This is the standard data processing agreement of Lince para escuelas (in Spanish, contrato de encargo de tratamiento), as article 28 of the GDPR requires. It covers the personal data Lince processes for a school, or for a teacher who teaches on their own, when they run classes in Lince. A school accepts it online: by becoming a teacher in the teacher panel, or by creating or using a class with a teacher account, the teacher accepts it on behalf of their school. It applies for as long as the school has classes in Lince.
Parties and roles
- The school — the school, academy or teacher who runs classes in Lince decides why and how class data is used, and is its controller. A teacher who accepts this agreement confirms they may do so for their school.
- Lince — Lince, the operator of the Lince app and getlince.app, processes class data on the school's behalf as its processor. For the rest of each person's account (their own learning, settings and subscription) Lince remains the controller, as the Privacy policy describes.
- Adults only — Lince para escuelas is for adult education. The school uses classes only for learners aged 18 or older.
What Lince processes
- Purpose — only to provide Lince para escuelas to the school: classes and join codes, the class roster, homework with lessons and tasks, marking and grading, the gradebook and its spreadsheet download, the exercise bank and Lince Live games in class, and, for a teacher who connects their own Google Classroom, creating classes and invitations from their courses.
- Teachers — their name on Lince, their school name, and the classes (name, level, course and join code), homework, tasks, worksheets, grades and comments they create.
- Learners in a class — their name on Lince and the date they joined and agreed to share their class work; for each homework assignment, their progress on its lessons and, for each lesson question, whether they were right, how many tries they took and when (never what they typed); the answers they submit to homework tasks, how each one was marked, and the teacher's score, rubric and comment.
- Lince Live players — their name on Lince or the nickname they choose, their answers and their score in each game.
- Google Classroom import — for a teacher who connects their own Google Classroom: the connection (Google's refresh token, encrypted, the connected account's email address, the permissions granted and the connection date); for each imported class, the ID and name of its Classroom course; for each invited student, their name, email address, Google user ID and whether the invitation is pending or declined. Lince only reads Google Classroom and never changes anything in it.
- No special categories — Lince para escuelas does not ask for special categories of data (GDPR art. 9). The school should not put them in class names, tasks or comments.
- Product analytics — when a learner joins a class, the app records one class-joined event with the class level, the course and whether they joined from their profile or a class link (no class name and no class work), linked to the learner's account identifier, so we can run and improve the service. On Android, the app also records session replay in every session, uploaded on Wi-Fi only, with no audio or camera and with on-screen text and images masked; it can show the screens a person uses in the app, including class screens. The app also records which screens a learner opens and which controls they tap (the control’s name and the screen only, never what they type, their answers or on-screen text), linked to the learner’s account identifier.
What Lince commits to
- We process class data only on the school's documented instructions: this agreement and what its teachers do in Lince (creating classes and homework, grading, downloading, archiving and deleting). If we think an instruction breaks data protection law, we tell the school.
- We do not sell class data or use it for advertising.
- Only the people who operate Lince can reach the production database, and they are bound to confidentiality.
- We help the school answer requests from learners and teachers to access, correct, delete or move their data. Learners can leave a class in the app, teachers can download the gradebook, and for anything else the school can email us.
- If a personal data breach affects class data, we email the school's teachers without undue delay after we become aware of it, with what we know, so the school can meet its own duties.
- We allow and contribute to audits and inspections by the school, or by an auditor it appoints: on request by email we give the information needed to show that this agreement is kept, and we agree a reasonable date and scope for any inspection. We also help with data protection impact assessments.
Security
- All traffic to the Lince app's service and getlince.app is encrypted with TLS.
- Our servers accept web traffic only through Cloudflare. The database requires authentication and accepts connections only from Lince's own services.
- The database is backed up every day. Backups are encrypted, protected against change, and expire after a limited time, about a week.
- A teacher sees only the learners currently in their class, and results per lesson question only as totals for the whole class.
Sub-processors
- Hetzner Online (Germany) — the servers and the database, in Falkenstein, Germany, and the encrypted backups, in Hetzner object storage in the EU.
- Cloudflare — DNS, TLS encryption and the network proxy in front of getlince.app: every request to the Lince service passes through it.
- Mixpanel (EU) — product analytics: the class-joined event, screens opened, controls tapped (name and screen only) and the Android session replay (on-screen text and images masked) described above.
- New Relic (EU) — crash and error reports, which can include an account identifier. API response bodies are not collected.
- Brevo (Sendinblue SAS, France, EU) — sends account emails (sign-up confirmation, password reset).
- Zoho Mail — our support inbox when the school or a learner writes to us.
- We bind each sub-processor by contract to the same data protection obligations as this agreement, and we remain responsible to the school for how they process class data.
- Before we add or replace a sub-processor that handles class data, we update this list and email the school's teachers, so the school can object. A school that objects can stop using classes and have its class data deleted.
- Where data is processed — class data is stored in the EU, and Mixpanel and New Relic process their data in the EU. Cloudflare and Zoho Mail run services outside the EU too. We transfer personal data outside the EU only with the safeguards that Chapter V of the GDPR requires.
Keeping and deleting class data
- Class data is kept while the class exists; archiving a class keeps it.
- When a student joins a class, the invitations to it from a Google Classroom import addressed to one of their verified email addresses (including a linked Google account's) are deleted. A declined invitation is kept, marked declined, so that the student is not invited again. Deleting a teacher account deletes the invitations in its classes, and deleting a learner account deletes the invitations addressed to one of its verified email addresses (including a linked Google account's). When a teacher disconnects Google Classroom, Lince revokes its access at Google and deletes the connection; the classes and invitations already imported stay until they are deleted as described here.
- When a learner leaves a class, the teacher stops seeing them at once and their lesson question results for that class are deleted. The homework tasks they submitted stay readable for them, hidden from the teacher, until the teacher deletes the task.
- Deleting a homework assignment deletes its lesson question results; deleting a task deletes the answers submitted to it.
- A Lince Live game is deleted automatically 24 hours after its last activity.
- Deleting a teacher account deletes its classes with their memberships, homework, tasks, results and submissions, its school name and its own exercise bank. Deleting a learner account deletes the learner's memberships, results and submissions.
- When this agreement ends, or whenever the school asks by email, we delete the school's class data within one month and confirm it, unless the law requires us to keep it. Before that, a teacher can download each class's gradebook. Deleted data can remain in the encrypted backups for a limited time, about a week, until they expire.
Changes
We may update this agreement, for example when Lince para escuelas gains a feature or a sub-processor. The date at the top shows the current version, and a school that keeps using classes after a change accepts it. A school that does not accept a change can stop using classes and ask us to delete its class data.
Contact
Questions about this agreement, or a request from your school? Email info@getlince.app.
This is the standard data processing agreement of Lince para escuelas under GDPR article 28, written in plain language.