Data Processing Agreement
Last updated: 31 August 2026
1. Parties, and why this agreement exists
This data processing agreement applies between you, the tutor or practice with an account on LessonSolutions (the controller), and Just-Solutions, KvK 42024979, Panna 3, 5126 DJ Gilze, the Netherlands (the processor).
It exists because with this product you process other people's personal data: children of roughly four to twelve years old and their parents. You decide what you record and why; we store and handle it solely to provide the service to you. Article 28 of the General Data Protection Regulation requires that relationship to be set down in writing. This document is that.
How it is entered into. This agreement forms part of the Terms and applies as soon as you create an account and accept those terms. If you would rather have a separate copy signed by both parties — because a school or municipality asks for one, say — email privacy@lesson-solutions.online and we will send you one.
The Dutch text is the authoritative version. If the German or English translation differs from it, the Dutch text prevails.
2. Order of precedence
Where this agreement differs from the Terms, this agreement prevails, but only in respect of the processing of your pupils' and parents' personal data. The Privacy Policy describes the same processing in plain language and is intended as an explanation, not as a deviation.
Terms such as "personal data", "processing", "data subject", "controller", "processor", "sub-processor" and "personal data breach" have the meaning the GDPR gives them.
3. Subject matter, duration, nature and purpose
- Subject matter: providing LessonSolutions — administration, planning, progress tracking, reporting, invoicing and the parent portal for a tutoring practice.
- Nature of the processing: collecting, recording, organising, storing, consulting, altering, transmitting (to the parent through the portal and to the sub-processors in clause 8), and erasing.
- Purpose: solely to provide the service to you. We do not process the data for our own purposes, do not use it to improve our products, do not train models on it, do not sell it and do not share it with advertisers.
- Duration: for as long as you have an account, and afterwards as described in clause 13.
4. Categories of data subject and personal data
Data subjects are: (a) your practice's pupils — children of roughly four to twelve years old; (b) their parents or guardians; and (c) people who request a trial lesson through the sign-up form.
| Category | Data |
|---|---|
| Pupil | first and last name, year group, school, date of birth, hourly rate, start and end date, active or not, free-text notes |
| Parent / guardian | first and last name, email address, phone number, address, country, free-text notes |
| Lessons and lesson logs | date, time, duration, subject, rate, status, the tutor's free-text note, topics covered, homework set and done |
| Assessments | a judgement from 1 to 5 per topic, dated, kept as history |
| Progress reports | draft text, final text, PDF, send date |
| Invoices | invoice number, period, lines with lesson date and amount, VAT treatment, status, payment date, reminders, PDF |
| Materials | files you upload and may share with the parent |
| Parent portal | absences, requests for extra lessons, messages, when the portal was last visited and a counter that allows links to be revoked |
| Trial-lesson request | the child's name, year group, the parent's name, email address and phone number, message |
Special categories. The service never asks for them and has no field for them. The free-text notes and the lesson log are free text, so you can put something in them that counts as a special category. Do not, unless it is genuinely needed for the tutoring practice and you have a basis for it. We are not set up for the systematic processing of health data and do not treat it as part of the instruction.
5. Your instructions
We process the personal data only on your documented instructions. Your instructions consist of: this agreement, the Terms, the features of the service as you use them, and the settings you choose.
If Union or Member State law requires us to process beyond that, we tell you before we do, unless that law prohibits us from telling you.
We will tell you if we believe an instruction of yours infringes the GDPR or other data protection rules.
You warrant that you have a valid basis for processing this data, that you inform parents about what you record and why, and that you decide for yourself how long you keep it. We cannot make that assessment for you, and we do not.
6. Confidentiality
Everyone on our side with access to the personal data is bound to confidentiality, by contract or by law. That duty survives the end of their work and of this agreement.
Access to production data is limited to the people who need it to keep the service running, and is used for operations, backups and fixing faults — not for reading along.
7. Security (Art. 32 GDPR)
We take appropriate technical and organisational measures. These are the measures actually in the product today:
- encryption of all traffic with TLS (HTTPS);
- passwords stored only as a hash, using an algorithm intended for that;
- the session cookie is HttpOnly, Secure and SameSite; a session access token is short-lived;
- strict separation between practices: every query in the service is bound to the account that owns the record, and a parent portal link is bound to one family — changing a parameter yields nobody else's data;
- a parent portal link is signed, cannot be tampered with, and can be revoked for a family in one action;
- rate limiting on sign-in and on the API, and a temporary account lock after repeated failed sign-ins;
- security headers on every response;
- spam protection on public forms that runs on our own server and involves no third party;
- a security log of sign-in and account events, with a timestamp and IP address;
- hosting inside the European Union, in Germany;
- regular backups of the database.
We may change these measures as long as the level of protection does not decrease.
