CMS.Kids Data Processing Agreement

1. Subject matter, duration, nature and purpose

1.1. EMODAS processes, on behalf of the Client, the personal data that the Client and its users enter into CMS.Kids.

1.2. Purpose: providing the CMS.Kids service — records of children and parents, groups, timetable, attendance, reports, charges and invoices, communication with parents.

1.3. Nature of processing: storage, organisation, display to users, alteration, sending emails and push notifications, generating PDF documents, erasure.

1.4. Duration: for as long as the Client uses the service, and thereafter until the data is deleted under section 8.

2. Data subjects and categories of data

Health information (illness, diet, allergies) is a special category of data and is processed only if the Client enters it.

3. Processing only on the Client’s instructions

3.1. EMODAS processes the data only on documented instructions from the Client, including with regard to transfers to third countries. The instructions are this Agreement, the Terms of Use, actions of the Client’s users in the system and the Client’s emails to info@cms.kids.

3.2. If Union or Member State law requires EMODAS to process the data otherwise, EMODAS informs the Client before processing, unless that law prohibits such information.

3.3. EMODAS immediately informs the Client if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

4. Confidentiality

Only those persons at EMODAS who need access to the Client’s data to run and support the service are given it. All of them are bound by confidentiality, by contract or by law.

5. Security measures

EMODAS implements the measures required by Article 32 GDPR:

• the server and the data are located in a data centre in Germany;
• all connections to the service are encrypted (HTTPS, TLS 1.2/1.3, HSTS);
• the database and the internal API are not reachable from the internet;
• passwords are stored only as bcrypt hashes; one-time links in emails are stored as hashes and expire within 7 days;
• sessions are kept in cookies with the HttpOnly and Secure flags;
• access is role-based (manager, teacher, parent); parents’ contact details are visible only to staff granted a separate permission;
• the data of different clients is separated at the level of every database query;
• photos and files are served only to authenticated users of the Client;
• the number of sign-in attempts from one IP address is limited;
• third-party scripts are blocked (Content Security Policy); there are no analytics or advertising cookies;
• web server logs are capped in size and older entries are deleted automatically;
• operating system security updates are installed automatically;
• backups are made daily, stored by Hetzner in Germany and deleted automatically within 7 days at the latest; temporary copies made before system updates are kept for no longer than 30 days.

6. Sub-processors

6.1. The Client gives general authorisation to engage the sub-processors listed below.

6.2. EMODAS notifies the Client by email at least 30 days before adding or replacing a sub-processor. The Client may object within that period; if no agreement is reached, the Client may stop using the service.

6.3. EMODAS imposes on each sub-processor, by contract, data protection obligations no less protective than these and remains liable to the Client for their performance.

6.4. Data is transferred outside the EEA only with the safeguards of Chapter V GDPR: a European Commission adequacy decision (including the EU–US Data Privacy Framework) or the EU standard contractual clauses.

7. Assistance to the Client

7.1. EMODAS assists the Client in responding to data subject requests: access, rectification, erasure, restriction of processing, portability and objection. A request received by EMODAS directly is forwarded to the Client without delay.

7.2. EMODAS notifies the Client of a personal data breach without undue delay after becoming aware of it. The notification states what happened, which data and data subjects are affected, the likely consequences and the measures taken. What is not yet known is provided as it becomes available.

7.3. Taking into account the nature of processing and the information available to it, EMODAS assists the Client with its obligations under Articles 32–36 GDPR: security, notification of the supervisory authority and data subjects, data protection impact assessment, prior consultation.

8. Deletion or return of data

After the Client stops using the service, EMODAS, at the Client’s choice, returns the personal data to the Client or deletes it, and deletes all existing copies unless Union or Member State law requires storage. A copy of the data in a machine-readable format is provided on request to info@cms.kids made before the workspace is closed. The data, including backups, is deleted no later than 30 days after closure.

9. Demonstrating compliance

EMODAS makes available to the Client all information necessary to demonstrate compliance with this Agreement and Article 28 GDPR, and allows for and contributes to audits, including inspections, by the Client or an auditor it mandates. An audit is agreed at least 30 days in advance, takes place no more than once a year (except after a breach or at the request of a supervisory authority), is at the Client’s expense and gives no access to other clients’ data.

10. Limitation of liability

EMODAS’s total liability to the Client under this Agreement is limited to the amount the Client paid for the service in the 12 months before the incident, but not less than EUR 500. This limit does not apply to liability that cannot be limited under applicable law.

11. Final provisions

This Agreement applies together with the Terms of Use and prevails over them in matters of data protection. EMODAS notifies the Client of a new version by email, and the new version is accepted in the system again. This Agreement is made in Russian, English and Greek; in case of discrepancy the English version prevails.