Data Processing Agreement

1. Roles

The school or educator is the controller. ExcelUp Lab is the processor and processes personal data only on the controller’s documented instructions, which are the terms of this agreement and the use of the product.

2. Subject matter and duration

Processing lasts for the term of the account. On termination or on request, stored content is deleted or returned, subject to limited legally required records.

3. Nature and purpose

• Hosting uploaded activity sheets and extracted instructional content.
• Generating scaffolded versions and supporting resources with an enterprise AI gateway.
• Producing exports and maintaining account, usage, and audit records.

4. Categories of data and data subjects

Data subjects are educators and administrators holding accounts. Data is limited to account identifiers, profile preferences (including instructional framework, target reading level, and selected accommodation supports), and instructional content. ScaffoldED360 is designed so that no student personal data is uploaded, and the product warns users before upload when likely student identifiers are detected. Special-category data must not be uploaded.

5. Security measures

• Encryption in transit (TLS) and at rest.
• Row-level security so each record is reachable only by the account that created it.
• Private storage buckets served through short-lived signed links.
• Server-side authentication and role checks for all administrative functions.
• An administrative audit log of privileged actions.
• Least-privilege internal access and periodic dependency and security scanning.

6. Subprocessors

We use subprocessors for cloud application hosting and edge delivery, managed database, authentication and private file storage, and an enterprise AI gateway for content generation. AI subprocessors do not train models on customer content. We will give notice of new subprocessors and allow reasonable objection.

7. International transfers

Where personal data leaves the EEA, the transfer relies on the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, supported by the technical measures above.

8. Assistance to the controller

• Support with data subject requests, including access, correction, and erasure.
• Breach notification to the controller without undue delay after becoming aware.
• Reasonable assistance with data protection impact assessments and supervisory authority queries.
• Information necessary to demonstrate compliance, and cooperation with audits.

9. Deletion and return

Controllers can delete individual activities, versions, and profiles at any time, and can delete the account from settings, which purges stored files and records.

10. AI transparency

Generated materials are drafts produced by AI and are labelled as such in the product and on every exported document. In line with EU AI Act Article 50 transparency duties, each DOCX and PDF export carries the notice: “AI-assisted draft generated by ScaffoldED360. Portions of this document were produced by an AI model and reviewed by the educator before use.” The change report also records how many AI-drafted blocks the educator accepted, rejected, or left undecided.

Educator review is required before classroom use. ScaffoldED360 does not grade students, score assessments, or make placement or access decisions, so it is not a high-risk education system under the EU AI Act.

Request a signed copy

Email privacy@exceluplab.com with your institution name and we will send a countersignable DPA including the Standard Contractual Clauses.