Data Processing Agreement (DPA)

Template for signature. Fields in [brackets] are completed by the institution on signing. Not legal advice.

This Data Processing Agreement (the "Agreement") is entered into between [institution name], reg. no. [reg. no.] (the "Controller") and Lukas Thrane (sole proprietorship), reg. no. 936 043 925, Vegamot 1N, 7049 Trondheim, Norway (the "Processor", "Graidable"). It governs the Processor's processing of personal data on behalf of the Controller in connection with use of Graidable, under GDPR Art. 28.

The Agreement is signed by the Controller below. A teacher also accepts it in the app when creating an account, on behalf of the institution whose students' work they upload, and confirms in the Terms that they are authorised to do so.

1. Purpose and scope

The Processor processes personal data only to deliver the Graidable service (reading students' work, sorting it to students, and AI-assisted draft assessment and feedback that the teacher reviews and approves) and only on the Controller's documented instructions as set out in this Agreement and the main agreement/terms. The Processor shall not process the data for its own purposes.

2. Duration

The Agreement applies for as long as the Processor processes personal data on the Controller's behalf, and ends when processing ceases and the data is deleted/returned (clause 9).

3. Nature of processing, categories and data subjects

The nature and purpose of processing, the categories of personal data and the data subjects are set out in Annex A. What each sub-processor receives is set out in Annex B.

4. Processor obligations

The Processor shall:

• process personal data only on documented instructions, and notify if an instruction is considered to infringe data protection law;
• ensure persons with access are bound by confidentiality;
• implement appropriate technical and organisational measures under GDPR Art. 32 (see Annex B);
• assist the Controller in fulfilling obligations regarding data-subject rights, security, data protection impact assessments (Art. 35) and prior consultation (Art. 36);
• not use customer or student content to train AI models, and send AI requests only to providers that, under the routing set out in Annex B, neither store nor train on them.

5. Personal data breach

The Processor shall notify the Controller without undue delay after becoming aware of a breach, and assist with the information needed for the Controller to meet its obligations under Art. 33–34.

6. Sub-processors

The Controller gives general prior authorisation for the sub-processors in Annex A. The Processor shall impose obligations equivalent to this Agreement on sub-processors, and notify the Controller of intended changes (new or replacement sub-processors) with reasonable notice so the Controller can object.

7. International transfers

Storage, the database, email and reading (OCR) are configured within the EU/EEA, and so are the AI models for finding questions, criteria and grading. Two processors work outside the EEA: OpenRouter (USA), through which every AI request passes, and TypeSafe (USA), whose model Jev sorts the work to students and so receives students' names and the text of their work (Annex B). For these transfers a valid transfer mechanism shall apply, normally the EU Standard Contractual Clauses (SCC) with necessary supplementary measures.

8. Audit

The Processor shall make available the information necessary to demonstrate compliance with Art. 28, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by it.

9. Return and deletion

On termination of the service, the Processor shall, at the Controller's choice, delete or return all personal data and delete existing copies, unless retention is legally required. Deletion is performed without undue delay on request.

10. Liability and governing law

The Agreement is governed by Norwegian law, with venue Trøndelag District Court (Trondheim). Each party is liable under data protection law and the main agreement. Data subjects may complain to the Norwegian Data Protection Authority (Datatilsynet).

---

Annex A – Processing overview and sub-processors

Purpose: reading students' work, sorting it to students, and AI-assisted draft assessment and feedback that the teacher reviews and approves. Data subjects: students; teachers and teaching assistants. Categories: identifiers (name, and where the teacher adds them: email, student number, candidate label); students' work (the uploaded files, images of their pages and the text read from them, which may contain special-category data in free text); assessment data (points, draft and approved results, feedback); account and log data. Retention: data is kept while the class or account exists, with no automatic end date. Deleted classes and assignments are erased after 30 days in "Recently deleted"; a deleted account is erased at once.

AI models: the Processor chooses the models and their endpoints; there is no per-account policy to select. The Processor calls TypeSafe, Microsoft and Google only through OpenRouter and has no direct contract with them. The Processor's code also lists Gemini 3.8 Flash on Google's global endpoint (outside the EU) as a grading model; it is used only in the Processor's own test runs, never on the Controller's data, and will not be used on it without prior notice under clause 6.

Annex B – Technical and organisational measures (Art. 32)

Security: encryption in transit (TLS); files in storage encrypted at rest; access control and role-based access; logging; EU/EEA-based hosting; breach-handling procedures and notification within the Art. 33 deadlines.

AI routing, fixed in code for every AI request: only the endpoints listed in Annex A, with no fallback to another provider; only endpoints OpenRouter lists as zero data retention; only providers that, under OpenRouter's data policies, do not store or train on requests; a request with any other routing is refused before it is sent; the content of AI requests and replies is not logged. These settings bind the model providers; what OpenRouter itself keeps is governed by its terms with the Processor.

Data minimisation: what each sub-processor receives

Students' names are therefore sent to TypeSafe in the USA, and handwritten names can appear in page images sent for grading. Where feasible, the Controller may reduce this by using candidate labels or numbers in place of names on the class list and on the work.

---

Signature