Data processing agreement

This is a working draft. The academy and qualified legal counsel should review it before signing.

Roles and purpose

The academy is the controller of its students' data. Daniel Márquez Bouzo, the owner of Impronta, acts as processor and follows the academy's documented instructions to provide protected video, control access and record viewing.

Duration

Processing lasts while the service is active and for the agreed retention periods. Records are scheduled to expire after 24 months unless the academy instructs otherwise or the law requires longer; technical deletion may occur later.

Data and people

Data may include names, email addresses, Moodle identifiers, access and playback records, and information the academy chooses to show in the video mark. The people concerned are students, teachers and authorised academy staff.

Infrastructure and security

Infrastructure runs on Amazon Web Services (AWS), eu-west-1, Ireland. Impronta uses academy isolation, access controls, expiring signed links and internal codes where personal data need not appear in records. Other subprocessors will be identified before use and changes will be notified in advance.

Security measures

Access to the service is restricted to authorised personnel who need it for operation and support. The academy remains responsible for choosing the data shown in the video mark and for its instructions to Impronta.

Retention and termination

On termination, the academy can export its videos in their original format and request return or deletion of data as applicable.

Assistance and breaches

Impronta will reasonably assist with data-subject requests, impact assessments and supervisory-authority consultations, and will notify the academy without undue delay of any security breach affecting its data.

This draft is not legal advice or a signed agreement. Contacthola@impronta.video.