Data processing agreement
Courtesy translation. In case of any discrepancy, the Spanish version prevails.
1. Parties and purpose
This agreement is part of NowLesson’s terms and every teacher accepts it when signing up. The teacher is the controller of their own students’ data managed on NowLesson, and NowLesson (Luis Emilio Liriano Aróstegui, tax ID 60038864D) processes it as processor, only to provide the service: schedule, lessons, classroom, messages, payments and notifications.
2. Data and data subjects
Data of the teacher’s students (and, for minors, their parents or guardians): name, email, time zone and language, lessons, notes and homework, whiteboards and notebooks, messages, balance and payments, and attendance and talk time in the classroom. NowLesson doesn’t process special categories of data, unless the teacher writes them in notes or messages on their own initiative, which they should avoid.
3. Duration and end of processing
For as long as the teacher has an account. When they leave, NowLesson deletes or anonymizes that data as explained in the privacy policy, except what it must keep by law (for example, payment history without personal data). Before that, the teacher can export their data from Settings.
4. Instructions
NowLesson processes the data only on the teacher’s instructions, which are the ones given by using the service. It doesn’t use it for its own purposes, advertising or commercial profiling, or with artificial intelligence. If an instruction seems unlawful, it will say so.
5. Confidentiality and security
Only the NowLesson staff who need it can access the data, under a duty of confidentiality. Security measures are those of the privacy policy: encrypted connections, access limited to each account through database rules, two-step verification for staff, encrypted backups and a log of staff actions.
6. Sub-processors
The teacher authorizes NowLesson to use the providers listed in the privacy policy (Supabase, OVHcloud, Resend, Cloudflare and, if used, Stripe and Google). NowLesson will give 15 days’ notice of any new provider that processes this data; if the teacher objects, they can close their account.
7. International transfers
Data is stored in the European Union. If a provider processes it outside, it does so with GDPR safeguards (EU-US Data Privacy Framework or standard contractual clauses), as explained in the privacy policy.
8. Students’ rights and cooperation
If a student asks NowLesson to exercise their rights over data managed by the teacher, NowLesson will pass it on and help the teacher respond (for example, by exporting or deleting data). It will also help, as far as it depends on NowLesson, with security, impact assessments and consultations with the data protection authority.
9. Security breaches
If NowLesson detects a breach affecting this data, it will inform the teacher without undue delay and, where possible, within 48 hours, with the information available so they can notify it if required.
10. Information and audits
NowLesson will give the teacher the information needed to show it complies with this agreement and will allow reasonable audits, with prior notice and at the cost of whoever requests them. Contact: soporte@nowlesson.com.