Data Processing Agreement

This agreement applies between JG Tromp, trading as CandleDraw (“we”, the processor) and you, when you use CandleDraw to teach: when you create a cohort, add or invite a student, set an assignment, or review a submission. For the personal data those activities generate you are the controller, and we process it on your instructions.

It takes effect automatically and needs no signature. You accepted it with the Terms, which it supplements and forms part of; where the two conflict on the processing of your cohort’s data, this agreement wins. It is the contract art. 28(3) of the UK and EU General Data Protection Regulation requires a controller to have with its processor.

It does not cover your own account. Your name, email, subscription and your own drawings are data we hold as controller in our own right, and the Privacy Policy governs those. The line falls where your students’ data begins.

Subject matter

Providing the CandleDraw teaching features to you: cohorts, curriculum, assignments, submissions and review.

Duration

For as long as you have an account with teaching features in use, and then for the periods in How long we keep things.

Nature and purpose

Storing, organising, displaying and deleting the material a course generates, so that you can set work and your students can return it. We do not analyse it, profile anyone with it, or use it to train machine-learning models.

Types of personal data

Account identifiers and email addresses, display names, cohort membership, curriculum and assignment content you author, submitted work, and the feedback and approvals you record against it.

Categories of data subject

Your students, and anyone who signs up through your referral link.

No special category data is asked for or expected. CandleDraw has no field for health, biometric, political or similar data. If you put such data into free text, an assignment title or a drawing, you do so as controller and on your own assessment of the extra conditions art. 9 imposes.

We process your cohort’s personal data only on your documented instructions, including on transfers out of the European Economic Area.

Your instructions are the actions you take in the product. Releasing a curriculum section to a cohort, adding a student, setting an assignment, approving or returning a submission: each is an instruction, and the product carries it out and does nothing else with the data. This agreement, the Terms and the Privacy Policy are the rest of them. Anything further you want to instruct, email support@candledraw.com.

Where a provider we use is outside the European Economic Area, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision, as Who else touches your data sets out.

We will tell you if an instruction looks unlawful. If we think something you ask for breaches data protection law, we will say so before acting, as art. 28(3) requires. We may also refuse an instruction that would require us to break the law.

We will not process your cohort’s data for any purpose of our own. One exception, and it is narrow: we may use aggregated, anonymised statistics that cannot identify anyone to run and improve the service.

Everyone we authorise to process your cohort’s data is bound to keep it confidential, by contract or by professional obligation, and that obligation survives their work with us ending.

Access is limited to the people who need it to run or support the service. In practice CandleDraw is operated by one person; where that changes, this clause is what binds whoever is added.

We take the technical and organisational measures art. 32 requires, appropriate to the risk. They are described in Security rather than repeated here, so there is one account of them to keep accurate.

The measure worth naming in a teaching contract is the one that enforces your cohort boundaries: access is checked in the database, by row-level security, rather than by the interface choosing what to ask for. A student who is not in your cohort cannot read its work even with a modified client, and an educator cannot read another educator’s.

You give a general authorisation for us to engage the sub-processors listed in Who else touches your data. That list is the current one, kept there rather than duplicated here so it cannot drift.

We impose the same data protection obligations on each of them that this agreement imposes on us, and we remain fully liable to you for what they do with your cohort’s data.

Before we add or replace one, we will update that list and tell account holders in advance, as a material change under the Terms. If you object on reasonable data protection grounds, tell us within the notice period; if we cannot resolve it, you may cancel and we will refund the unused part of your period.

Requests from your students. If a student asks us directly to access, correct, export or erase work that belongs to your course, we will not answer for you: we will tell them to ask you, and tell you it happened. We will help you answer, and the product does most of it already, since a submission is visible and exportable from the hub.

Breaches. If we become aware of a personal data breach affecting your cohort’s data we will tell you without undue delay, with what we know: what happened, who is affected, the likely consequences, and what we are doing. Your 72-hour clock under art. 33 starts when you become aware, so we do not sit on it.

Assessments. We will give you reasonable help with a data protection impact assessment or a prior consultation with a regulator under arts 35 and 36, to the extent it concerns our processing and you cannot answer it from these documents.

When you stop using the teaching features, or your account closes, we delete your cohort’s personal data or return it to you, at your choice, and delete any copies unless the law requires us to keep them. The periods and the mechanics are in Deleting your account.

Export first. Return is your export: charts, assignments and submissions come out of the product in formats you can keep, and it is faster than asking us. If you close an educator account, tell your students beforehand, because their membership of your cohorts and their submissions to your assignments do not survive it, as the Terms say.

We will make available the information you reasonably need to show that we meet art. 28, and answer questions about our processing, in writing, within a reasonable time. Most of what an assessment asks for is on this page and in the Privacy Policy, which are written to be read by someone doing exactly that.

We will contribute to an audit or inspection you carry out, or an auditor you appoint. Two limits, both proportionate rather than an attempt to avoid the obligation: no more than once in a twelve-month period unless a regulator or a breach makes another necessary, and on reasonable notice, so that it does not disturb other customers’ data or the service.

Data protection questions and requests

privacy@candledraw.com

Anything else about this agreement

support@candledraw.com

If you need this agreement signed, or your institution has its own form to put alongside it, email privacy@candledraw.com and say so.