Data Processing Agreement

Status of this document

Where an Institution has its own required data protection addendum, we would rather read it than insist on ours. Send it with the same message.

Definitions

Data Protection Law means every law about personal data that applies to the processing under this DPA, including as applicable the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, US state privacy statutes, the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), the Protection of Pupil Rights Amendment, and state student-privacy statutes.

Institution Personal Data means personal data within Institution Data that Sillion processes on the Institution's behalf under the Order.

Data Subject, controller, processor, processing, and personal data breach carry the meanings given in the GDPR. Subprocessor means a processor engaged by Sillion to process Institution Personal Data.

Terms defined in the Terms of Service — Service, Institution, Authorised User, Institution Data, Order — carry the same meaning here.

Roles of the parties

For Institution Personal Data, the Institution is the controller and Sillion is the processor. Where the Institution is itself a processor for a third party, Sillion is a subprocessor and this DPA applies as if references to the controller were to that third party.

Under FERPA, Sillion acts as a school official with a legitimate educational interest in the education records it processes, under the Institution's direct control, and does not redisclose those records except as this DPA permits or the law requires.

Each party complies with the Data Protection Law that applies to it. The Institution is responsible for the lawfulness of the instructions it gives and for having a basis to provide the data.

Processing instructions

Sillion processes Institution Personal Data only on the Institution's documented instructions, including as to international transfers, unless required to do otherwise by law that applies to Sillion. Where such a law applies, Sillion will tell the Institution before processing, unless the law forbids telling it on important grounds of public interest.

The Order, this DPA, the Institution's configuration of the Service, and instructions given through an administrator account together make up the documented instructions. Sillion will tell the Institution if, in its opinion, an instruction infringes Data Protection Law.

Purpose limitation and AI training

Sillion processes Institution Personal Data solely to provide, maintain, and secure the Service for the Institution, and for no other purpose.

Sillion does not:

• sell Institution Personal Data;
• use it for targeted advertising, or disclose it to anyone for that purpose;
• use it to build a commercial profile of a student outside the educational purpose;
• use it to train, fine-tune, or otherwise improve general-purpose models for the benefit of other customers, without the Institution's separate written agreement.

Processing a student's question through a model in order to answer it is part of providing the Service. Retaining that content afterwards to improve a model is not, and does not happen by default. Where the Institution does opt in to model improvement, the scope, the data, and the safeguards are set out in that written agreement.

Sillion may generate and use aggregated, de-identified data about Service usage, provided the data cannot reasonably be used to re-identify a person or an Institution and Sillion does not attempt to re-identify it.

Personnel and confidentiality

Sillion limits access to Institution Personal Data to personnel who need it to provide the Service. Those personnel are bound by written confidentiality obligations or an appropriate statutory duty, which survive the end of their engagement.

Sillion takes reasonable steps to ensure those personnel understand what they may do with the data and are trained on the handling obligations that apply to it.

Security

Sillion implements appropriate technical and organisational measures to protect Institution Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, taking account of the state of the art, the cost of implementation, and the risk to data subjects. The measures in force are described in Annex II.

Security measures change. Sillion may update them, provided the level of protection is not reduced. Material changes are reflected in Annex II.

Subprocessors

The Institution gives general authorisation for Sillion to engage subprocessors. Those authorised at the effective date of the Order are listed in Annex III to that Order.

Sillion imposes on each subprocessor, by written contract, data protection obligations no less protective than those in this DPA, and remains liable to the Institution for a subprocessor's performance as it would be for its own.

Sillion gives the Institution notice before a new subprocessor starts processing Institution Personal Data, on the notice period stated in the Order. The Institution may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Institution may terminate the affected part of the Service on the terms in the Order.

The public subprocessors page covers providers used by the Sillion website. It is not the institutional annex, and Annex III governs for an Institution.

Assistance with data subject rights

Taking account of the nature of the processing, Sillion assists the Institution with appropriate technical and organisational measures, so far as possible, in responding to requests to exercise rights of access, rectification, erasure, restriction, portability, and objection, and rights relating to automated decision-making.

Where Sillion receives such a request directly from a data subject in respect of Institution Personal Data, it will not respond to the substance itself. It will tell the requester to contact the Institution, and pass the request on promptly.

Parent and eligible-student rights under FERPA — inspection, review, and a hearing to amend an education record — are exercised with the Institution. Sillion supports the Institution in meeting them.

Other assistance to the Institution

Taking account of the nature of the processing and the information available to it, Sillion assists the Institution in meeting its obligations relating to security of processing, breach notification to a supervisory authority and to data subjects, data protection impact assessments, and prior consultation with a supervisory authority.

Where an Institution's request goes materially beyond what is needed to meet those obligations, the parties will agree reasonable charges before the work is done.

Security incidents

Sillion notifies the Institution without undue delay after becoming aware of a personal data breach affecting Institution Personal Data. Where the Order states a fixed outer limit, that limit applies.

The notification will describe, so far as it is known:

• the nature of the breach and the categories and rough numbers of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed to address it and mitigate its effects;
• a point of contact for further information.

Where not all of that is available at once, Sillion provides it in phases without undue further delay, and cooperates with the Institution in its own investigation and in any notification the Institution decides to make. Sillion does not notify a supervisory authority or data subjects on the Institution's behalf unless the Institution asks it to or the law requires it.

