Data Processing Agreement

Subject matter: the records the School keeps in Telpen Edu to run itself: learners, parents and guardians, staff, classes, assessment, attendance, fees, messages, learning materials and online classes.

Duration: from the day the School creates its account until its records are returned or deleted under clause 10.

Purpose: providing the Telpen Edu service to the School and nothing else.

• Learners (many of them children): name, learner ID, date of birth, class, results and report comments, attendance, fee ledger, residence and next of kin, and, only with recorded consent, learning-support, disability and health notes.
• Parents and guardians: name, phone numbers, email, occupation, residence, next of kin, payment references, messages with the School.
• Staff: name, phone, role, responsibilities, registration numbers, certificates, disciplinary records.
• Special categories: health, disability and learning-support information; religious-education option where the School records it.

Telpen processes School records only on the School's documented instructions. These are: the Terms of Service, this agreement, the settings the School chooses in the app, and the actions its authorised users take. If Telpen believes an instruction breaks the law it will say so before acting. Telpen never uses School records for its own purposes, for advertising, or to train AI models.

Only named Telpen staff who need access to keep the service running may see School records, and each of them is bound by a written confidentiality duty. Access to production data is logged.

• HTTPS for every connection; encryption at rest at the database and file providers.
• Every database query is scoped to one School; four automated tenancy tests run on every change.
• Role-based access the School controls; learning-support and disciplinary records limited to named roles.
• Append-only audit log of sensitive actions; every full view of a learning-support profile is logged.
• Backups kept by the database provider in the same region; no secrets in the code base; automated checks on every release.
• Payments start only from a person at the School; Telpen never stores card numbers or M-Pesa PINs.

The School authorises these sub-processors:

• Fly.io — application servers (Frankfurt, Germany).
• Neon — main PostgreSQL database (Frankfurt, Germany).
• Supabase — sign-in and sessions (EU).
• UploadThing — uploaded files (USA / EU).
• Paddle.com — card payments as Merchant of Record (school billing data only) (UK / EU).
• Africa's Talking — M-Pesa fee collection; text messages only where a school turned them on (Kenya).
• Anthropic — translation and draft report comments, human-reviewed, pseudonymised where possible (USA).

Telpen binds each sub-processor to data-protection terms no weaker than this agreement and stays responsible for their work. Telpen will email the School's administrator at least 30 days before adding or replacing a sub-processor; a School that objects on reasonable data-protection grounds may end its subscription and export its records before the change takes effect, with a refund of any unused period.

School records are stored in Frankfurt, Germany, with the sub-processors in the countries listed above. A serving copy of Kenyan Schools' records hosted in Kenya is being put in place under regulation 26 of the Kenya Data Protection (General) Regulations, 2021.

• Kenyan Schools: transfers outside Kenya rest on the Office of the Data Protection Commissioner's standard contractual clauses, which form part of this agreement, and on the safeguards in clause 5.
• Nigerian Schools: transfers rest on the School's consent given by accepting this agreement and on the Nigeria Data Protection Commission's contract and adequacy rules.
• Other countries: the School's written instruction in this agreement, contractual clauses with each sub-processor and the safeguards in clause 5. Where a country requires a local copy or an approval, Telpen puts it in place before serving Schools there.

Telpen tells the School's administrator within 24 hours of becoming aware of a breach that affects the School's records: what happened, which records and people are likely affected, what Telpen has done, and what the School may need to do. Telpen then helps the School notify its regulator and the people affected within the time its law sets, and keeps a record of every breach.

Telpen helps the School answer requests from learners, parents and staff to see, correct, delete, restrict or receive their information, through the app's own tools first and by hand where needed, within five working days of the School asking. Telpen also provides the information the School needs for a data protection impact assessment or a consultation with its regulator.

When the School ends its subscription, its records become read-only for a grace period so it can export them. On the School's written request, or 90 days after the account is closed, Telpen returns the records in a portable form if asked and then deletes them, including from backups as they expire, keeping only what the law requires (for example payment records) and confirming deletion in writing.

Telpen gives the School the information it reasonably needs to show that this agreement is kept: this document, the security measures, sub-processor terms and audit-log extracts for its own records. Once a year, or after a breach, the School or an independent auditor it appoints may audit Telpen's processing of the School's records on 30 days' notice, during working hours, without disturbing other schools' data.

The School warrants that it has a lawful basis for each learner's records and that, for learners under the age of consent in its country, it has obtained and recorded a parent's or guardian's consent where its law requires one, including specific consent before any learning-support, disability or health note is entered. Telpen never uses learners' or parents' data for marketing, never profiles children, and never lets a child create an account without the School.

The limits of liability in the Terms of Service apply to this agreement. It is governed by the laws of Kenya, and the courts of Kenya have jurisdiction, without taking away a School's right to complain to its own regulator. Telpen may update this agreement to reflect new law or new sub-processors; the School is told by email at least 30 days before a material change.