← Back to Kluppy

Data Processing Agreement (DPA)

2 October 2026

Data Processing Agreement (DPA)

Version 2.3 · October 2026

Article 28 GDPR data processing agreement for the B2B channel (educational centres). Supersedes versions 2.2 and 2.1 of September 2026, version 2.0 of July 2026 and the March 2026 outline. English translation of the Spanish original; in the event of any discrepancy, the Spanish version prevails.

Changes in version 2.3: withdrawing a student's licence once again leaves the account blocked within the Centre and deletes it after 180 days (9.2). The same regime applies to accounts created with no licence available. Version 2.2 described the account becoming a free personal account; that behaviour was withdrawn on 1 October 2026. Only accounts that were already personal before joining the Centre return to their holder. Clause 9.4 now governs the accounts whose licence was withdrawn while the version 2.2 model was in force. Immediate erasure from the panel (9.3) and the data excepted by legal obligation (9.5) are unchanged. In addition, Annex III has been corrected: ElevenLabs voice synthesis runs in the United States, not in the EU, and also receives the text of the dictations written by teaching staff; new clause 10.3 explains it.

In accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), this Data Processing Agreement (the "DPA") governs the processing of personal data that KLUPPY, S.L. (the "Processor") carries out on behalf of the Educational Centre or Institution (the "Controller") for the provision of the Kluppy educational platform service.

This DPA forms an integral part of the Terms and Conditions of the School Plan (B2B) (the "B2B Terms and Conditions") and prevails over them in all matters relating to the protection of personal data.

Identification of the parties

The Processor

The Controller (the "Centre", referred to in the B2B Terms and Conditions as "the School")

1. Subject matter, nature, purpose and duration of the processing

1.1. Subject matter. The Controller engages Kluppy to process such personal data of its students and teaching staff as is necessary for the provision of the Kluppy typing learning platform.

1.2. Nature and purpose. The processing consists of hosting, storage and computation, the generation of exercises, performance measurement (WPM, accuracy, levels), the presentation of educational and gamification metrics and, where the Controller activates it, the issuing of evidence reports that arrange those measurements by period in order to support the assessment of the keyboard-writing block (clause 12), solely and exclusively for the provision of the contracted service. Kluppy shall not process the data for its own purposes (marketing, profiling with legal effects, or the training of AI models).

1.3. Duration. The processing carried out on the Controller's behalf has the same duration as the licence/service contract between the parties. Upon its termination, the provisions of clause 9 (return or deletion) shall apply.

2. Documented instructions

2.1. Kluppy shall process the personal data only on documented instructions from the Controller, including with regard to international transfers, unless required to do so by law, in which case it shall inform the Controller beforehand unless that law prohibits such information.

2.2. The service contract, its terms and this DPA constitute the Controller's initial instructions. Kluppy shall inform the Controller if, in its opinion, an instruction infringes data protection law.

3. Confidentiality

Kluppy shall ensure that the persons authorised to process the personal data have expressly committed themselves in writing to confidentiality, or are under an appropriate statutory obligation of confidentiality, and that they receive the necessary training.

4. Security of processing (Art. 32 GDPR)

Kluppy shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as detailed in Annex II, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of data subjects, with particular regard to the fact that the data concerned is that of minors.

5. Sub-processors (Arts. 28.2 and 28.4 GDPR)

5.1. The Controller authorises the engagement of the sub-processors listed in Annex III.

5.2. Kluppy shall impose on each sub-processor, in writing, the same data protection obligations as those set out in this DPA, in particular by providing sufficient guarantees to implement appropriate technical and organisational measures. Kluppy shall remain fully liable to the Controller for the performance of the sub-processor's obligations.

5.3. Kluppy shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance, giving the Controller the opportunity to object on legitimate data protection grounds.

6. Assistance to the Controller (Arts. 28.3.e and 28.3.f GDPR)

6.1. Data subjects' rights. Kluppy shall assist the Controller, by appropriate technical and organisational measures (including the export and deletion tools available on the platform; for the right to erasure, the tool referred to in clause 9.3), in responding to requests for the exercise of rights (access, rectification, erasure, restriction, portability and objection; Arts. 15-22 GDPR). If a data subject addresses a request to Kluppy, Kluppy shall forward it to the Controller without delay.

6.2. Security, DPIAs and prior consultation. Kluppy shall assist the Controller in complying with its obligations under Arts. 32-36 GDPR (security, personal data breach notification, data protection impact assessments and prior consultation of the supervisory authority), providing the necessary technical information about the platform.

