Data processing
Review draft, not an executed DPA.
Vindica has prepared a discussion draft for a limited school pilot. It is not signed, has not been presented as legal advice, and does not authorize transfer of identifiable student data.
No production authority: a public draft, email, demo, or technical integration does not establish school authority. Identifiable student data remains out of scope until both parties sign the final agreement and its data schedule.
Items the final agreement must fix
- School and Vindica roles, documented educational purpose, program dates, and authorized users.
- Exact data fields, student groups, sources, prohibited fields, and whether minors participate.
- Consumer-versus-school record separation and rules for cross-product use.
- AI providers, model features, paid/commercial tier verification, and human-review restrictions.
- Subprocessors, international access and transfers, including primary hosting in Singapore and authorized operational access from South Korea.
- Security measures, incident contacts, notification timing, audit evidence, and remediation.
- Access, correction, export, return, deletion, backup expiry, legal holds, and end-of-program certification.
- Applicable law, parent or student notices/consents, allocation of responsibility, liability, and signatures.
Technical schedule proposed for the first pilot
The smallest acceptable first pilot uses pseudonymous adult testers, one program, one integration, no audio or email/classroom connection, no consumer-history sharing, no AI processing unless separately approved, and a tested deletion at program end. Moving beyond that scope requires a new review.
Request the internal draft
Schools evaluating a pilot may request the controlled review draft and capability evidence from kevinchoi@vindicaseneca.com. The final language should be reviewed by counsel for both parties.