← Back

Data Processing Agreement (DPA)

Last updated: 16 September 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Antonis Christodoulou, Cyprus ("the Processor") and the business using PayStamp ("the Controller"). It sets out how the Processor handles personal data on the Controller's behalf, in line with Article 28 of the GDPR.

1. Roles

The Controller (the Business) determines the purposes and means of processing the personal data of its students and their parents. The Processor (PayStamp) processes that data only on the Controller's documented instructions, which include these Terms and the normal use of the Service.

2. Subject matter and purpose

The Processor processes personal data solely to provide the PayStamp service: recording student enrolment and tracking confirmed cash payments, and optionally sending payment receipts on the Controller's behalf.

3. Categories of data and data subjects

  • Data subjects: students of the Business, and where recorded, their parents or guardians.
  • Categories of data: names, enrolment and lesson details, enrolment/paused months, confirmed payment records, unconfirmed notes from a parent that they have paid (amount, date and any reference given), a contact identifier for receipts (where used), and language preference.
  • No special-category data and no payment card or bank data are processed.

4. Processor obligations

The Processor shall:

  • Process personal data only on the Controller's instructions. Where the Processor is required by law to process the data otherwise, it will inform the Controller before doing so, unless that law prohibits such notice on important grounds of public interest.
  • Immediately inform the Controller if, in the Processor's opinion, an instruction infringes the GDPR or other applicable data protection law.
  • Ensure persons authorised to process the data are bound by confidentiality.
  • Implement appropriate technical and organisational security measures (see Section 6).
  • Not engage another sub-processor without the Controller's general authorisation (see Section 5).
  • Assist the Controller, as far as reasonably possible, in responding to data subject requests and in meeting its security, breach-notification and impact-assessment obligations.
  • On termination, delete or return the personal data at the Controller's choice. The Service's export function makes the Controller's records available at any time in spreadsheet form. Where deletion is chosen, or where no choice is made, the data is deleted within 30 days of the account closing, including from any backup copies, unless retention is required by law.
  • Make available all information needed to demonstrate compliance with Article 28, and allow for and contribute to audits and inspections carried out by the Controller or an auditor it mandates.

5. Sub-processors

The Controller authorises the Processor to use the following sub-processor:

  • Supabase — database hosting and authentication, hosted within the European Union (Frankfurt, Germany).

Any sub-processor is engaged under a contract imposing data protection obligations equivalent to those set out in this DPA. The Processor remains fully liable to the Controller for the performance of a sub-processor's obligations.

The Processor will inform the Controller of any intended change to sub-processors and give the Controller the opportunity to object.

6. Security measures

The Processor maintains measures including:

  • Encryption of data in transit (HTTPS/TLS).
  • Access controls that logically isolate each Controller's data from other Businesses.
  • Restricted administrative access to the underlying database.
  • EU-based hosting with a reputable infrastructure provider.
  • Regular review of access rules and security configuration.

7. Personal data breaches

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and provide information reasonably available to help the Controller meet its own notification obligations.

8. International transfers

Personal data is stored and processed within the European Union. The Processor will not transfer the data outside the EU/EEA without an appropriate safeguard under the GDPR and notice to the Controller.

9. Duration

This DPA applies for as long as the Processor processes personal data on the Controller's behalf under the Terms of Service.

10. If the Service is discontinued

If the Processor decides to stop operating PayStamp, it will give the Controller at least 30 days' written notice to the account's registered email address. During that period the Service's export function remains available so the Controller can take a copy of its records. Personal data is deleted within 30 days of the Service closing.

11. Governing law

This DPA is governed by the laws of the Republic of Cyprus.

Privacy Policy · Terms of Service