7. Notification of personal data breaches (Art. 33.2 GDPR)

Kluppy shall notify the Controller, without undue delay after having become aware of a personal data breach, providing it with at least the information referred to in Art. 33.3 GDPR: the nature of the breach (the categories and approximate number of data subjects and of personal data records concerned), a contact point from which further information may be obtained, the likely consequences and the measures taken or proposed to be taken. This notification enables the Controller to comply, where applicable, with its own obligation to notify the supervisory authority (72 hours, Art. 33.1) and the data subjects (Art. 34).

8. Audits and inspections (Art. 28.3.h GDPR)

8.1. Kluppy shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 (including audit reports and certifications of the underlying infrastructure).

8.2. Kluppy shall likewise allow for and contribute to audits, including inspections, conducted by the Controller or by another auditor mandated by it, subject to the following reasonable conditions: at least 15 business days' prior notice; a maximum frequency of once a year (save where required by the supervisory authority or in the event of a personal data breach); respect for the confidentiality and security of other customers; and the Controller bearing any costs that do not arise from a breach by Kluppy of its obligations.

9. Return or deletion at the end of the provision of services (Art. 28.3.g GDPR)

9.1. Upon termination of the service and at the Controller's choice, Kluppy shall return or delete all personal data processed on its behalf and delete existing copies, unless retention is required by law. To that end, Kluppy shall make available to the Controller a complete export of the data in a structured format (JSON). Absent an instruction to return or to delete early, Kluppy shall proceed to final deletion 180 days after termination. This period is aligned with the school year, so that a Centre renewing the service in the following year does not lose its students' progress.

9.2. Deactivation of an individual student during the term of this DPA. Where the Controller withdraws a student's licence via the administration panel, the account remains the Centre's: it is blocked and inaccessible to the student, the seat returns to the Centre's quota under the terms of the licence agreement and the data is kept for a maximum of 180 days. Within that period the Controller may reinstate the student by assigning a licence again, without loss of progress, or instruct erasure in accordance with clause 9.3. Once the 180 days have elapsed without reinstatement, the data is permanently and automatically deleted. Kluppy does not turn that account into a personal account or process its data for its own purposes. The same regime applies to accounts the Controller creates with no licence available: they are created blocked, inaccessible to the student, until a licence is assigned, and are automatically deleted if 180 days elapse from creation without one being assigned. Exception: where the account already belonged to the data subject before joining the Centre —they hold a paid subscription of their own, or the Centre neither created nor imported the account and they had been using it on their own for more than seven days before joining—, withdrawing the licence returns it to its holder as a personal account, subject to Kluppy's Privacy Policy: the Controller loses access to its data and Kluppy ceases to process it on the Controller's behalf.

9.3. Immediate erasure on the Controller's instruction. The Controller may at any time instruct the permanent erasure of a particular student's data. To that end, and in fulfilment of clause 6.1, Kluppy makes available a deletion tool within the administration panel itself, which an administrator of the Centre executes directly, without Kluppy's intervention and without any waiting period. The erasure is irreversible and covers the access account, the progress, the statistics, the achievements, the files and the data subject's social data. It does not cover: (i) data whose retention is imposed by a legal obligation, in accordance with clause 9.5; nor (ii) the records of the competency assessment module, where the Controller has activated it, which clause 12.7 requires to be kept immutable so that the Controller can evidence what was provided to it. Where the Controller also needs those records erased, it must request this from Kluppy, which shall carry it out without undue delay. Where the account has a life of its own beyond the Centre (a paid subscription belonging to the data subject, registration on the student's own initiative, or continued use of the service after deactivation), the panel tool is disabled and states so: in those cases erasure is requested from Kluppy, which shall carry it out without undue delay after verifying the Controller's standing.

9.4. Accounts whose licence was withdrawn between 2 September and 1 October 2026. During that period, withdrawing the licence turned the account into a free personal account of its holder. The accounts that left the Centre in that way remain personal accounts, subject to Kluppy's Privacy Policy, and the Controller has no access to them. Where the Controller needs them erased, it may request this from Kluppy, which shall carry it out without undue delay after verifying the Controller's standing. Accounts deactivated before 2 September 2026 follow the 180-day cycle of clause 9.2. Accounts the Controller created with no licence available before 2 October 2026 keep the unlicensed access they had; the Controller may assign them a licence or erase them in accordance with clause 9.3.

9.5. Data excepted from erasure. Clauses 9.1 to 9.4 do not cover data whose retention is required by a rule having the force of law, and in particular invoices and invoicing records, which Kluppy retains for the period required by Spanish tax legislation for the sole purpose of complying with that obligation.

