# Data Processing Agreement *Template. Version October 2026. The bracketed parts are for the parties to complete.* This Data Processing Agreement ("DPA") is between **[Customer name]**, [Customer address] (the "Customer"), and **[Madison's legal entity]**, [address] ("Madison"). It forms part of the agreement under which the Customer buys Madison for its students, members or staff (the "Agreement"). ## 1. Roles 1.1 For personal data in accounts the Customer pays for, the Customer is the controller and Madison is the processor. 1.2 Each person keeps their own plan. Madison does not give the Customer access to the contents of anybody's plan; the Customer sees who holds a seat, and nothing else. 1.3 Where the Customer is an educational institution in the United States, Madison acts as a "school official" with a legitimate educational interest under FERPA (34 CFR ยง 99.31(a)(1)), under the Customer's direct control as to the use and maintenance of education records, and uses them only for the purposes in Annex 1. ## 2. Instructions 2.1 Madison processes personal data only to provide Madison as described in the Agreement and in Annex 1, and on the Customer's documented instructions, unless the law requires otherwise (in which case Madison will say so first, where the law allows). 2.2 Madison does not sell personal data, does not use it for advertising or to build profiles for advertising, and does not use it to train artificial intelligence models. Text sent to Anthropic's Claude to provide a feature is sent under Anthropic's commercial terms, which do not allow it to be used for training. ## 3. People 3.1 Everyone at Madison who can reach personal data is bound by confidentiality, and reaches it only to provide or support the service. ## 4. Security 4.1 Madison keeps the technical and organisational measures in Annex 2, and may improve them, never weaken them. ## 5. Sub-processors 5.1 The Customer authorises the sub-processors in Annex 3. 5.2 Madison will give at least 30 days' notice (by email to [Customer contact]) before adding or replacing one. The Customer may object on reasonable data protection grounds; the parties will then discuss it in good faith, and if they cannot agree the Customer may end the affected part of the Agreement with a pro-rata refund. 5.3 Madison imposes data protection terms on each sub-processor no less protective than this DPA, and remains responsible for them. ## 6. Requests from people 6.1 Each person can export their own plan and delete their own account from Settings at any time. Madison will help the Customer answer any other request from a data subject, as far as it reasonably can. ## 7. Breaches 7.1 Madison will tell the Customer without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting the Customer's data, with what is known and what is being done, and will update the Customer as more is known. ## 8. End of the Agreement 8.1 When the Agreement ends, seats end. Each person keeps their own account (it is theirs) unless the Customer instructs Madison to delete the accounts it created by invitation, which Madison will do within 30 days. Backups held by the database host expire within its retention window. ## 9. Audits 9.1 Madison will make available the information reasonably needed to show compliance with this DPA, and will answer a written security questionnaire once a year at no charge. ## 10. International transfers 10.1 Where personal data leaves the UK, the EEA or Switzerland, the parties rely on the European Commission's Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK Addendum, which are incorporated by reference. ## 11. Children 11.1 Madison is for people aged 13 and over and does not knowingly hold an account for anyone younger. The Customer will not invite anyone under 13. ## 12. General 12.1 This DPA is governed by the law of [governing law]. If it conflicts with the Agreement on data protection, this DPA wins. --- **Signed for the Customer:** ________________________ Name, title, date **Signed for Madison:** ________________________ Name, title, date --- ## Annex 1. The processing - **Data subjects:** the Customer's students, members or staff who accept a seat. - **Personal data:** email address; hashed password or a linked Google, Microsoft or Apple sign-in; passkey public keys; an authenticator app's sealed secret; the plan each person keeps (courses or projects, dated items, notes, grades they enter); billing records for the Customer (not for seat holders). - **Special categories:** none are asked for. A person may type anything into their own notes; Madison does not read or analyse it. - **Purpose:** to provide a personal planner and its features to each seat holder. - **Duration:** for the term of the Agreement, then as in section 8. ## Annex 2. Technical and organisational measures - Encryption in transit (TLS) everywhere; HSTS on every response. - Passwords stored only as scrypt hashes. Optional second step by authenticator app, with single-use recovery codes kept only as keyed hashes; passkeys (WebAuthn). - Sessions are signed, revocable one by one or all at once, and listed to their owner. - Calendar tokens and authenticator secrets sealed at rest with AES-256-GCM under keys derived per purpose. - Rate limits on sign-in, the second step, password resets and every endpoint that costs money or reaches a person. - Each plan readable only by its owner; organisation admins see seats, never plans. - No third-party analytics or advertising scripts. - Error reports carry the message, stack and path, never a name, an address or plan contents. - Scheduled jobs recorded and alerted on; a public status page with an incident log. - Deleting an account removes it and everything saved to it at once. ## Annex 3. Sub-processors | Sub-processor | Purpose | Location | When | | --- | --- | --- | --- | | Vercel | Hosting: serves the site and runs the server code | United States, with edge locations worldwide | Always | | Neon | The database | The region the deployment chose (United States by default) | Always | | Anthropic | Claude: reading syllabi and briefs, Ask Madison, the week planner, Focus study guides | United States | Only when switched on | | Resend | Email: confirming an address, resetting a password, the reminders you switch on | United States | Only when switched on | | Stripe | Payments | United States and Ireland | Only when switched on | | Cloudflare R2 | Storage for Madison Studio pictures | Region chosen by the deployment | Only when switched on | | Google | Two-way Google Calendar sync, and Sign in with Google | United States | Only when switched on | | Microsoft | Two-way Outlook sync, and Sign in with Microsoft | United States | Only when switched on | Questions about this DPA: hello@madisonplanner.app.