Data processing agreement

Version: DPA-2026-10-05 · Effective from: 5 October 2026

Summary for the school

• When teachers at your school use Paidoria with pupils, the school decides about the pupils’ data — it is the controller. Paidoria processes the data only for the school and on its instructions — it is the processor.
• With the result of a task sent by link we store about a pupil only what the pupil types: a first name or nickname, the class and the result. Pupils have no accounts, no lists of pupils are entered and we collect no health data.
• Task results are deleted automatically after 13 months. The teacher can delete them at any time before that and download them as a table.
• The database is in the European Union (Frankfurt am Main). We use three providers — Supabase, Cloudflare and Websupport; they are listed in Annex 3.
• We do not sell the names and results of individual pupils and do not use them for advertising, for profiling or for our own purposes. For our own statistics we only compute summary counts without names from them (point 5.7).
• The agreement is free of charge, it is concluded electronically and the school can end it at any time.

The summary does not replace the agreement — the text below is what binds.

1. Parties

1.1. The School — the school or school facility named in the school registration request in the Paidoria app. If the school has no legal personality of its own, the party to the agreement is its founding authority, on whose behalf the person accepting the agreement acts. In this agreement the School is the controller (Article 4(7) GDPR).

1.2. Paidoria — Vyskilluj s. r. o., Ulica Veterná 8760/43, 917 01 Trnava, Slovak Republic, Company ID 53388178, Tax ID 2121360032, registered in the Commercial Register of the District Court Trnava, Section Sro, Insert No. 47906/T, e-mail info@paidoria.com, telephone +421 908 023 050. In this agreement Paidoria is the processor (Article 4(8) GDPR).

1.3. GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council. The terms “personal data”, “processing”, “data subject” and “personal data breach” have the meaning given in Article 4 GDPR.

1.4. The School’s point of contact is the e-mail address of the contact person given in the school registration request; the School can change it by a notice to info@paidoria.com. Paidoria’s point of contact is info@paidoria.com. The parties send notices under this agreement by e-mail to these addresses.

2. Subject-matter and duration of the processing

2.1. The agreement governs the processing of personal data that takes place when the School’s teachers use the Paidoria app at https://app.paidoria.com — in lessons and when setting tasks for pupils.

2.2. Paidoria processes the data for as long as the School uses the app. The agreement is concluded for an indefinite period and ends as set out in Article 15. Individual data are deleted within the periods given in Annex 1 even while the agreement lasts.

2.3. Paidoria charges no fee for performing its obligations under this agreement.

3. Nature and purpose of the processing

3.1. Purpose: to enable the School to use Paidoria in teaching — to keep classes, to set pupils tasks made of cards and questions and to see their results.

3.2. Nature: the data are processed by automated means in the app. The pupil enters them when opening a task; Paidoria stores them, counts the correct answers to questions, shows the result to the teacher who set the task, lets the teacher download the results as a table and delete them, computes summary counts without pupils’ names from them (point 5.7), and deletes them once the retention period has passed.

3.3. The app keeps no accounts or profiles of pupils, does not profile them and takes no decisions about them. A grade or any other assessment of a pupil is always decided by the teacher.

4. Types of personal data and categories of data subjects

4.1. The data subjects are the School’s pupils (children) and the School’s teachers. The following data are processed:

• Pupils — the first name or nickname the pupil types when doing a task, the class, the date and time of submission and the result of the task (for questions: the number of questions, the number of correct answers, the number of attempts and the answers to the individual questions; for cards: the number of cards completed).
• Teachers — the classes they have created (name and number of pupils, without names) and the tasks and card sets they have put together (titles, questions, answers, texts and pictures), including which teacher they belong to.

4.2. Special categories of data (for example data concerning health) are not processed under this agreement. The app does not collect them and the School does not enter them into it.

4.3. A detailed list of the data, purposes and retention periods is in Annex 1.

4.4. What is outside this agreement. For the following processing Paidoria is the controller and the Privacy policy applies; we store a pupil’s name with none of it:

• the teacher’s account — e-mail address, password, language, the school the teacher belongs to, the record of the terms confirmed, the days on which the account was active and the answers from the voluntary questionnaire; the teacher creates the account personally and has a contract of their own with Paidoria (the terms and conditions);
• the school registration request, the registration codes for teachers and the record of acceptance of this agreement (Article 17);
• protection against misuse — the “I am not a robot” check when a teacher signs in and the records of attempts to check a registration code;
• statistics without pupils’ names — a record that a class finished an activity in a lesson (class, teacher, kind of activity, content, number of exercises and exercise time), Paidoria’s own statistics from the summary counts under point 5.7, pseudonymous analytics if the teacher has consented to it, and anonymous counts of story starts;
• technical crash reports of the app — the error text and the place in the app, without a name, without the content of forms and without the task link;
• the optional activity rating — stars and two short text answers (what the pupil liked and an idea for another topic) a pupil may give at the end of a task; it is stored with the identification of the task and the time, without the pupil’s name, only Paidoria receives it and it is used to improve the content.

