Data processing agreement

This agreement is between you, the customer that holds a GradeHomeworkOnline account, or the school or team that does (the “controller”), and Aether Analytics LLC, which runs the service (the “processor”). It is part of our terms of service and applies automatically wherever the EU or UK General Data Protection Regulation (GDPR) applies to the personal data you upload. Where it differs from the terms, this agreement wins for personal data.

• Purpose: grading the work you upload against the rubric you approve, showing you the results, and keeping the service secure and working.
• Personal data: what students wrote in their submissions, including any names or details in them and in file names; the names and email addresses of your staff; grades, feedback, corrections and approvals.
• People concerned: your students and your staff.
• How long: while you use the service, and then as described under “Keeping and deleting” on the privacy page.

• We process the personal data only on your documented instructions: your use of the service and this agreement. If we think an instruction breaks the law, we tell you.
• Everyone who works with the data is bound to keep it confidential.
• We protect it with suitable technical and organizational measures, including encryption when it is stored and when it travels, separation of each customer's data, and access only by the roles that need it.
• We help you answer requests from students, parents, and staff who use their rights, and with security, breach notification, impact assessments, and consultation with a supervisory authority, as far as our part of the processing allows.
• We tell you without undue delay after we become aware of a personal data breach that affects your data.
• When you delete your data, your account, or your school or team, we delete it as described on the privacy page, unless the law requires us to keep it.
• We give you the information needed to show that this agreement is kept, and allow and contribute to reasonable audits, with notice, at most once a year unless a breach or a supervisory authority requires more.

You allow us to use other processors to run the service, such as our cloud hosting, sign-in, and AI model providers. We bind each of them to data-protection terms that protect the data as much as this agreement does, and we remain responsible for them. We publish their list before the service is offered publicly, and tell you at least 30 days before we add or replace one, so that you can object. Stripe handles payments as a separate controller under its own terms.

The data is stored in the United States. For transfers from the European Economic Area, the EU standard contractual clauses (Commission Decision 2021/914), module two (controller to processor), are part of this agreement, with you as data exporter and us as data importer. For transfers from the United Kingdom, the UK International Data Transfer Addendum to those clauses is part of it too. Where the clauses ask for a choice: clause 7 (docking) applies; clause 9 uses general authorization with 30 days' notice; the optional wording in clause 11 does not apply; clauses 17 and 18 choose the law and courts of Ireland; the descriptions in section 2 and the measures in section 3 fill the clauses' annexes. If the clauses and this agreement differ, the clauses win.

Sharing approved grades to build better grading is not offered to customers in the EU, the European Economic Area, or the UK. Nothing from them is used for it.

Questions about this agreement, or a signed copy, go to support@gradehomeworkonline.com.