Teacher data processing agreement — draft
Sandbox working draft, not a final legal document. Owner-supplied identity is included; the office, tax classification and remaining gaps require verification. Live sales are not authorised.
Version: 2026-10-16-sandbox-v4-direct-manual
Scope and parties
MERCURIUS 4 Kereskedelmi és Szolgáltató Betéti Társaság (Mercurius 4 Bt.). Company registration: 01-06-016739; Hungarian tax number: 28135775-2-41. Registered office: [REGISTRY ADDRESS TO BE PROVIDED AND VERIFIED]; registry court: [TO BE VERIFIED]; postal complaints address: [TO BE PROVIDED]. Contact: info@chemistrytutor.hu. Normal Hungarian VAT status is owner-declared; the registry extract and applicable tax registrations require separate verification. Only processing on a teacher’s documented instructions within their private-student workspace may fall within this processor arrangement. Teacher/controller identity, authority, service agreement and fact-based legal role approval must be completed. This Article 28 working draft is not an effective DPA or blanket consent.
Subject, duration and purpose
During the subscription and an approved return/deletion period: learner invitations, scheduling, sharing, submissions, shared drawing/notes, feedback and progress. Subjects include teachers, learners and necessary representatives; data includes necessary names/emails/IDs, timetable, work, drawings, results, messages and sharing choices. Routine special-category processing is not intended; unexpected sensitive free text requires separate handling.
Instructions and confidentiality
The teacher determines lawful purposes, legal basis, notices and instructions. Processing, including transfers, follows documented instructions; statutory exceptions are notified beforehand unless prohibited. Unlawful instructions are reported and the affected action suspended. Authorised personnel require documented confidentiality and least-privilege access.
Security and separation
Server access checks, workspace membership and RLS; private files/signed links; TLS; administrator MFA; token hashes; revocation and audit. Actual backup, restoration, access-review and vulnerability procedures must be specified in the final technical annex. Teacher access is not platform administration.
Subprocessors and transfers
Approve a specific register of Supabase, Vercel, Resend, configured OpenAI and delivery-specific FCM/APNs entities, data, regions and terms. Stripe’s own payment purposes can involve separate controllership. Prior written general/specific authorisation, change notice and objection handling apply to new subprocessors. Non-EEA transfers require an appropriate Chapter V mechanism and necessary supplementary measures.
Incidents and assistance
Notify the teacher/controller without undue delay after awareness, including available facts, affected categories, effects, measures and contact; provide updates. Assist rights requests, DPIAs and prior consultation without deciding the teacher’s legal basis for a request. The controller assesses regulatory notification deadlines.
Return, deletion and backups
At termination, follow the teacher’s documented choice of supported export/return or secure deletion, subject to statutory retention. Export format/deadline, primary deletion, backup expiry and re-deletion after restoration require an approved retention annex. Cancelling renewal alone does not delete data; no unimplemented deletion automation is promised.
Audit and approval
Provide information needed to demonstrate compliance and cooperate with justified audits while protecting system security and other clients. Complete version/approval, security and subprocessor annexes, teacher/controller identity, contacts and retention instructions. This is not represented as an effective agreement before legal review.