Data processing agreement
This Data Processing Agreement describes how YouGrade (the "Processor") handles personal data on behalf of each school using the service (the "Controller"). It supplements the Terms of Service.
Scope & roles
The school appoints YouGrade to process personal data solely for providing the examination service. The school decides the purposes and means and remains the controller; YouGrade acts only on documented instructions from the school.
Data & data subjects
Data subjects: school staff (admins, operators, teachers) and students identified in the school's rosters. Data categories: staff names/emails/roles; student IDs, names, classes, parent mobile numbers; exam answers, answer photos, marks and attempt metadata.
Processor obligations
We process personal data only for the service; keep it confidential; restrict access to authorized personnel; isolate each school's data; and do not use it for our own purposes or disclose it except as instructed or required by law.
Sub-processors
The school authorizes the sub-processors listed on the Security page (currently: cloud hosting and email delivery). We will inform schools of intended additions or replacements and give an opportunity to object.
Security measures
Technical and organizational measures are described on the Security page: TLS in transit, per-school data isolation, passwordless staff authentication, role-based access, CSRF and rate-limit protections.
Breach notification & rights requests
If we become aware of a personal-data breach affecting a school's data we will notify that school without undue delay, with information needed to meet its obligations. We will assist the school in responding to data-subject requests (access, correction, deletion).
Term & deletion
This agreement applies for as long as we process data for the school. On account closure, school data is deleted from active systems and expires from backups on the normal cycle. Need a signed copy for procurement? Contact hello@yougrade.net and we'll provide one.