10. International transfers (Chapter V GDPR, Arts. 44-49)

10.1. Data is processed and stored within the European Economic Area (EEA). Specifically, the database resides in the European multi-region eur3 (Belgium and the Netherlands), server-side logic runs in europe-southwest1 (Madrid) and europe-west1 (Belgium), and backups are stored in a European multi-region bucket. Details per sub-processor are set out in Annex III.

10.2. Certain sub-processors belong to corporate groups whose parent company is established in the United States (Google, Stripe, Microsoft, Mailjet). Where access to the data from outside the EEA is unavoidable (for example, for technical support), such processing is covered by the appropriate safeguards of Art. 46: standard contractual clauses (SCCs) approved by the European Commission, incorporated into the data processing agreements entered into with each sub-processor and, cumulatively, the EU-US Data Privacy Framework in respect of those providers listed as certified on the official list maintained by the United States Department of Commerce. Kluppy keeps the applicable mechanism for each sub-processor up to date and makes it available to the Controller on request.

10.3. Voice synthesis. To turn tutorial scripts, the application's instructions and the text of the dictations written by teaching staff into audio, Kluppy sends that text to a voice synthesis provider: ElevenLabs, whose servers are in the United States, or Elhuyar Fundazioa (Spain) where the language is Basque. Only the text and the voice identifier are sent, from Kluppy's servers: no user identifiers, no user IP address and no account data of the person who writes it or listens to it. That text contains no personal data, so sending it is not an international transfer of personal data. The panel warns teaching staff, next to the dictation field, that the text leaves for that provider and that it must not include names or personal data; the Controller ensures that its staff comply. If, despite this, a text did include personal data, sending it would be covered by the safeguards of clause 10.2.

11. Transparency regarding the use of Artificial Intelligence (Art. 50 Regulation (EU) 2024/1689)

11.1. Kluppy generates part of the practice texts using a generative AI system (Google Vertex AI, EU eu multi-region). No student personal data is included in the prompts sent to the AI; the system is not used to assess students automatically or to take decisions producing legal effects. The evidence reports under clause 12 do not use AI: they are calculated using deterministic arithmetic rules applied to the recorded measurements.

11.2. Kluppy visibly identifies AI-generated content and provides the Controller with the information it needs to inform students and families in turn, in accordance with the transparency duty of Art. 50 of Regulation (EU) 2024/1689. The AI systems used by Kluppy are classified as limited risk, subject to the transparency obligations of Art. 50 and not falling within the high-risk cases listed in Annex III to that Regulation. This classification is documented in a formal risk classification report, which Kluppy makes available to the Controller on request.

12. Evidence reports supporting assessment (human oversight)

12.1. Subject matter. At the Controller's request, Kluppy issues reports that arrange each student's typing measurements by period (speed, accuracy, level reached, cumulative keystrokes and sessions worked) and place them in achievement bands, for the purpose of providing the Controller's teaching staff with objective evidence.

12.2. Nature of the report. The report is an interpretative proposal, not a grade. By itself it produces no effect on the student: it does not change their level, their access or their progress on the platform, and it is not disclosed to any third party outside the Controller's organisation.

12.3. Method. The bands are obtained by applying deterministic, auditable arithmetic rules to the recorded measurements and to the cut-points agreed with the Controller. No AI systems, no profiling and no inferences about the student's personal characteristics are involved. Kluppy does not process students' age for these purposes.

12.4. No automated decision-making (Art. 22 GDPR). Since the grade is always determined by a person within the Controller's organisation, and that person may change or discard any proposed band, the processing does not constitute a decision based solely on automated processing within the meaning of Art. 22 GDPR. Kluppy shall provide the Controller, upon request, with an explanation of how a particular band was calculated, so that the Controller can respond to requests from data subjects exercising their rights.

12.5. Limits on use. In accordance with the B2B Terms and Conditions, the Controller may not use the reports as the sole or main basis of the student's official assessment. The Controller shall set and document the weight it gives the keyboard-writing block within the subject; the tool requires this as a mandatory parameter and rejects a setting of 100%.

12.6. Classwork signal. For context, the platform infers from the group's own aggregate activity the sessions in which each group worked, and records in how many of those sessions each student worked. It is not an attendance-monitoring mechanism, it is neither presented nor exported as such, and it plays no part in the achievement bands.

12.7. Traceability. The reports issued and the cut-points applied are recorded in an immutable log, so that the Controller can demonstrate, to data subjects and to the supervisory authority, what evidence was provided to it and on what parameters that evidence was based.

