Data Processing Agreement

Version July 14, 2026

This Data Processing Agreement (“DPA”) is offered to institutions that adopt the Impuls Deutsch Vocabulary Trainer (the “Service”). It supplements the Terms of Service and Privacy Policy. Institutions may also submit their own data-protection addendum for our review. Both parties should review this agreement before signing.

1. Parties

This DPA is entered into between Niko Tracksdorf (“Operator”) and the institution identified in the signature block (“Institution”).

2. Definitions

• Education Records / Student Data: personally identifiable information about a student provided to, or generated within, the Service, as protected by FERPA and applicable state law.
• School Official:the Operator’s role under 34 CFR § 99.31(a)(1) when processing Student Data for the Institution.
• Subprocessor: a third party engaged by the Operator to process Student Data to provide the Service.

3. Roles and ownership

The Institution owns and controls the Student Data. The Operator processes Student Data solely as a School Official and service provider on the Institution’s behalf and under its direction, only to provide the Service.

4. Permitted use; no secondary use

The Operator will use Student Data only to provide, secure, and support the Service. The Operator will not sell Student Data; use it for advertising or commercial profiling; disclose it except as permitted here; or use Student Data to train artificial-intelligence or machine-learning models.

5. Confidentiality

The Operator will keep Student Data confidential and limit access to personnel and Subprocessors who need it to provide the Service and are bound by confidentiality obligations.

6. Security

The Operator will maintain reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of Student Data, including encryption in transit and at rest, access controls, and salted password hashing.

7. Subprocessors

The Operator may engage the Subprocessors listed in the Privacy Policy (currently Neon for database hosting and Google Cloud for hosting, storage, and speech services), each bound by data-protection terms consistent with this DPA. The Operator will provide reasonable notice of new Subprocessors that process Student Data.

8. FERPA and children’s privacy

The Operator will handle Student Data consistent with FERPA’s school-official exception. Where the Institution enrolls students under 13, the Institution provides school consent under COPPA for a school-directed educational purpose, and the Operator will use such data only to provide the Service.

9. Data return and deletion

Upon the Institution’s written request, or upon termination, the Operator will return and/or securely delete the Institution’s Student Data within a reasonable period (target: 30 days), except for limited copies retained as required by law or in routine backups that are deleted on a rolling basis.

10. Data-subject and parental requests

The Operator will reasonably assist the Institution in responding to requests to access, correct, or delete Student Data, and will refer any such requests it receives directly to the Institution.

11. Breach notification

The Operator will notify the Institution without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the unauthorized access, disclosure, or loss of the Institution’s Student Data, and will provide information reasonably needed for the Institution to meet its own notification obligations.

12. Term and termination

This DPA remains in effect while the Institution uses the Service. The data-return and deletion obligations in Section 9 survive termination.

13. General

This DPA is governed by the law specified in the Terms of Service unless the parties agree otherwise in writing. If any term conflicts with the Terms of Service with respect to Student Data, this DPA controls.

14. Signatures

To execute a DPA or submit your institution’s form, contact privacy@impulsdeutsch.com.