School data processing terms

These terms are between the school or other educational institution that uses a school account (the “School”) and Omnibus, Ltd., address available on request (“we”). They form part of the agreement or offer under which the school account is provided, and they prevail over it on data protection matters. They are written to meet GDPR / UK GDPR Art. 28 and, for schools in Türkiye, KVKK Art. 12.

Staff members also have their own Earbunny accounts; their use of the app outside the school account is covered by our privacy policy.

No special-category data and no student personal data are processed on the School's behalf. The School must not upload or send us students' personal data.

We process School data only on the School's documented instructions, which are these terms and the School's settings in the school account, unless the law requires otherwise (in which case we tell the School first, unless the law forbids it). We tell the School if we think an instruction breaks data protection law.

Only staff who need it can access School data, and they are bound by a duty of confidentiality. Every staff access to personal data is logged.

We apply the technical and organisational measures in the annex, appropriate to the risk (GDPR Art. 32). We may improve them over time but will not reduce the overall level of protection.

The School gives general authorisation for us to use the sub-processors on our sub-processors page. We email the School at least 30 days before adding or replacing one. The School may object on reasonable data protection grounds; if we cannot address the objection, the School may end the school account. We bind each sub-processor to data protection obligations equivalent to these terms and remain responsible for it.

School data is hosted in the EU. Where a sub-processor processes it outside the EU/EEA, the UK or Türkiye, we use an adequacy decision (including the EU–US Data Privacy Framework where applicable) or Standard Contractual Clauses, and for data from Türkiye the safeguards of KVKK Art. 9.

Taking into account the nature of the processing, we help the School to answer requests from staff exercising their data protection rights, and with data protection impact assessments and consultations with authorities (GDPR Art. 32 to 36). If we receive a request about School data directly, we pass it to the School.

We notify the School without undue delay, and in any case within 72 hours of becoming aware of a breach affecting School data. The notice describes, as far as known, what happened, the data and people concerned, likely consequences and the measures taken or proposed, and names a contact. We add information as it becomes available and help the School meet its own notification duties.

When the school account ends, we delete the School's organisation, classes, class codes and staff assignments within 30 days, unless the School asks for a copy first or the law requires us to keep something. Backups are overwritten within a further 30 days. Students' links to the classes end; families keep their own Earbunny accounts and data, which are not affected.

We make available the information needed to show compliance with these terms. The School may audit our compliance, once a year or after a breach, with at least 30 days' notice, at its own cost and under confidentiality. We may first answer with documents, questionnaires or reports; an on-site audit is possible when these are not enough.

Each party's liability under these terms follows the agreement under which the school account is provided, except where the law does not allow limiting it.

These terms are governed by the law of the country where Omnibus, Ltd. is registered, unless mandatory law applicable to the School, such as public-sector or data protection law of its country, requires otherwise.

• Encryption in transit (TLS) and at rest, including backups.
• Hosting in the EU; encrypted backups kept for 30 days.
• One access rule checked on every request; school staff see only anonymous reports for their own classes, and class codes only for school administrators.
• Reports are blocked when fewer than 10 students reported data, and contain no names or identifiers.
• Short-lived sessions; sign-in ends with a code sent by email; rate limits and bot protection on sign-in and codes.
• Two-step verification for our admin accounts; every staff access to personal data is logged.
• Sign-in and pairing codes are not written to production logs; crash reports contain no personal data beyond an opaque ID.
• Separation of production and test environments; access granted on a need-to-know basis.
• Incident response process with breach notification as in section 11.

Questions about these terms or a signed copy: schools [at] earbunny.app. More on our security page.