Legal and compliance
Data Processing Agreement
Effective 18 October 2026. This agreement forms part of the Qavona Terms of Service.
1. Roles and instructions
The school is the data controller for member and academic records. Qavona Technology acts as processor and processes personal data only to provide, secure, support, and improve the contracted school service, on the school's documented instructions and as required by law.
2. Covered data and people
Processing may include identity, contact, attendance, assessment, finance, communications, account-security, and audit data relating to students, parents, staff, applicants, and authorized school users. Schools must only upload information they are lawfully permitted to process.
3. Security and confidentiality
We maintain tenant isolation, access controls, encryption, audit logging, backups, incident response, and confidentiality obligations appropriate to the risk. The school remains responsible for role assignments, endpoint security, and the accuracy of its records.
4. Sub-processors and transfers
We may use vetted hosting, email, SMS, payment, monitoring, and support providers. They receive only the data required for their service and are bound by data-protection obligations. Material changes will be notified through the service where reasonably possible.
5. Assistance and incidents
We assist schools with data-subject requests, security assessments, breach response, exports, correction, restriction, and erasure to the extent applicable. Confirmed personal-data incidents are communicated without undue delay with available facts and remediation steps.
6. Return, deletion and recovery windows
Before termination, an authorized school administrator may request an export subject to identity and authority checks. A tenant deleted by a platform operator first enters a restricted 45-day recycle period and may be restored during that period. After the recycle deadline, active tenant data is purged or irreversibly anonymized. Encrypted backup copies age out under a separate controlled backup-retention schedule and are not restored as an active tenant except for documented disaster recovery or legal obligations. Financial, security, fraud-prevention, audit, and legal-hold evidence may be retained in minimized or pseudonymized form where required.
7. International transfers and sub-processors
Where a provider processes information outside the originating country, Qavona uses contractual, technical, and organizational safeguards appropriate to the transfer. Current service categories include hosting and storage, transactional email and SMS, monitoring, customer support, payment gateways, and optional AI services selected by the school. A school may contact us for material sub-processor information relevant to its deployment.
8. Audit and termination
Qavona provides reasonable information needed to demonstrate compliance and supports proportionate audits subject to confidentiality, security, and non-disruption controls. Processing ends when the service and applicable retention obligations end.
9. Contact
Privacy and data-processing enquiries may be sent to contact@qavona.com.