Auftragsverarbeitungsvertrag

Für Schulen und andere Einrichtungen, die UDoodle für ihre Kinder, Mitglieder oder Mitarbeitenden nutzen.

Letzte Aktualisierung: 10. November 2026

Diesen Vertrag gibt es nur auf Englisch. Bei Fragen schreiben Sie uns an [email protected].

1. Who this agreement is between

This agreement is between Guernsey Audiovisual, Forest Road, St Martins, Guernsey, which runs UDoodle (“UDoodle”, “we”, “us”), and the school or other organisation that uses UDoodle under our Terms (“the Customer”, “you”).

It forms part of our Terms and applies automatically whenever we process personal data for you, without needing to be signed. If you need a copy signed by us for your records, email [email protected] and we will send one.

If this agreement and our Terms disagree about personal data that we process for you, this agreement takes priority.

2. Meanings

Data Protection Law means the Data Protection (Bailiwick of Guernsey) Law, 2017 and, where they apply to you, the UK GDPR and the Data Protection Act 2018, or the EU General Data Protection Regulation. Words such as controller, processor, personal data, processing, data subject and personal data breach have the meaning that Data Protection Law gives them.

Customer Personal Data means the personal data that we process for you when we provide UDoodle, as described in the Schedule (section 14).

3. Our roles

You are the controller of Customer Personal Data and we are your processor.

You are responsible for having a lawful basis for using UDoodle, for telling the people concerned (or, for children, their parents or guardians) as the law requires, for the personal data you choose to put into UDoodle, and for the instructions you give us.

Our Privacy Policy explains where we act as a controller in our own right, for example for payment records and for the sign-in details of adults who hold their own UDoodle account. This agreement does not cover that data.

4. Acting on your instructions

We will process Customer Personal Data only on your documented instructions. Your instructions are this agreement, our Terms, and the choices you make when you use UDoodle, such as adding, archiving or deleting pupils, inviting teachers or parents, and turning settings on or off.

If the law requires us to process Customer Personal Data in any other way, we will tell you before we do so, unless the law forbids it. We will tell you if we believe an instruction breaks Data Protection Law.

5. Confidentiality

Everyone we allow to process Customer Personal Data is bound to keep it confidential, and can reach it only as far as they need to in order to provide, support or secure UDoodle.

6. Security

We will take appropriate technical and organisational measures to protect Customer Personal Data, taking into account the nature of the data and the risks to the people concerned. The measures we use are described on our Security and data protection page and in section 9 of our Privacy Policy.

We may improve or change these measures over time, but we will not reduce the overall level of protection.

7. Sub-processors

Customer Personal Data is stored only on servers that we own and run ourselves, and no outside company stores your pupils’ work or details for us. Two providers handle Customer Personal Data, in limited ways:

Cloudflare carries the encrypted connection between your devices and our servers, and protects them from attacks. Customer Personal Data passes through its network, but is not stored there.
Resend delivers our emails, which go only to adults. An invitation to a parent or guardian includes the pupil’s display name and class, so that the recipient knows which child it concerns.

PayPal takes payments as a separate controller and receives no Customer Personal Data.

Cloudflare and Resend handle personal data under their own published terms, which include data protection terms that cover the UK GDPR. We remain responsible to you for how they handle Customer Personal Data.

We keep the list of providers in section 6 of our Privacy Policy up to date, and update it at least 14 days before a new sub-processor starts handling Customer Personal Data. If you have a reasonable data protection concern about a change, tell us and we will work with you to resolve it. If we cannot, you may close your account and we will refund the unused part of your plan.

8. Where the data is kept

Customer Personal Data, and its backups, are kept on our own servers in the Channel Islands, under Guernsey law. The UK and the European Union recognise that law as giving personal data an adequate level of protection.

Resend delivers email from the United States, and Cloudflare’s network spans many countries. Where Customer Personal Data goes to a country that the Bailiwick of Guernsey does not recognise as giving adequate protection, we rely on the safeguards in their data protection terms, such as standard contractual clauses.

9. Helping you meet your duties

People’s rights: we will help you respond to people exercising their rights under Data Protection Law, mostly through UDoodle’s own tools, such as downloading a pupil’s notebooks or deleting a pupil. If someone contacts us directly about Customer Personal Data, we will pass the request to you and will not answer it ourselves unless you ask us to.
Assessments: we will give you the information you reasonably need for a data protection impact assessment, and help you with any prior consultation with a data protection authority.
Security: we will help you meet your own security duties, taking into account the nature of the processing and the information available to us.

10. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and in any case within 48 hours. We will tell you what we know about what happened, the data and people affected, the likely consequences, and what we are doing about it, and we will keep you updated as we learn more.

We will work with you to deal with the breach, and help you to tell the data protection authority and the people affected where you need to.

11. When you stop using UDoodle

You can download your pupils’ notebooks as PDFs at any time. When you close your account, we keep Customer Personal Data for 30 days in case you change your mind, and then delete it permanently. Copies leave our backups within a further 30 days. A free trial that ends without an upgrade is deleted as our Terms describe.

If you would like us to return Customer Personal Data to you before it is deleted, ask us and we will help. If the law requires us to keep any of it for longer, we will keep it only for as long as required, and protect it as this agreement describes.

12. Showing that we keep these commitments

We will give you the information you reasonably need to show that we meet this agreement, and answer your reasonable questions about it.

If that information is not enough, you, or an auditor you appoint who is bound to keep what they learn confidential, may audit our compliance with this agreement, no more than once a year unless a data protection authority requires it or there has been a personal data breach. You must give us at least 30 days’ notice, cover your own costs, and carry out the audit in a way that does not affect the security of other customers’ data.

13. Responsibility, changes and law

Each party’s responsibility under this agreement is subject to the limits in section 12 of our Terms, except where Data Protection Law does not allow it to be limited.

This agreement lasts for as long as we process Customer Personal Data for you. We may update it when the law or UDoodle changes. We will email account owners at least 30 days before a significant change, and no change will reduce the protection this agreement gives Customer Personal Data.

This agreement is governed by the law of the Bailiwick of Guernsey, like our Terms.

14. Schedule: details of the processing

Subject matter and duration: providing UDoodle to you, for as long as you use it and until the data is deleted as section 11 describes.
Nature and purpose: storing, showing, syncing and backing up notebooks, shared whiteboards and class information; signing members in; letting the staff, parents and guardians you choose see members’ work; and keeping UDoodle secure.
People concerned: the pupils and other members you add, and your staff where they appear in that data, for example as the teacher who marked a page.
Types of personal data: members’ display names, chosen pictures and colours; their sign-in codes and card keys (stored encrypted); notebooks, drawings and writing, including anything personal written in them; teachers’ marks; class and class tablet details; which staff, parents and guardians can see each member’s work; and security records such as sign-in attempts. Section 3 of our Privacy Policy gives full details.
Special category data: UDoodle does not ask for any. As pupils can write or draw anything in their notebooks, you decide how UDoodle is used for that kind of content.
Where: our own servers in the Channel Islands, with the sub-processors in section 7.
How long: as section 8 of our Privacy Policy and section 11 of this agreement describe.