13. Enhanced protection of minors (Art. 7 LOPDGDD; LOPIVI)

13.1. The Controller warrants that it has a valid legal basis for the processing of its students' data — generally the exercise of its educational function as a task carried out in the public interest and, where applicable, the consent of the holders of parental authority in the case of children under 14 (Art. 7 LOPDGDD) — and that it has informed the data subjects and their legal guardians.

13.2. Kluppy applies data minimisation measures in the social features (pseudonymisation in leagues and rankings) and does not carry out profiling producing legal effects on minors. Kluppy has content moderation mechanisms and a reporting channel for incidents in place.

13.3. The obligations of LOPIVI (Organic Law 8/2021) concerning child welfare in the educational setting fall to the Centre in respect of its students; Kluppy, as a technology provider, does not qualify as an entity bound by that law in respect of the Centre's students. Kluppy provides the moderation and communication tools described and cooperates with the Centre's child welfare coordinator upon request.

14. Obligations of the Controller

The Controller undertakes to: (a) have a valid legal basis and to have informed the data subjects; (b) enter its use of Kluppy as processor in its Record of Processing Activities (ROPA); (c) issue lawful instructions; (d) handle, as controller, requests from data subjects exercising their rights; and (e) where it activates the evidence reports, inform the data subjects and their legal guardians accordingly, set and document the weight of the block in accordance with clause 12.5, and ensure that the grade is always determined by its teaching staff.

15. Applicable law and signature

This DPA is governed by the GDPR, the LOPDGDD and Spanish law. For the resolution of any disputes arising from it, the parties submit to the Courts and Tribunals of Donostia-San Sebastián.

For the Processor (KLUPPY, S.L.) For the Controller (the Centre)
Name: ____________________________ Name: ____________________________
Position: ________________________ Position: ________________________
Date: ____________________________ Date: ____________________________
Signature: _______________________ Signature: _______________________

ANNEX I — Description of the processing

ANNEX II — Technical and organisational security measures (Art. 32 GDPR)

  1. Pseudonymisation: cryptographic identifiers (UIDs) and pseudonyms in leagues and rankings.
  2. Encryption: in transit using HTTPS/TLS; at rest using infrastructure-managed encryption (AES-256) on Google Cloud.
  3. Access control (RBAC): strong authentication and granular security rules (Firestore Security Rules); the data of each Centre is logically isolated and inaccessible to other Centres.
  4. Resilience and availability: serverless architecture with automatic scaling and daily backups of the database.
  5. Logging and traceability: logging of relevant administration and security events.
  6. Certifications of the underlying infrastructure (Google Cloud): ISO 27001, ISO 27017, ISO 27018 and SOC 2.
  7. Incident management: procedure for the detection and notification of personal data breaches in accordance with clause 7.

ANNEX III — Authorised sub-processors

Sub-processor Service Data Processing location Transfer safeguard
Google Cloud EMEA Limited (Firebase / Cloud) Hosting, database, authentication and backups All EU (eur3: Belgium and the Netherlands; functions in europe-southwest1 and europe-west1) Contract with an EU entity (Ireland). Google's data processing agreement incorporates the European Commission's SCCs for access from outside the EEA
Google Vertex AI AI text generation No personal data (technical parameters only) EU (eu multi-region) Covered by the Google Cloud data processing agreement
Google Workspace / Classroom Directory import (optional, initiated by the Centre) Email and name EU Covered by the Google Cloud data processing agreement
Microsoft Ireland Operations Limited (Azure AD / Entra ID) Authentication and directory import (optional, initiated by the Centre) Email and name Ireland (EU) Contract with an EU entity. Microsoft's data protection terms incorporate the European Commission's SCCs
Stripe Payments Europe, Ltd. Billing gateway (the Centre's payer data, not student data) Email and payment data Ireland (EU) Contract with an EU entity. Stripe's data processing agreement incorporates the European Commission's SCCs
Holded Invoicing Email, name and tax ID (payers only) Spain Processing within the EU
Mailjet Transactional email Recipient's email address EU Processing within the EU
ElevenLabs Voice synthesis of tutorial scripts, the application's instructions and the dictations written by teaching staff (all languages except Basque) No personal data (only the text turned into audio and the voice identifier; no user identifiers or user IP address) United States No transfer of personal data (clause 10.3). If the text did contain any, SCCs incorporated into the ElevenLabs data processing agreement
Elhuyar Fundazioa Voice synthesis in Basque (tutorials, instructions and dictations) No personal data (only the text turned into audio) Spain (Basque Country) Processing within the EU

To arrange for this document to be formally signed, or with any queries, contact: info@kluppy.com