GestCampus
Sign in Request your proposal

Legal document

Data Processing Agreement (DPA)

Last updated: July 2026.

This Data Processing Agreement (hereinafter, the «DPA» or «Agreement») governs the relationship between the client engaging or using GestCampus services (hereinafter, the «Controller») and GestCampus (hereinafter, the «Processor») where the Controller uses the services to process personal data of third parties.

This DPA is signed electronically upon acceptance of the service terms and forms an integral part of them. It applies automatically and is deemed accepted when the Controller first enters a third party’s personal data into the tool.

1. Parties and definitions

On the one hand, the Data Controller is the client, whether a natural or legal person, who engages or uses GestCampus and uploads to the platform personal data of third parties over which it holds ownership or a legitimate interest in the processing.

On the other hand, the Data Processor is Tarraco App Lab, S.L.U. (in incorporation), owner of GestCampus (a registered trade mark owned by it), with registered office at C/ Pau Claris, 2 - 43005 Tarragona, Spain, and contact address privacidad@tarracoapplab.com.

The definitions in Article 4 of Regulation (EU) 2016/679 (GDPR) and in Spanish Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights (LOPDGDD) apply.

2. Subject matter, duration and nature of the processing

Subject matter. Processing by the Processor, on behalf of the Controller, of the personal data the Controller uploads to the GestCampus platform for the provision of the services engaged.

Duration. The duration of the processing coincides with the duration of the contractual service relationship, subject to any subsequent mandatory legal retention.

Nature. Automated processing on cloud infrastructure, with encryption in transit and at rest, in accordance with the technical and organisational measures described in clause 6.

Purpose. Solely the provision of the services engaged (hosting and management of the virtual campus, learner enrolment and tracking, assessment, issuing of certificates and the technical support requested by the Controller).

3. Categories of data and of data subjects

The categories of personal data processed and the data subjects affected vary according to how the Controller uses the platform. The most common are:

3.1. Learners

  • Data subjects: learners enrolled by the Controller.
  • Identification data: first name, surname, national ID number, email address and telephone.
  • Academic data: courses enrolled on, enrolment and withdrawal dates, progress, connection time, completed activities, grades and certificates issued.

3.2. Teaching and administrative staff

  • Data subjects: teaching and administrative staff registered by the Controller.
  • Identification and account data: name, email address, assigned role and session identifiers.

3.3. Evidence for funding bodies

  • Data subjects: learners on subsidised or publicly funded training.
  • Data: activity and completion records required by the funding body to evidence the training.

The Controller undertakes not to upload to the platform special categories of data (racial origin, health, ideology, sex life or orientation, genetic or biometric data) except where strictly necessary and with an appropriate legal basis, and to notify the Processor in advance so that the corresponding enhanced measures can be activated.

4. Obligations of the Processor (GestCampus)

The Processor undertakes to:

  • Process personal data only in accordance with the Controller’s documented instructions, including those relating to international transfers (which are deemed documented in the contract and in this DPA), unless required to do otherwise by Union or Member State law, in which case it will notify the Controller before processing, unless legally prohibited.
  • Ensure that personnel with access to the data have committed themselves to confidentiality, through a contractual undertaking and periodic training. The duty of confidentiality survives termination of the relationship.
  • Adopt the technical and organisational measures required by Art. 32 GDPR, as detailed in clause 6.
  • Not subcontract the processing to third parties without the Controller’s prior authorisation, whether general or specific. Signature of this DPA constitutes general authorisation for the sub-processors listed in clause 5, with the Controller retaining the right to object to the addition of new sub-processors.
  • Assist the Controller with appropriate technical and organisational measures in responding to data subjects’ rights (access, rectification, erasure, restriction, objection, portability). Where a data subject addresses a request to the Processor, it will be forwarded to the Controller within a maximum of 5 calendar days.
  • Assist the Controller in complying with its obligations under Arts. 32 to 36 GDPR (security, breaches, impact assessments and prior consultation).
  • Notify the Controller without undue delay and, in any event, within a maximum of 48 hours of becoming aware of any personal data breach. The notification will describe the nature of the breach, the data and categories of data subjects affected, the likely consequences and the measures taken or proposed.
  • Make available to the Controller, upon reasonable request and with at least 4 weeks’ notice, all information necessary to demonstrate compliance with Art. 28 GDPR, and allow audits once a year, during business hours and in a manner that does not interrupt service provision. For audits of technical measures, an independent auditor’s report (ISO 27001, SOC 2 or equivalent) may be provided if current.
  • Return or delete, at the Controller’s choice, all personal data once the service has ended, except for copies strictly required by applicable law (taxation, limitation of actions). Return will be made in a structured, commonly used format (CSV, JSON) and deletion will be documented in writing. The maximum period from termination of the contract is 90 calendar days.

