Data privacy agreement template
Draft pending counsel review. This page is a working draft for the Teams product launch.
It is not final legal advice. Counsel must review and approve it before you rely on it in production.
For School and Department plans that need a written agreement with their institution. Download the markdown template, have counsel review it, then execute a final version.
Data Privacy Agreement Template (Draft)
Status: Draft pending counsel review. Not a signed contract until both parties execute a counsel-approved version.
Parties: Learning Style Quiz ("Processor") and the educational institution named below ("Controller").
Scope: Use of the Teams product for School or Department plans, including rostering participants, quiz administration, results dashboards and playbook delivery.
1. Roles
The Controller determines the purposes of processing student or learner data. The Processor processes that data only to provide the Teams Service described in the product Terms.
2. Categories of data
For K-12: first name, last initial, quiz answers and derived learning-style results, group membership, and related operational logs.
For University Department plans: first name, last name, email, quiz answers and results, group membership, and related operational logs.
No advertising identifiers are collected from participants for marketing.
3. Processor obligations
- Process personal data only on documented instructions from the Controller (including configuration inside the Teams product).
- Ensure personnel are bound to confidentiality.
- Implement appropriate technical and organizational measures (access control, encryption in transit, password hashing, org-scoped queries, audit logging of admin actions).
- Not sell personal data or use participant data for advertising.
- Delete or return personal data after the retention periods in the Privacy Policy (archived participants hard-deleted 12 months after archive; organization deletion after a 30-day grace window), unless law requires retention.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data.
4. Subprocessors
Current subprocessors include hosting, Stripe (billing for the Controller's subscription) and Mailgun (transactional email). The Processor will keep a current list available on request.
5. Assistance
The Processor will reasonably assist the Controller with data subject requests that the Controller cannot fulfill alone inside the product, and with security and DPIA questions related to the Service.
6. International transfers
Describe transfer mechanisms applicable to the Controller's jurisdiction once counsel has reviewed hosting locations.
7. Term
This agreement tracks the Controller's paid School or Department subscription and survives termination for so long as the Processor retains Controller personal data.
---
Controller legal name: _______________________________
Controller signatory: _______________________________ Date: __________
Processor signatory: _______________________________ Date: __________