Data Processing Agreement

Last updated 4 October 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Panagiotis Chatzigiannakis, who operates Bandwise (“we”, “Bandwise”), and the school or teacher who uses Bandwise (“the customer”). It sets out how we process personal data on the customer’s behalf, as Article 28 of the EU General Data Protection Regulation (GDPR) requires. A school can ask for a copy signed by both sides at hello@bandwiseapp.com.

1. Roles

For the personal data described in section 2, the customer is the controller and Bandwise is the processor. Where a school uses Bandwise, the school is the controller of the data its admins and teachers add. Bandwise is the controller only of the data it needs to run teachers’ accounts (for example, sign-in details), as described in our Privacy Policy.

2. What we process

• Subject matter and purpose: providing Bandwise to the customer: storing their workspace, marking and giving feedback on students’ practice work (with AI where the customer asks for it), producing and sending reports, and the school features the customer uses.
• Duration: for as long as the customer uses Bandwise, and until the data is deleted as section 3.8 describes.
• People concerned: the customer’s students (who may be children), and, for a school, its teachers and school admins.
• Types of data: students’ names, email addresses, target scores, test types and classes; their essays, photos, PDFs and speaking recordings, with transcripts, scores, feedback and teachers’ notes; writing profiles and comparisons a teacher asks for; for a school, its test bank papers, its own exams and rubric documents, its marked essays (and, where switched on, recordings of its marked speaking tests) and the teachers’ marks on them, its marking tips, example essays and marks adjustments, and how each teacher’s reviewed marks compare with Bandwise AI’s and with colleagues’.
• Special categories: Bandwise is not designed for special categories of data (such as health). The customer should not add them.

3. Our obligations

1. Instructions. We process the data only on the customer’s documented instructions: these terms, and what the customer’s admins and teachers do in Bandwise (for example, asking for an assessment, sharing a report or starting a marks adjustment). If we think an instruction breaks data protection law, we will tell the customer.
2. Confidentiality. Anyone we allow to process the data is bound to keep it confidential. Bandwise staff open a school’s own exams and marking setup only while the school’s admin lets Bandwise help (for 7 or 30 days, or until they stop it); every change they make is logged and shown to the school.
3. Security. We take the measures in the annex below, and keep them up to date.
4. Sub-processors. The customer authorises the sub-processors in section 4. We will tell the customer’s admins by email at least 30 days before adding or replacing one. The customer may object on reasonable data protection grounds; if we can’t resolve it, the customer may stop using the affected feature or end its use of Bandwise. We bind each sub-processor to data protection terms at least as protective as these, and remain responsible for it.
5. People’s rights. Bandwise lets the customer find, export, correct and delete the data itself (for a school feature that is switched off, we delete its data on request). We will help the customer answer requests from students or teachers, and pass on any we receive directly.
6. Assistance. We will help the customer, as far as we reasonably can, with its security obligations, data protection impact assessments and consultations with a supervisory authority.
7. Breaches. We will tell the customer without undue delay, and where we can within 48 hours, after becoming aware of a personal data breach affecting its data, with what we know and what we are doing about it.
8. Deletion. When the customer deletes data, or deletes its account or school, it is removed from Bandwise straight away. The customer can export its data first, under Settings → Account (or, for a school, on the School page). The database’s own recovery copies (kept for 30 days) and our encrypted database backups (kept for 90 days) then expire. Counts of AI use, without any content, are kept for our cost records.
9. Information and audits. We will make available the information needed to show we meet these terms, and allow audits by the customer or an auditor it chooses, at reasonable notice and no more than once a year unless a breach or a supervisory authority requires it.

4. Sub-processors

• Cloudflare, Inc.: hosts Bandwise, stores its database and files (in the EU), and sends Bandwise’s own emails.
• Google LLC: “Bandwise AI”, the built-in AI that transcribes and marks work and runs the school’s checks and try-outs, using Google Gemini on Google’s paid service, where Google does not use the content to train its models; and “Continue with Google” sign-in. During early testing, Bandwise AI may instead run on Google’s free tier, where Google can use submitted content to improve its products; while that is the case it is offered only to named testers, for sample work, and the studio says so.
• GitHub, Inc.: keeps our nightly database backups, encrypted with a key only we hold, for 90 days.

If a teacher connects their own AI provider key or their own mailbox, that provider processes the data under the teacher’s or school’s own agreement with it, not as our sub-processor.

5. Transfers outside the EU

Some sub-processors may process data outside the European Economic Area. Where they do, the transfer relies on safeguards recognised under EU law, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

6. Order of precedence

For the processing of personal data, this DPA takes precedence over the Terms of Service. It is governed by the same law as the Terms.

Annex: security measures

• All traffic is encrypted in transit (HTTPS).
• The database and uploaded files are stored with Cloudflare under EU jurisdiction.
• Saved AI keys and email passwords are encrypted at rest.
• Each teacher’s workspace and each school are kept apart: every request is checked against the signed-in account, and uploaded files are served only to those allowed to see them (report logos excepted, so that emailed reports can show them).
• Sign-in uses one-time email codes or Google, with rate limits against abuse.
• Nightly database backups are encrypted before they leave Cloudflare, and checked to decrypt correctly.
• Only the operator has administrative access to the production systems.

Questions? Email hello@bandwiseapp.com.