5. Authorised sub-processors

The Controller grants the Processor general authorisation to use the following sub-processors, all bound by a GDPR-compatible contract:

  • Netlify Inc. — site hosting, serverless functions and temporary custody of access codes. Location: United States. Safeguards: standard contractual clauses (SCC) + supplementary measures.
  • Brevo (Sendinblue SAS) — delivery of access emails and campus notifications. Location: France (EEA).

The Processor will give the Controller at least 30 calendar days’ notice of any addition or replacement of a sub-processor. The Controller may object on reasoned grounds within that period and, if the objection is reasonable, the Processor must offer an alternative or the Controller may terminate the contract without penalty.

6. Technical and organisational measures (Art. 32 GDPR)

6.1. Encryption

  • TLS 1.2/1.3 mandatory on all communications. HSTS enabled.
  • AES-256 at rest for the storage bucket and the PostgreSQL database.
  • Passwords hashed with bcrypt or equivalent.

6.2. Access control

  • Row-Level Security in the database: each user can only access their own data.
  • Rotatable and revocable API keys. Session tokens with expiry.
  • Administrative access by the Processor with mandatory multi-factor authentication.
  • Least-privilege principle for all administrative access.

6.3. Resilience and availability

  • Automatic backups with 7 to 30 days’ retention depending on plan.
  • Infrastructure with the cloud provider’s availability SLA.
  • Basic continuity plan with recovery time objective (RTO) <24h and recovery point objective (RPO) <24h.

6.4. Staff confidentiality

  • Perpetual confidentiality undertaking signed by anyone with access to systems.
  • Periodic training in data protection and security.
  • Revocation of access upon termination of the employment relationship.

6.5. Verification and auditing

  • Periodic review of logs and dependencies (lockfiles, vulnerability alerts).
  • Penetration testing whenever a new critical component is introduced.
  • Internal register of incidents and breaches with analysis and corrective measures.

7. International transfers

Where a sub-processor is located outside the EEA, the Processor will apply the safeguards provided for in Chapter V GDPR: in particular, the standard contractual clauses approved by the European Commission in Decision 2021/914, supplemented by the additional measures derived from the impact assessment (Schrems II judgment). The Processor will make available to the Controller a copy of the safeguards applied to any international transfer, upon reasonable request.

8. Security breach — detailed procedure

In the event of a breach affecting the Controller’s personal data:

  1. The Processor will make an internal record of the incident with a detection timestamp.
  2. Within a maximum of 48 hours it will notify the Controller by email at the designated contact, with a full description of the incident.
  3. The Processor will immediately adopt reasonable corrective measures and keep the Controller informed of developments.
  4. The Controller will decide whether notification to the AEPD (Art. 33 GDPR) and to data subjects (Art. 34 GDPR) is appropriate. The Processor will provide technical and documentary assistance for that notification.
  5. Following resolution, both parties will document the lessons learned and any additional measures adopted.

9. Audit

The Controller may audit compliance with this DPA once a year, with at least 4 weeks’ prior written notice, during business hours and without interrupting service provision. To minimise the impact, the Processor may offer the Controller a current external audit report (ISO 27001, SOC 2 or equivalent). The costs of the audit are borne by the Controller, unless the audit reveals material breaches by the Processor, in which case the Processor will bear them.

10. Liability and financial arrangements

Each party is liable for damage arising from a breach of its obligations, in accordance with Art. 82 GDPR and other applicable legislation. The limitation of liability and indemnity regime is governed by the general terms of service. The Processor will maintain professional civil liability insurance appropriate to the volume of the service.

11. Duration and termination

This DPA remains in force for as long as the Controller’s contractual relationship with GestCampus for the processing of third-party personal data continues. Termination of the main contract entails termination of the DPA, without prejudice to obligations that by their nature survive (perpetual staff confidentiality, legal data retention).

12. Changes

The Processor may modify this DPA where required by a change in legislation or a substantial improvement in security measures. Changes will be published on this page with the revision date and notified to the Controller with reasonable notice. The Controller may object on reasoned grounds; if the objection is not resolved by agreement, it may terminate the contract without penalty.

13. Applicable law and jurisdiction

This DPA is governed by Spanish law (GDPR, LOPDGDD and other applicable legislation). The parties submit, expressly waiving any other jurisdiction, to the competent Courts and Tribunals of Spain in accordance with the applicable procedural rules.

Last updated: July 2026.