location from the school’s address or from another KUBO service.

Transfers outside the EEA require the school’s documented instructions and a valid GDPR transfer mechanism, with supplementary safeguards where necessary. The schedule identifies those transfers and safeguards. This agreement is not itself an international-transfer mechanism. School-selected identity services and a payment merchant may have separate controller roles; they must not automatically be described as KUBO subprocessors.

Rights, assistance and oversight

KUBO will promptly refer requests about school-controlled records to the school and assist it, taking account of the nature of processing, with access, correction, restriction, export, objection and deletion. It will also assist with security obligations, impact assessments and consultation with supervisory authorities, taking account of information available to KUBO.

KUBO will provide information necessary to demonstrate compliance with this agreement and allow and contribute to audits and inspections by the school or its appointed auditor. Practical arrangements must protect other customers’ data and security without preventing the school’s statutory oversight rights. KUBO will cooperate with competent supervisory authorities as required.

Return, retention and deletion

Covered school records may be retained only as needed for the school’s educational service and documented instructions, subject to applicable law. The service schedule must identify the educational purpose, the applicable retention period or end event, and the timeframes and arrangements for return, live deletion and removal of backup copies. These must reflect the actual deployment and comply with applicable legal requirements; student records must not be retained indefinitely for possible future use. A temporary subscription lapse alone does not end the school agreement.

At the end of the services, KUBO must, at the school’s choice, return or delete covered personal data and delete existing copies, unless EU or Member State law requires retention. KUBO must also act on valid deletion instructions and remove records when they are no longer needed for their authorised purpose. Any legally retained copies remain protected and may be used only for the required purpose. Applicable statutory deadlines and any stricter commitments in a signed school agreement continue to apply.

Cross-service requests currently require manual coordination. The process must cover the Portal, the Play game server, relevant exports and support copies, and subprocessors. Portal delete buttons do not automatically remove corresponding Play records. The school’s schedule must expressly address backup retention, removal and safeguards against restoring deleted data to ordinary use. KUBO must verify the agreed arrangements for each deployment before accepting that schedule, and confirm the scope of completed work and any outstanding copies or lawful exceptions when responding to a deletion request.

US school use

Where a school relies on FERPA’s school-official exception, KUBO acts under its direct control over the use and maintenance of education records, uses them only for the authorised educational service and restricts redisclosure as applicable law requires. The school determines whether that exception and its required criteria apply. KUBO assists the school with access and correction requests.

Where COPPA applies, KUBO must provide the required direct notice and obtain valid authorisation before collecting children’s information. School authorisation is limited to use for the school’s educational purposes and cannot authorise unrelated commercial uses. KUBO remains responsible for its own COPPA obligations. Where school authorisation cannot be relied on, any required verifiable parental consent must be obtained before the relevant collection.

Applicable state student-privacy requirements and mandatory district provisions continue to apply. This agreement does not claim certification or replace required state-specific terms.

Service schedule and order of precedence

Before using this agreement, KUBO and the school must record the following in their service order or attached schedule:

• The school’s legal name, address, authorised signatory, privacy/incident contact, selected services, start date and service duration.
• Any changes to the processing description above, the educational retention purpose, the retention period or end event, and verified timeframes for return, live deletion and backup removal, including any stricter legal or contractual deadlines.
• Deployment locations, approved subprocessors, international transfers and safeguards, and the security measures applying to that deployment.
• Applicable US school provisions, required notices and authorisation, and any agreed return/export arrangements.

This agreement prevails over conflicting general service terms on processing covered data. Mandatory law and any applicable international-transfer clauses prevail where required. Changes require the parties’ written agreement. Existing signed school agreements continue to govern until properly amended.