1. Parties to the Agreement

2. Background and Purpose

This Data Processing Agreement governs the Data Processor's processing of personal data on behalf of the Data Controller in connection with the use of the service Timeplaner.no.

Timeplaner.no is a digital planning tool for teachers that enables:

• Creating and managing weekly and yearly plans
• Storing lesson notes and homework
• Organizing teaching materials
• Using classroom screen for display to students
• AI-assisted lesson planning (optional, teacher-activated)
• Cloud storage via Google Drive or Microsoft OneDrive (optional, teacher-activated)
• Sharing lesson plans with substitute teachers via time-limited link (optional)
• Sharing calendar via public link (optional)

3. Categories of Personal Data

3.1 Data Processed

Category	Data	Source
Identification	Name, email address	Feide / Google / Microsoft
Authentication	Feide ID, Google ID, Microsoft ID	Feide / Google / Microsoft
Organization Affiliation	School/municipality, role at organization (teacher/staff/student). The role is used solely to reject student logins at registration, and is not stored in the service database	Feide
User Content	Weekly plans, yearly plans, notes, images uploaded by the teacher (typically screenshots of websites and teaching material)	Created by user
Technical	Login time, language preference	System generated
Student identifiers	Nickname/number/initials, gender (optional), birthday (MM-DD, optional), the teacher's own notes and labels about the pupil (free text, optional)	Recorded by teacher
Student activity	Homework status (submitted/not submitted/late), test results recorded by the teacher, assessment without formal grades (pass/fail, points, percentage, goal attainment) and the teacher's comment on the result (free text, optional)	Recorded by teacher / system generated
Security logging	IP address, user agent (retained 12 months)	System generated
Activity logging	Page visits, in-service actions (aggregated)	System generated
AI lesson context	School type, grade level, school name, subject name, class name, week and day, year-plan content (topic, competence aims, learning goals, activities, resources), the teacher's subject links, routines and custom columns, and the teacher's own notes and messages (only when AI assistant is used). The teacher sees what accompanies each message and can deselect individual parts before it is sent. Student lists, student identifiers, homework status, and test results are never sent to the AI service	Teacher-activated
Cloud-stored content	Documents created by the teacher (only when Drive/OneDrive is connected)	Teacher-activated

3.2 Data NOT Processed

• Diagnoses, medical certificates, or specific health information
• Religion, ethnicity, or other special categories under GDPR Article 9
• National identification numbers
• Formal grades (1-6) or end-of-term assessments

4. Data Subjects

This agreement applies to the processing of personal data about:

• Teachers employed by the Data Controller who use Timeplaner.no
• Students recorded in the class overview by the teacher. The teacher does this on behalf of the Data Controller, who is also the controller for these data. What goes in the identifier field is described in section 3.1

The number of data subjects will vary based on how many teachers choose to use the service and how many students they record.

5. Purpose and Legal Basis

The Data Processor processes personal data solely for the following purposes:

1. Authentication: Verifying user identity via Feide, Google, or Microsoft
2. Service Delivery: Providing the functionality described in section 2
3. AI-assisted planning: Generating lesson content suggestions when the teacher actively uses the AI assistant
4. Cloud storage: Storing the teacher's documents in Google Drive or Microsoft OneDrive when the teacher has activated the connection
5. User Support: Helping users with technical problems
6. Security: Protecting against unauthorized access and misuse

Legal basis is GDPR Article 6(1)(b), performance of a contract with the data subject.

6. Data Processor Obligations

6.1 General Obligations

The Data Processor shall:

1. Only process personal data in accordance with documented instructions from the Data Controller
2. Ensure that persons with access to personal data have committed to confidentiality
3. Take all measures required under GDPR Article 32 (security)
4. Assist the Data Controller in fulfilling data subject rights under GDPR Chapter III (Articles 12 to 23), cf. Article 28(3)(e)
5. Assist the Data Controller in complying with GDPR Articles 32 to 36, including security, breach handling, data protection impact assessment, and prior consultation with the supervisory authority, cf. Article 28(3)(f)
6. Delete or return personal data at the end of the agreement
7. Make available all information necessary to demonstrate compliance

6.2 Security Measures

The Data Processor has implemented the following security measures:

• Encrypted data transfer (HTTPS/TLS)
• Secure authentication via Feide, Google, or Microsoft OAuth 2.0
• Access control based on user identity
• Regular backups
• Security event logging
• Data storage in the Nordic countries (server in Finland, EU/EEA)

6.3 Assistance with Data Protection Impact Assessment (DPIA)

Carrying out a data protection impact assessment under GDPR Article 35 is the responsibility of the Data Controller. The Data Processor shall assist with the material such an assessment is based on, and with any prior consultation with the supervisory authority under Article 36.

This assistance is free of charge to the Data Controller, and covers:

• A DPIA source document describing purposes, data categories, data subjects, sub-processors and their locations, retention periods, security measures, third-country transfers, and the controls the Data Controller has at organisation level
• A Transfer Impact Assessment for transfers to third countries, cf. Section 8
• Written answers to questions from the Data Controller's data protection officer, normally within 10 working days
• A meeting showing the actual data flow in the service, if the Data Controller wants one

The documents are available on request to [email protected]. If we change the processing so that a completed assessment needs updating, the Data Processor notifies the Data Controller.

