Data Processing Terms

These terms form part of the Terms of Use for every teacher who creates student accounts. A school that wants a signed copy can ask at privacy@yourworksheets.com.

1. Roles

• Controller: the teacher, or the school or institution the teacher acts for, who decides which students get accounts, what is entered and why.
• Processor: YourWorksheets, which handles that data only on the controller’s behalf.

Under Türkiye’s KVKK this is the relationship between veri sorumlusu and veri işleyen (article 12); under the GDPR it is the one described in article 28.

2. What is processed

Sensitive data — health, religion, ethnicity, biometrics and the like — must not be entered.

3. Our commitments

We:

1. process student data only on the controller’s documented instructions — these terms and the way the controller uses the service — and only for the purpose above;
2. never sell student data, never use it for advertising, never build profiles of students for any other purpose, and never use it to train AI models;
3. make sure everyone who can access it is bound by confidentiality;
4. keep it secure with the measures in Annex 1;
5. use only the sub-processors listed on the sub-processors page (those marked as handling student data), bind them to the same obligations, and give at least 30 days’ notice there before adding one — the controller may object;
6. help the controller answer requests from students and parents, and with security and impact assessments;
7. tell the controller without undue delay — our target is within 24 hours — after we become aware of a breach affecting their students’ data, with what we know and what we are doing;
8. delete the data when the controller removes the student or the class or deletes their account — messages 90 days later — and let the controller download their data before that;
9. give the controller the information needed to show these terms are kept, and answer reasonable questions about them.

4. The controller’s commitments

The teacher or school:

• has authority to create the accounts and a lawful basis for the processing;
• informs parents or guardians as the law and the school require (parent letter);
• enters only the minimum — a first name or nickname — and no sensitive data;
• keeps login cards private and removes students who leave.

5. Transfers abroad

Our providers are mainly in the United States. Transfers rely on the safeguards described on the sub-processors page; for Türkiye, the standard contracts announced by the Personal Data Protection Board are being put in place, and their status is shown there.

6. Schools in the United States

Where the controller is a US school, we act as a “school official” with a legitimate educational interest under FERPA: we are under the school’s direct control as to the use and maintenance of the records, use them only for the purposes the school authorised, and do not re-disclose them except as the school directs or the law requires. We collect student data only for the school’s educational purposes, with the school acting for parents as permitted under COPPA, and never for commercial purposes. A state student-privacy agreement can be requested at privacy@yourworksheets.com.

Annex 1 — Security measures

• Access rules enforced by Google’s Firestore and Cloud Storage: a student can read only their own records and the worksheets assigned to them; a teacher can read only their own classes.
• Student accounts and their records can be changed only by our server, never directly by a browser.
• Passwords are handled by Firebase Authentication and stored only as hashes; a forgotten password is replaced, never revealed.
• All traffic over HTTPS; server keys kept off the client; requests checked by App Check and rate limits.
• Students cannot message each other or anyone outside their teacher; messages are plain text and cannot be deleted by either side, so the record survives.
• No advertising, no analytics and no optional cookies on students’ pages.