8. Sub-processors
You give us general authorisation to engage the sub-processors below. With each of them we have arrangements no less strict than this agreement.
| Sub-processor | For what | Where | Which data |
|---|---|---|---|
| Contabo GmbH | hosting of servers, database and file storage | Germany | all data in the service |
| TransIP B.V. | domain name and DNS | the Netherlands | no content data |
| Our own mail server | sending email on behalf of the service | EU, the same infrastructure as the hosting | email address and message content |
| Mollie B.V. | payment of your subscription with us — no parent payments | the Netherlands | your name, email address and payment details |
| Anthropic PBC | writing a draft progress report, only when you use that feature | United States | the pupil's first name, year group, subject, period, lesson dates, topics, your lesson notes and your assessments |
Anthropic deserves a separate warning. This is the only sub-processor that processes the personal data of a named child outside the EU, and the only one that sees free text you wrote about that child. You instruct it by using the feature: the service sends nothing to Anthropic unless you have a draft report generated. Surname, date of birth, school, address, parent details and invoices are never sent. The output is always a draft you must review; nothing is ever sent to a parent automatically.
We inform you at least 30 days before we add or replace a sub-processor. If you object within that period and we cannot resolve it together, you may cancel your subscription as of the date of the change at no cost.
9. Transfers outside the EU
All data sits on servers in Germany. The only structural transfer outside the EU is the one to Anthropic in the United States, and only when you use the draft-report feature. That transfer relies on the European Commission's Standard Contractual Clauses, incorporated in Anthropic's data processing terms.
We do not transfer personal data to any other third country without informing you and without a valid transfer mechanism.
10. Data subject rights
If a parent asks for access, rectification, erasure, restriction, objection or portability, you are the one who answers that request. We may not do so on our own initiative.
We help you with the means the service provides: you can see and edit all of a family's data in the app, and you can erase a family together with its full history — the service shows exactly what that will destroy before it does it.
If you get stuck or need something the app does not offer, email privacy@lesson-solutions.online. We help within a reasonable period and free of charge, unless a request demands a disproportionate amount of work.
If a request from a parent reaches us directly, we do not answer it on the merits. We refer the parent to you and let you know a request has come in.
11. Assistance with assessments and consultation
Taking into account the nature of the processing and the information available to us, we assist you in meeting your obligations under Articles 32 to 36 GDPR: securing the processing, notifying a data breach, carrying out a data protection impact assessment, and prior consultation of the supervisory authority.
In practice that means: on request we give you the information about our processing, our sub-processors and our security measures that you need for such an assessment.
12. Personal data breaches
If we discover a personal data breach affecting your data, we notify you without undue delay and in any event within 48 hours of becoming aware of it.
We report what we know at that moment: what happened, which categories of data and data subjects are involved, the likely consequences, the measures we have taken and who to reach at our end. If we do not know everything yet, we report first and supplement afterwards.
Notifying the supervisory authority and, where required, the parents is your responsibility — you are the controller. We supply everything you need from us to do so.
13. What happens to the data when this ends
We describe honestly what happens today, including where that is not yet what it should be.
- You can always erase it yourself. You can erase a family together with its full history — children, lessons, logs, assessments, reports, materials and messages — in one action. The service first shows exactly what will disappear and asks you to type the family name.
- Sent invoices block that. If sent invoices exist for that family it cannot be erased: you must keep those invoices for seven years (Art. 52 of the Dutch General Tax Act), and the GDPR expressly leaves that obligation standing (Art. 17(3)(b)). A draft invoice blocks nothing — it was never sent, and it is erased along with the family.
- Export. You can export your account data from your settings. If you want a full export of your practice data in a readable format, email privacy@lesson-solutions.online; we provide it free of charge.
- Deleting your account erases the whole practice. If you delete your account we erase, in the same action, every pupil and parent record you put into the service: children, lessons, lesson logs, assessments, reports, schedules, materials and portal messages. If that erasure fails, the account is not deleted either. Only families with sent invoices remain, and of those only the name and billing address — everything else, including the child and their lessons, is erased in that case too. If you want those last records gone as well, that is possible once your own retention obligation has expired; email privacy@lesson-solutions.online and we will do it.
- Backups. Erased data may remain in routine backups until those expire. For as long as it does, it is no longer used and no longer shown.
14. Audit and information
On request we make available all information necessary to demonstrate compliance with this agreement: our security measures, our sub-processors, and where the data sits. Ask at privacy@lesson-solutions.online.
You have the right to have an audit carried out by an independent expert bound to confidentiality. Give at least 30 days' notice, at most once a year, unless a data breach or a direction from the supervisory authority gives cause for more. An audit may not disrupt the service to other customers and may not give sight of another practice's data. You bear the cost, except where the audit shows a material failure by us to comply with this agreement.
15. Liability
Each party is liable for its own conduct as Article 82 GDPR provides. The liability cap in the Terms does not apply to our obligations as a processor under this agreement.
16. Duration, changes, law and contact
This agreement lasts for as long as we process personal data for you and ends afterwards, except for provisions that by their nature continue (confidentiality, liability, and what happens to the data at the end).
We may change this agreement where the service, the law or regulatory guidance gives cause. We announce a change by email at least 30 days in advance; if you do not agree you can cancel as of the effective date.
Dutch law applies to this agreement. Contact:
Just-Solutions, Panna 3, 5126 DJ Gilze, the Netherlands. KvK 42024979.
privacy@lesson-solutions.online