Data Processing Agreement
What this document is for. When a school uses Voice-Board, we
process data about its pupils and teachers. The school decides what for — it is
the controller. We only carry out what it instructs — we are the processor.
Article 28 GDPR requires that relationship to be put in writing, and this is it.
This agreement becomes part of the contract when an education licence is
concluded. A signed copy is available on request at .
In case of doubt the German version prevails.
§ 1 Parties and subject matter
(1) The controller is the educational institution using Voice-Board ("the institution").
(2) The processor is
Voice-Board.com by Ing. Bernhard Wurm MA BSc BEd
Stifterstr. 4A
4160 Aigen-Schlägl
Austria
Email:
(3) The subject matter is the processing of personal data in the course of providing the software-as-a-service platform Voice-Board — feedback boards, roadmaps, task and project management, time tracking, document storage and the notifications that go with them.
(4) Processing takes place exclusively within the European Union, except where Annex 2 states otherwise.
§ 2 Duration
This agreement runs for as long as the institution uses Voice-Board. It ends with the main contract; the obligations under § 8 (return and deletion) and § 5 (confidentiality) survive it.
§ 3 Nature, scope and purpose of the processing
3.1 Purpose
Operating the platform for the institution: creating and managing accounts, storing and displaying contributions and tasks, enforcing permissions, sending notifications, storing files, and logging use as far as operation and security require.
3.2 Categories of data subjects
- pupils of the institution
- teachers and other staff of the institution
- where the institution involves them, parents and guardians
- where the institution invites them, external project partners
3.3 Types of data
| Category | Specifically |
|---|---|
| Master data | name, email address, display name, optional profile picture, language, time zone |
| Credentials | password hash, passkey credentials or the identifier of a sign-in provider; passwords are never stored in the clear |
| Roles and permissions | membership of workspaces, boards and projects, role, permissions |
| Content | contributions, comments, votes, tasks, time entries, uploaded files and documents — everything users type in |
| Usage and log data | time and nature of access, IP address, technical error messages; kept for 14 days |
| Notification data | delivery settings, email address, device endpoint where push notifications are enabled |
Special categories under Article 9 GDPR are not envisaged. Voice-Board does not collect them. Because content fields are free text, the institution can put them there — it tells its users not to, and carries the responsibility if they do.
§ 4 Instructions
(1) We process the data solely on the documented instructions of the institution. The main contract, the settings in the product and this agreement are those instructions; anything beyond them is to be given in text form (email is enough).
(2) If we consider an instruction unlawful we say so, and may suspend it until the institution confirms or changes it (Article 28(3)(h) GDPR).
(3) There is no processing for our own purposes. In particular, the institution's content is not analysed for product improvement, not used to train AI models and not sold to third parties.
§ 5 Confidentiality
(1) Only persons bound to confidentiality have access to the institution's data (Article 28(3)(b) GDPR). The obligation outlasts their engagement.
(2) Voice-Board is currently operated by one person. Administrative access to production data happens only where it is necessary for operation, fault fixing or a support request from the institution.
§ 6 Technical and organisational measures
We take the measures described in Annex 1 under Article 32 GDPR. They may be developed further as long as the level of protection does not fall.
§ 7 Sub-processors
(1) The institution consents to the sub-processors listed in Annex 2.
(2) We announce a change or addition in text form at least four weeks in advance. Within that period the institution may object on substantial data-protection grounds; if no agreement is reached it may terminate the main contract with effect from the date of the change.
(3) Each sub-processor is bound by obligations equivalent in protection to this agreement.
§ 8 Return and deletion
(1) During the term the institution can export its data at any time (JSON and CSV).
(2) After the contract ends the data remains retrievable for a further 30 days and is then deleted. We delete sooner on request.
(3) Records we are required by law to keep are excepted — in particular invoices under § 132 BAO (seven years). These are blocked and used for nothing else.
§ 9 Assistance to the institution
(1) Data subject rights. If a data subject approaches us directly we refer them to the institution and inform it. The product provides functions for access, rectification and erasure; beyond that we assist as far as can reasonably be expected.
(2) Personal data breaches. We report any breach to the institution without undue delay after becoming aware of it, as a rule within 24 hours, with everything it needs for its own notification under Article 33 GDPR. The report goes to the contact address held for the institution.
(3) We assist with data protection impact assessments under Article 35 GDPR as far as the information is available only to us.
§ 10 Evidence and audits
(1) We make available to the institution the information it needs to demonstrate compliance with this agreement (Article 28(3)(h) GDPR). This document and its annexes are the first part of that evidence.
(2) The institution may request an audit. It takes place with reasonable notice, during normal business hours and without disrupting operations. Effort for audits beyond one per year that are not prompted by a specific incident may be charged.
§ 11 Minors
(1) The institution determines the legal basis for processing pupils' data. Where required, it obtains the consent of those with parental responsibility (Article 8 GDPR; in Austria a minor may consent independently from the age of 14, § 4(4) DSG).
(2) We do not create accounts for minors without the institution's instruction and send them no marketing.
§ 12 Liability and final provisions
(1) The liability provisions of the main contract apply; Article 82 GDPR remains unaffected.
(2) Where this agreement contradicts the main contract on data protection, this agreement prevails.
(3) Austrian law applies. The place of jurisdiction is Rohrbach in Oberösterreich, unless the institution is subject to a statutory venue.
(4) If a provision is invalid, the remainder stays in force.
Annex 1 · Technical and organisational measures (Article 32 GDPR)
Confidentiality
| Measure | Implementation |
|---|---|
| Physical access control | Operation in the hosting partner's data centre; physical access under its security policy |
| System access control | Sign-in with a password (stored hashed), a passkey/WebAuthn credential or a sign-in provider; lockout after repeated failures; email address confirmation |
| Data access control | Role and permission system per workspace, board and project; every database query is confined to the caller's workspace regardless of what is asked for |
| Separation | Tenant separation at the database level; files are held per tenant in separate stores |
| Pseudonymisation | When an account is deleted, contributions remain as anonymised placeholders so that other people's discussions stay intact |
Integrity
| Measure | Implementation |
|---|---|
| Transmission control | Transport exclusively over TLS; credentials for integrations are stored encrypted |
| Input control | Changes to content are logged with time and the person who caused them |
| Cross-site protection | Writing requests arriving from other sites are refused; content security policy |
Availability and resilience
| Measure | Implementation |
|---|---|
| Backup | Regular backup of database and file storage |
| Recoverability | Restore from backup; schema changes run versioned and traceably |
| Monitoring | Operational health checks for database and background services |
Procedures for review
| Measure | Implementation |
|---|---|
| Processor control | This agreement; equivalent obligations with every sub-processor |
| Data protection by design | Only the data a feature needs is collected; permissions are checked centrally rather than per screen |
| Regular review | Automated tests hold tenant separation and permission checks in place on every change |
Annex 2 · Sub-processors
| Company | Service | Data | Location |
|---|---|---|---|
| Eigener Server des Verantwortlichen | Operation of the application, database, file storage and mail delivery | all data listed in § 3 | European Union |
| Browser vendors' push services | only where a user enables push notifications | encrypted notification, device endpoint | worldwide |
| Google Ireland Ltd. / Microsoft Ireland / GitHub, Inc. | only where sign-in goes through one of these services; the institution can switch it off | the sign-in itself; we receive email, name and possibly a picture | EU/US |
Not part of educational use: no payment provider is involved — education licences are billed by invoice. AI features are not enabled; no content is transmitted to an AI provider.
Last updated: 09/2026