7. Sub-processors

The Data Processor uses the following sub-processors:

7.1 Always-active sub-processors

Sub-processor	Service	Location
Hetzner Online GmbH	Web hosting, database and file storage	Server in Finland (Nordic, EU/EEA)
Cloudflare, Inc.	CDN and DDoS protection, plus storage of encrypted backups (AES-256, the key is held only by the Processor)	EU/USA*
SMTP2GO	Email delivery (transactional emails, no pupil data)	EU (Amsterdam, Netherlands)**
Sikt, Norwegian Agency for Shared Services in Education and Research	Feide authentication (when Feide login is used)	Norway
Google LLC	Google OAuth 2.0 (when Google login is used)	EU/USA*
Microsoft Corporation	Microsoft OAuth 2.0 (when Microsoft login is used)	EU/USA*

7.2 Optional sub-processors (teacher-activated)

The following sub-processors process personal data only when the individual teacher actively activates an optional feature:

Sub-processor	Service / data	Location	Activated when
Google LLC	Gemini AI: lesson context (school type, grade level, school name, subject name, class name, week and day, year-plan content, subject links, routines, custom columns, and the teacher's own notes and messages). The teacher can deselect individual parts before each message. No student information from the student register (student lists, identifiers, homework status, test results) is sent to the AI service. Paid plan; data is not used to train Google's models.	USA*	Teacher uses the AI assistant
Google LLC	Google Drive: document storage (teacher's own documents)	USA*	Teacher connects Google Drive
Microsoft Corporation	Microsoft Graph / OneDrive: document storage (teacher's own documents)	USA*	Teacher connects OneDrive

* Transfers to the USA are secured under the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC).
** Timeplaner's SMTP2GO account is hosted in SMTP2GO's European data center in Amsterdam. All email is sent, stored, and processed on servers within the EU/EEA. SMTP2GO is ISO 27001 certified and GDPR compliant; the European data center is additionally SOC 2 Type II and ISAE 3402 certified. SMTP2GO Pty Ltd is incorporated in New Zealand; the EU Commission has an adequacy decision for New Zealand (2013/65/EU), and Standard Contractual Clauses (SCC) additionally apply to the corporate parent relationship.

The Data Processor will inform the Data Controller of any planned changes to sub-processors at least 30 days before the change takes effect.

7.3 Sharing features activated by the teacher

The service includes two optional sharing mechanisms that the teacher activates:

• A public calendar link gives read-only access to the teacher's calendar via a randomly generated token. The teacher can revoke it.
• A substitute teacher (vikar) plan link gives read-only access to one specific substitute lesson plan via a time-limited token with an expiry date.

All sharing can be revoked by the teacher, and tokens are random and unguessable.

8. Transfer of Personal Data

Personal data is primarily stored on servers in the Nordic countries (server in Finland, EU/EEA).

Email is sent through SMTP2GO's European data center in Amsterdam, so transactional email content is stored and processed within the EU/EEA.

Data is transferred to the USA only when Google, Microsoft, or Cloudflare services are used (secured under the EU-US Data Privacy Framework and Standard Contractual Clauses).

Transfers outside the EU/EEA are secured through:

• EU-US Data Privacy Framework (for US vendors)
• Standard Contractual Clauses (SCC) approved by the EU Commission
• The EU Commission's adequacy decision for New Zealand (2013/65/EU)

A Transfer Impact Assessment (TIA) for transfers to third countries has been prepared and is available on request via [email protected].

9. Data Subject Rights

The Data Processor shall assist the Data Controller in fulfilling data subject rights:

• Access: Data subjects can view their own data in the service
• Rectification: Users can update their information
• Erasure: Users can delete their account via Settings
• Data Portability: Export of data is available upon request

Inquiries about data subject rights can be directed to: [email protected]

10. Breach Handling

In the event of a personal data breach, the Data Processor shall:

1. Notify the Data Controller without undue delay and within 24 hours at the latest
2. Document all breaches, including circumstances, consequences, and measures taken
3. Assist the Data Controller with notification to supervisory authorities and data subjects if necessary

Notification will be sent to the contact person specified in section 1, as well as to: [email protected]

11. Audit Rights

The Data Controller has the right to:

• Conduct audits of the Data Processor's processing
• Receive documentation on security measures and procedures
• Request confirmation of compliance with this agreement

Audits shall be notified at least 14 days in advance and conducted in a way that does not disrupt normal operations.

12. Retention and Deletion

12.1 Retention Period

• User data is retained as long as the account is active
• Inactive accounts (no login for 24 months) are notified before deletion
• Security logs are retained for 12 months

12.2 Upon Termination of Agreement

Upon termination of the agreement, the Data Processor shall:

1. Give the Data Controller the opportunity to retrieve data (30 days)
2. Delete all personal data, including backups (90 days)
3. Confirm in writing that deletion has been completed

13. Duration of Agreement

This agreement enters into force upon signing and applies as long as the Data Controller has users using Timeplaner.no via Feide.

The agreement may be terminated by either party with 3 months written notice.

14. Liability

The Data Processor is liable for:

• Damage resulting from processing in breach of this agreement
• Damage resulting from processing in breach of GDPR or the Data Controller's instructions

The Data Processor is exempted from liability if it is proven that the Data Processor is not responsible for the event that caused the damage.

15. Governing Law and Jurisdiction

This agreement is governed by Norwegian law. Any disputes shall be sought resolved through negotiations. If negotiations are unsuccessful, the dispute shall be decided by Norwegian courts with Bergen District Court as the legal venue.