Data Processing Agreement (DPA)

This Agreement supplements the Dearpage School use contract between the contracting school ("School") and Dearpage ("Processor"). It governs the processing of personal data of students, teachers, staff and guardians, and the School accepts it when it contracts. It applies the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018).

1. Roles

The School is the controller of the personal data processed in Dearpage School: it decides the purposes and means of processing. Dearpage is the processor: it processes the data on the School's behalf, only under the instructions described in this Agreement and in the contract. Processor: Pedro Henrique Iamondi (MEI), CNPJ 33.535.787/0001-45, privacy@dearpage.app.

2. Subject matter and duration

Processing is needed to provide Dearpage School: classes, lessons, assignments, marking, feedback, messages and school communication. This Agreement applies while the contract lasts and until the data is returned or deleted, as set out in clause 9.

3. Data subjects and data

• Data subjects: students, teachers and staff of the School and, where applicable, guardians.
• Data: identification and contact details, date of birth, links to the School and to classes, school content (lessons, assignments, grades, feedback and messages), and access and usage records.
• Dearpage does not request sensitive data. The School should not enter it on the platform unless necessary.

4. Instructions

The Processor processes the data only under the School's instructions, expressed in this Agreement, in the contract and in the use of the platform. If the Processor considers that an instruction breaches the LGPD, it will inform the School in writing.

5. Processor obligations

• Ensure that the persons authorised to process the data are bound by confidentiality.
• Adopt technical and administrative security measures, such as encrypted connections, role-based access control and logs of administrative actions.
• Not use the data for its own purposes, such as advertising.
• Forward to the School any data-subject requests received, within 5 business days, and assist the School in responding.

6. Sub-processors

The School authorises the sub-processors below. The Processor will give reasonable advance notice of any new sub-processor, and the School may object on legitimate grounds.

• Convex: database and backend processing.
• Cloudflare: hosting and delivery of the website.
• Dearpage's mail server: sending transactional e-mails.
• Stripe: payments, where the contract is paid through it.
• OpenRouter and Groq: artificial intelligence providers, only where the School enables AI features for its students' content.
• PostHog: analytics, only with the data subject's consent, as set out in the Privacy Policy.

7. International transfers

Some sub-processors are outside Brazil. Transfers follow Article 33 of the LGPD, with contractual clauses and safeguards compatible with the law.

8. Security incidents

The Processor will inform the School without undue delay, and within 48 hours of becoming aware of an incident that may cause significant risk or harm to data subjects. The notice will contain the information available and the measures taken.

9. End of processing

When the contract ends, the School may request the return of the data in a structured format within 30 days. After that period, the Processor deletes the data, unless a legal retention duty applies.

10. Children and adolescents

Where the School processes data of children or adolescents, the School must obtain the specific and prominent consent of at least one parent or legal guardian, under Article 14 of the LGPD, and inform the Processor of that consent. The Processor applies the School's instructions on that consent.

11. Information and audit

The Processor provides the information needed to demonstrate compliance with this Agreement. An audit may take place once a year, with 30 days' prior notice, during business hours and without access to other customers' data.

12. Governing law and venue

Brazilian law applies. The courts of the judicial district of Rio Claro/SP are chosen, subject to the venue rules of the law.