Data Processing Agreement

Samio Learning is an adaptive learning platform for primary education, focused on language acquisition. We process data solely to provide the service: - Student data — First name, age, and language preference. Students do NOT have personal login credentials; they access the platform via class codes. Exercise results (scores, time spent, attempts) are recorded to track progress. - Teacher/admin data — Email address, name, and role for dashboard authentication. - Session data — App-generated device identifiers and device type for session management. - Audit logs — User actions, timestamps, and IP addresses for security (retained 12 months). Optionally, schools can enable Edu-V/SIS synchronization, Entree Federation SSO, Google Classroom, or LTI integrations, which process additional identifiers as needed. Samio Learning does not process data for marketing, profiling, or purposes unrelated to the service.

Samio is specifically designed for children aged 4–12. Our privacy-by-design approach means: - Students do not have personal accounts — no email, no password, no BSN. - Access is via class codes combined with a name list managed by the teacher. - Only first name and age are stored for students; no home addresses or dates of birth. - Device approval can be required before a student can start exercises. - Data minimization is applied throughout: we collect only what is necessary.

- Student and exercise data — Duration of the service + 30 days after termination. - Teacher accounts — Duration of the service + 30 days. - Audit logs — 12 months, automatically deleted. - Session tokens — Expire automatically (max 30 days), removed via database TTL. - Backups — Maximum 30 days after source data deletion. After termination, all personal data is automatically hard-deleted via a daily GDPR cleanup process. Samio Learning confirms deletion in writing upon request.

Samio Learning uses the following sub-processors: - MongoDB, Inc. (MongoDB Atlas) — Database hosting (EU region available) — EU SCCs - Redis Ltd. — Rate limiting and caching (no PII in persistent storage) - Mailjet SAS (Sinch) — Transactional email (EU, France) — GDPR compliant - PayPal (Europe) S.à r.l. — Payment processing (EU, Luxembourg) — GDPR compliant - Google LLC (reCAPTCHA) — Bot protection — EU-US Data Privacy Framework - Google LLC (OAuth/Classroom) — Optional SSO and classroom sync — EU-US DPF - Microsoft Corp. (Azure AD) — Optional SSO — EU-US DPF, EU datacenter - Kennisnet (Entree Federatie) — Optional SSO (Netherlands) - DeepSeek — AI exercise generation (no personal data; data minimization applied) - Backblaze, Inc. (B2) — Audio file storage (no personal data) All sub-processors handling personal data are bound by equivalent data processing agreements. Schools are notified in advance of any sub-processor changes.

- Encryption in transit — HTTPS/TLS 1.2+ required, HSTS enabled. - Encryption at rest — MongoDB Atlas AES-256 encryption, AES-256-CBC for sensitive fields. - Authentication — bcrypt (12 rounds) password hashing, JWT with short-lived access tokens (1h) and rotating refresh tokens (7d). - Access control — Role-based (owner, admin, teacher) with scope-based API authorization. - Rate limiting — Redis-backed: 500 req/15min global, 30 req/15min on auth routes. - Security headers — Helmet.js: CSP, HSTS, X-Frame-Options deny, noSniff, XSS filter. - Input validation — Joi schemas with parameterized database queries. - Incident response — 24-hour notification to the school, cooperation with AP reporting within 72 hours.

Schools (as Controllers) can exercise the following rights on behalf of their data subjects: - Access, rectification, and deletion — Available via the school admin dashboard. - Full school data deletion — With a 30-day confirmation period. - Data export — Machine-readable format available on request. All requests are completed within 30 days. Contact: info@samiolearning.com.

Geekcow Creative Studio (trading as Samio Learning) Papaverweg 34 1032 KJ Amsterdam, Netherlands KvK: 73006637 Privacy contact: omolina@geekcowsd.com General: info@samiolearning.com