Return and deletion

On the Institution's request during the term, Sillion makes Institution Personal Data available for export in a structured, commonly used, machine-readable format.

On termination, Sillion deletes Institution Personal Data, or returns it and then deletes existing copies, at the Institution's choice, within the period stated in the Order — except to the extent law requires it to be kept, in which case Sillion keeps only what is required, for as long as it is required, and continues to protect it under this DPA.

Backups are deleted on their ordinary retention cycle. Until that cycle completes, data in backup remains subject to this DPA and is not restored into the live Service except to recover from a failure.

Information and audit

Sillion makes available to the Institution the information reasonably necessary to demonstrate compliance with this DPA, and allows for and contributes to audits, including inspections, conducted by the Institution or an auditor it mandates.

Audits are on reasonable prior written notice, during business hours, no more than once a year unless a personal data breach or a supervisory authority requires otherwise, and subject to confidentiality. Sillion may satisfy an audit request by providing documentation and answering questions in writing where that is enough for the Institution's purpose.

Sillion does not currently hold a completed third-party security certification or audit report. Where that changes, this section and Annex II will say so, and the report will be made available under confidentiality in place of an on-site inspection. Until then, Institutions should assume the answer to “may we see your SOC 2?” is that there is not one yet.

International transfers

Sillion and its subprocessors operate infrastructure in more than one country, so Institution Personal Data may be processed outside the country where it was collected.

Where a transfer is subject to the GDPR or UK GDPR and the destination is not covered by an adequacy decision, the parties rely on an appropriate safeguard under Chapter V — ordinarily the European Commission's Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies. The module, the annexes, and the docking arrangements are completed in the Order.

Where the Institution requires processing to be confined to a particular region, that requirement is agreed in the Order after we confirm what our providers can support. This page does not state a processing region, because the honest answer depends on the deployment.

Education-specific terms

Sillion processes education records only as the Institution directs and does not redisclose them except as this DPA permits, as the Institution instructs, or as the law requires.

Where the Service is made available to children under 13, Sillion relies on the Institution to provide consent on parents' behalf for the educational purpose, as COPPA permits, and limits its use of the data accordingly. Sillion does not condition a child's participation on disclosing more personal information than is reasonably necessary.

Sillion supports the Institution in meeting notice, consent, and transparency obligations under state student-privacy statutes, and will enter a state-specific addendum where one is required.

Teacher oversight is a design commitment as well as a contractual one: the Service drafts assessments for review and does not deliver a grade to a student without a person approving it.

Liability and precedence

Each party's liability under this DPA is subject to the exclusions and limits in the Order. Nothing here limits a data subject's rights under Data Protection Law, or either party's liability to a supervisory authority.

Where documents conflict on data protection, this is the order:

1. Standard Contractual Clauses or another Chapter V safeguard;
2. any state-specific or Institution-required addendum;
3. this DPA;
4. the Order;
5. the Terms of Service.

Annex I — Details of processing

Subject matter and duration

Provision of the Service under the Order, for the term of the Order and any agreed period afterwards for return or deletion.

Nature and purpose

Hosting, storage, transmission, and analysis of Institution Data in order to provide AI tutoring grounded in the Institution's course material, produce teacher-facing insight into student progress, and draft assessments for teacher review.

Categories of data subjects

• Students enrolled in courses the Institution connects;
• Teachers and teaching staff;
• Administrators and other staff the Institution authorises.

Categories of personal data

• Identifiers: name, institutional email address, student or staff identifier;
• Roster and enrolment data: course, section, role;
• Educational content: submitted work, assignments, and course material where it identifies a person;
• Interaction data: conversations with the tutor and the derived progress signals shown to a teacher;
• Assessment data: draft and approved grades and feedback;
• Technical data: log and access records generated by use of the Service.

Special categories

The Service is not designed to process special category data, and the Institution should not configure it to send any. Where a student volunteers such information in a conversation, it is processed as part of that content under the same protections; the Order records any additional safeguards the Institution requires.

Frequency

Continuous, for the duration of the Order.

Annex II — Security measures

Encryption

Data in transit is protected with TLS. Data at rest is encrypted by the managed database and storage services Sillion uses, under those providers' encryption-at-rest implementations.

Access control

Access to production systems and to Institution Personal Data is limited to personnel who need it, granted on the principle of least privilege, and removed when a person's role changes or ends. Administrative access to the Service is controlled by the Institution for its own users.

Segregation

The Service separates each Institution's data logically, so that one Institution's users cannot reach another's.

Infrastructure

Sillion runs on managed cloud infrastructure and inherits the physical security, network security, and availability controls those providers operate. Provider certifications belong to the provider and are published by them; Sillion does not present them as its own.

Resilience

Managed database backups are taken by the hosting provider on its standard schedule, and restoration is available through it.

Logging

Access to production infrastructure is logged, and application and request logs are retained for operational and security purposes.

Change management

Changes to the Service go through version control and review before release.

Vendor management

Providers are reviewed before they receive Institution Personal Data, and engaged under written terms that include data protection obligations.

Annex III — Subprocessors

The authorised subprocessors for a given Institution are listed in the Annex III attached to its Order, which is specific to the services being provided and is the operative list for that Institution.

For reference, the providers behind the Sillion website and waitlist are:

Request the current institutional Annex III at hello@sillion.app.