Data Processing Agreement
Effective Date: January 21, 2026
Version 1.0 | Last Updated: January 21, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Windsor Supply LLC d/b/a QuizMeBaby (“Processor”, “we”, “us”) and the entity agreeing to these terms (“Controller”, “you”) for the processing of personal data in connection with the QuizMeBaby services.
1. Definitions
“Data Protection Laws” means all applicable laws relating to data protection and privacy, including but not limited to the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and any other applicable data protection legislation.
“Personal Data” means any information relating to an identified or identifiable natural person as defined under applicable Data Protection Laws.
“Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
“Sub-processor” means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
“Data Subject” means the individual to whom the Personal Data relates.
2. Scope and Purpose of Processing
The Processor shall process Personal Data only for the following purposes:
- Providing the QuizMeBaby quiz creation and assessment services
- User account management and authentication
- Analytics and reporting on quiz performance
- Customer support and service improvement
- Compliance with legal obligations
Categories of Data Processed
- User identification data (name, email address)
- Educational data (quiz responses, scores, progress)
- Technical data (IP addresses, device information, usage logs)
- Content data (uploaded materials, generated quizzes)
Categories of Data Subjects
- Teachers and educators (Controller's employees/representatives)
- Students and quiz participants
- Administrative users
3. Controller and Processor Obligations
3.1 Controller Obligations
The Controller represents and warrants that:
- It has obtained all necessary consents and authorizations to share Personal Data with the Processor
- It has provided appropriate privacy notices to Data Subjects
- Its instructions to the Processor will comply with applicable Data Protection Laws
- It has implemented appropriate security measures on its end
3.2 Processor Obligations
The Processor agrees to:
- Process Personal Data only on documented instructions from the Controller
- Ensure personnel authorized to process Personal Data are bound by confidentiality obligations
- Implement appropriate technical and organizational security measures
- Assist the Controller in responding to Data Subject requests
- Delete or return Personal Data upon termination of services
- Make available information necessary to demonstrate compliance
- Allow for and contribute to audits conducted by the Controller
4. Security Measures
The Processor implements and maintains the following security measures:
Technical Measures
- Encryption of data in transit (TLS 1.2+)
- Encryption of data at rest (AES-256)
- Regular security assessments
- Access controls and authentication
- Intrusion detection systems
- Regular backups
Organizational Measures
- Employee training on data protection
- Confidentiality agreements
- Access logging and monitoring
- Incident response procedures
- Vendor management program
- Regular policy reviews
5. Sub-processors
The Controller authorizes the Processor to engage the following categories of Sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting and infrastructure | United States |
| Supabase Inc. | Database services | United States |
| Anthropic PBC | AI content generation | United States |
| Stripe Inc. | Payment processing | United States |
| Pusher Ltd. | Real-time communications | United Kingdom |
The Processor will notify the Controller of any intended changes to Sub-processors, giving the Controller the opportunity to object to such changes. The Controller may subscribe to Sub-processor change notifications by emailing privacy@windsor.supply.
6. International Data Transfers
Personal Data may be transferred to and processed in countries outside the European Economic Area (EEA) or the United Kingdom. When such transfers occur, the Processor ensures appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreement (IDTA) for UK transfers
- Supplementary measures where required by applicable law
A copy of the applicable transfer mechanisms is available upon request.
7. Data Subject Rights
The Processor will assist the Controller in responding to Data Subject requests to exercise their rights under applicable Data Protection Laws, including:
- Right of Access: Obtain confirmation and copies of Personal Data
- Right to Rectification: Correct inaccurate Personal Data
- Right to Erasure: Request deletion of Personal Data
- Right to Restriction: Limit processing of Personal Data
- Right to Data Portability: Receive Personal Data in machine-readable format
- Right to Object: Object to certain types of processing
The Processor will respond to Controller requests regarding Data Subject rights within 10 business days.
8. Data Breach Notification
In the event of a Personal Data breach, the Processor will:
- Notify the Controller without undue delay, and in any event within 48 hours of becoming aware of the breach
- Provide details of the nature of the breach, categories of data affected, and approximate number of Data Subjects concerned
- Describe the likely consequences of the breach
- Describe measures taken or proposed to address the breach
- Cooperate with the Controller in investigating and mitigating the breach
Breach Notification Contact
Report suspected data breaches immediately to: security@windsor.supply
9. Data Retention and Deletion
Upon termination of the services or upon the Controller's written request, the Processor will:
- Delete or return all Personal Data to the Controller within 30 days
- Delete existing copies unless storage is required by applicable law
- Provide written certification of deletion upon request
Standard data retention periods apply during the term of service:
- Active account data: Duration of account plus 90 days
- Quiz attempt data: 3 years from creation
- System logs: 12 months
- Backup data: 30 days rotation
10. Audit Rights
The Controller has the right to audit the Processor's compliance with this DPA:
- Upon reasonable notice (minimum 30 days)
- During normal business hours
- No more than once per 12-month period (unless a breach has occurred)
- At the Controller's expense
Alternatively, the Processor may provide:
- SOC 2 Type II audit reports (when available)
- Completed security questionnaires
- Evidence of certifications and compliance
11. Liability
Each party shall be liable for damages caused by processing that infringes applicable Data Protection Laws or this DPA, in accordance with the liability provisions of the Terms of Service.
The Processor shall not be liable for any damages to the extent they result from:
- Controller's failure to comply with its obligations under this DPA
- Controller's instructions that violate applicable Data Protection Laws
- Controller's failure to provide required notices or obtain necessary consents
12. Term and Termination
This DPA shall remain in effect for as long as the Processor processes Personal Data on behalf of the Controller. Upon termination of the underlying services, this DPA shall automatically terminate, subject to the data deletion obligations in Section 9.