1. Parties and subject matter
This Agreement is entered into between the Customer (the school, as controller) and [entity name], tax number [tax number], registered at [registered address] (the Provider, as processor), and forms part of the Terms of Service. On data protection matters it prevails over them.
It governs the processing of personal data that the Provider carries out on the Customer's behalf when providing SingDesk.
2. Duration
This Agreement applies while the Terms of Service are in force and, after they end, until the Customer's personal data has been deleted as set out in section 12.
3. Nature and purpose of the processing
Hosting, storage, organisation, consultation, communication and deletion of data, solely to provide the platform the Customer uses to run its school: scheduling and attendance, student and guardian records, teaching records and materials, payments and credits, communications by email and notifications, the student portal, the school's public page and registration forms, and the integrations the Customer chooses to connect.
4. Categories of data subjects and of data
Data subjects:
- students, who may include children;
- guardians and other people responsible for students;
- teachers, office staff and other users of the Customer;
- contacts and prospective students who write to the school or fill in its forms;
- accompanists and other people the Customer records in connection with lessons and events.
Categories of data:
- identification and contact data (name, email, telephone, address, date of birth and tax number when the Customer records them);
- relationships between students and guardians, and portal account data;
- lessons, timetables, attendance, availability and enrolments;
- payments, invoices, rates, credits and teacher remuneration;
- teaching records: notes, journals, repertoire, vocal profile, practice plans, progress reports, materials and audio and video recordings;
- communications sent through the platform;
- access and audit records of the school's accounts.
The platform is not designed for special categories of data (article 9 GDPR). If the Customer nevertheless records any — for example, information on a student's health relevant to voice work — it does so under its own responsibility and with a lawful basis for it.
5. The Customer's obligations
The Customer ensures that it has a lawful basis for each processing operation, informs the data subjects, obtains consent where it is the basis — from those with parental responsibility for children under 13 — and that the data it enters is accurate and limited to what is needed.
The Customer's documented instructions are these Terms, this Agreement and the settings and actions the Customer makes on the platform.
6. The Provider's obligations
- process the data only on the Customer's documented instructions, including with regard to transfers to third countries, unless required to do otherwise by law, in which case it informs the Customer first unless the law forbids it;
- inform the Customer immediately if, in its opinion, an instruction infringes data protection law;
- ensure that the people authorised to process the data are bound by confidentiality;
- apply the security measures described in section 8;
- comply with the conditions of section 9 for engaging other processors;
- assist the Customer in responding to requests from data subjects (section 10) and in complying with its obligations on security, breach notification, impact assessments and prior consultation (articles 32 to 36 GDPR), taking into account the nature of the processing and the information available to it;
- delete the data at the end of the service, as set out in section 12;
- make available to the Customer the information needed to demonstrate compliance with this Agreement and allow audits (section 13).
The Provider does not use the Customer's data for any purpose of its own, does not sell it and does not use it to train models or for marketing.
7. Location
The data is stored on the Provider's own server, in Portugal. Encrypted copies of the backups are kept by a storage provider, and traffic passes through a proxy server in the European Union, as listed on the subprocessors page.
8. Technical and organisational measures
- Encryption in transit: every address of the platform is served over HTTPS only; the connection between the proxy server and the platform's server goes through an encrypted tunnel (WireGuard); email is handed to the sending service over an encrypted connection.
- Credentials and secrets: passwords are stored only as Argon2id hashes; recovery codes likewise; two-step verification secrets and the tokens of connected services (Google, Zoom) are encrypted with AES-256-GCM.
- Authentication: two-step verification (TOTP) available to every staff account and mandatory for the Provider's operators; repeated sign-in attempts are throttled and locked out according to the school's settings; sessions are kept in cookies that scripts cannot read, sent only over HTTPS and only to the host where the session was opened, and they expire after inactivity.
- Access control: roles (owner, office, teacher) limit what each User sees and does; a teacher sees only the students assigned to them; a portal account sees only the students it has been given access to.
- Tenant isolation: every record belongs to exactly one school, and every read and write is limited on the server to the school of the session making it; private files are served only after the same check, never from a public address.
- Operator access: the Provider's operators enter a school only through a support session that the owner authorises for a limited period, lasting at most one hour each, shown on screen and recorded in the school's audit log.
- Audit log: sign-ins, changes to accounts and records, exports, closure requests and support access are recorded per school and visible to the owner.
- Backups: the database is copied every night and the files likewise; on the server they are kept for 7 days, 4 weeks and 6 months; copies leave the server only encrypted (restic, AES-256) and are kept for up to 12 months.
- Network: the platform's server is not directly reachable from the internet; traffic arrives only through the proxy server, which applies rate limits and blocks known malicious addresses. Pages carry a strict content security policy and cannot be embedded by other sites.
- Errors and logs: unexpected errors are recorded by the platform itself, without request contents, cookies or addresses, and with personal identifiers removed from messages; no third-party error or analytics service is used.
- Maintenance: dependencies are kept up to date by automated update proposals and checked daily against published vulnerabilities.
9. Other processors
The Customer gives the Provider general authorisation to engage the other processors listed on the subprocessors page. The Provider informs the Customer of any intended addition or replacement at least 30 days in advance, by email to the owner and on that page. The Customer may object on reasonable data-protection grounds; if no solution is found, it may close the school, after exporting its data, before the change takes effect.
The Provider imposes on each other processor, by contract, data protection obligations equivalent to those of this Agreement, and remains liable to the Customer for their performance.
Services the Customer itself chooses to connect to its school (such as Google Calendar or Zoom) act under the Customer's own account and its own agreement with those providers; the platform sends them only what the integration needs.
Personal data is transferred outside the European Economic Area only with the safeguards of chapter V of the GDPR (an adequacy decision or the standard contractual clauses).
10. Requests from data subjects
The platform gives the Customer the means to answer requests on its own: consult and correct any record, export a student's data, anonymise a student, end portal accounts and export the whole school. If the Provider receives a request directly, it forwards it to the Customer without undue delay and does not answer it itself except on the Customer's instructions.
11. Personal data breaches
The Provider notifies the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, so that the Customer can meet its own deadline of 72 hours. The notification describes, as far as is known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed, and names a contact; what is not yet known is provided as soon as it is.
12. Return and deletion at the end
Before closing the school, the Customer can download a complete export with every record (JSON and CSV) and every file; it remains available for 72 hours after it is ready and can be requested again.
After closure, the data is kept for 30 days so that the school can be reopened if the Customer so wishes, and is then permanently deleted, including files. All that remains is a record without personal data: the school's internal identifier and address on the platform, the dates and the number of records and files deleted.
Copies in backups disappear as they rotate, at the latest about 18 months after deletion; until then they are kept encrypted and are used only to recover from an incident, after which deleted schools are deleted again. On request, the Provider confirms the deletion in writing.
13. Information and audits
The Provider answers the Customer's reasonable questions about compliance with this Agreement and provides the relevant documentation. Where that is not enough, the Customer, or an independent auditor it appoints and who is bound by confidentiality, may audit the processing, with at least 30 days' notice, no more than once a year (except after a breach or at the request of a supervisory authority), at the Customer's expense and without disrupting the service or giving access to other schools' data.
14. Liability and governing law
Each party is liable under article 82 of the GDPR and, otherwise, under the Terms of Service. This Agreement is governed by Portuguese law.
This Agreement is written in Portuguese; this English version is a translation, and the Portuguese version prevails in case of difference.
This is a translation; the Portuguese version prevails.