# FixersTech School Data Processing Addendum (DPA) **Effective Date:** October 1, 2026 **Version:** 1.0.0 This Data Processing Addendum ("DPA") supplements the FixersTech School Terms of Service and applies where FixersTech processes personal data on behalf of an educational institution. ### 1. Roles and Scope - **Customer as Controller:** The School acts as the Data Controller, determining the purposes and lawful bases for entering student, parent, and staff records. - **FixersTech as Processor:** FixersTech acts as the Data Processor, processing personal data solely to provide the ERP services specified in the Terms and under the documented instructions of the School. ### 2. Processing Obligations FixersTech agrees to: - Process institutional data strictly in accordance with documented instructions from the Customer. - Ensure that personnel authorized to access customer data have committed to strict confidentiality obligations. - Implement robust technical and organizational security controls designed to prevent unauthorized disclosure, alteration, or loss. - Assist the Customer in responding to legitimate requests from data subjects (such as student record access or corrections) within reasonable technical capabilities. ### 3. Security Measures & Subprocessors We maintain industry-standard security controls including TLS encryption in transit, cryptographic password storage, database connection pooling, persistent backups, and isolated tenant queries. We maintain an up-to-date registry of authorized subprocessors (such as cloud hosting providers) and obligate them to equivalent data protection standards. ### 4. Incident Notification In the event of a verified security incident resulting in the unlawful destruction, loss, or unauthorized access to Customer personal data, FixersTech will notify the impacted School Administrator without undue delay and provide reasonable assistance in remediation.