5. Instructions of the School

5.1. Paidoria processes the personal data only on documented instructions from the School (Article 28(3)(a) GDPR). The instructions are:

• this agreement and its annexes;
• what the School’s teachers do in the app — for example creating a class, setting a task, closing it or deleting a result;
• further instructions the School sends by e-mail to info@paidoria.com.

5.2. Paidoria does not use the data processed for the School for its own purposes, for advertising or for profiling, does not sell them and does not disclose them to anyone except the sub-processors under Article 9. The only exception is the summary counts without pupils’ names under point 5.7. The use of teacher-created content under point 16.3 does not concern personal data and is not affected by this point.

5.3. If the law of the European Union or of the Slovak Republic required Paidoria to process the data beyond the instructions, Paidoria will inform the School before the processing — unless that law prohibits such information on important grounds of public interest.

5.4. If Paidoria believes that an instruction of the School infringes the GDPR or another data protection provision, it will inform the School immediately.

5.5. If the app is technically unable to carry out an instruction of the School, Paidoria will tell the School and the parties will agree on another solution; the School can end the agreement at any time (Article 15).

5.6. Supervision of teachers’ content. The School instructs Paidoria to supervise the content created by the School’s teachers to the extent needed to protect children and keep the service safe. Paidoria’s administrator can therefore view teachers’ tasks and card sets (together with the teacher’s name and e-mail address and the school) and download their content as a table, remove content that breaks the law or the terms and conditions of the service, and block a teacher from creating further content. Pupils’ results are not shown to the administrator in the app. Paidoria informs the School by e-mail, without undue delay, of any removal of content or block and states the reason. Removing a task also deletes its results; Paidoria therefore saves them before the removal, hands them over to the School as a table on request and deletes the saved copy after 30 days.

5.7. Summary counts. The School instructs Paidoria to compute summary counts without pupils’ names from the task results — the number of tasks submitted, cards completed, questions and correct answers and the time of the last activity, in total per school, per teacher and per task. They give an overview of how the School uses Paidoria; Paidoria provides it to the School on request. The School also agrees that Paidoria uses these summary counts for its own statistics on the use of the service and for deciding what content to create next; for that use Paidoria is the controller (point 4.4). The summary counts contain neither a pupil’s name nor a pupil’s answers, and without the School’s consent Paidoria will not publish them in a form from which the school or a teacher could be identified.

6. Rights and obligations of the School

6.1. The School decides whether and how its teachers use Paidoria with pupils. It has the right to give Paidoria instructions, to request information and audits (Article 14), to object to a new sub-processor (Article 9), to request the deletion or return of the data and to end the agreement at any time (Article 15).

6.2. The School is responsible for having a legal basis for processing the pupils’ data and for having informed the pupils and their legal guardians about the processing. Paidoria helps by showing a short notice and a link to the privacy policy where the pupil enters a name in a task.

6.3. The School instructs its teachers:

• to ask pupils only for a first name or a nickname — a full name is not needed;
• not to put pupils’ personal data (names, photographs), health data or other sensitive data into class names, questions, answers, card texts or pictures;
• to send the task link only to the pupils the task is meant for — whoever has the link can open the task and submit it;
• to tell pupils that the optional rating at the end of a task (stars and a short text) goes to Paidoria, not to the teacher, and that they should not write their name or other personal data in it;
• not to share their registration code or sign-in details with anyone and to sign out after working on a shared device.

6.4. The School informs Paidoria without undue delay of a change of the contact person and of a teacher having left the School whose access is to be removed.

7. Confidentiality

7.1. Paidoria ensures that every person who has access at Paidoria to the data processed for the School has committed to confidentiality or is under a statutory obligation of confidentiality (Article 28(3)(b) GDPR). The confidentiality continues after that person stops working for Paidoria and after this agreement ends.

7.2. Only persons who need access to run and support the service have access to the data, and they process them only on the School’s instructions (Article 29 GDPR).

8. Security of processing

8.1. Paidoria has taken and maintains technical and organisational measures under Article 32 GDPR (Article 28(3)(c) GDPR). They are described in Annex 2, which lists only measures that are really in place and says openly what is not in place.

8.2. Paidoria may change and improve the measures but must not lower the level of protection. After a change it updates the description in Annex 2 and states the day as at which it applies.

9. Sub-processors

9.1. The School gives Paidoria a general written authorisation to engage other processors (sub-processors) in the processing (Article 28(2) GDPR). Those Paidoria uses on the day this version takes effect are listed in Annex 3, and by accepting the agreement the School agrees to them. The authorisation also covers the providers these sub-processors themselves engage according to their published lists (linked in Annex 3). Paidoria follows the changes to these lists; it informs the School of a change that concerns the School’s data without undue delay after learning of it, and the School can object under point 9.3.

9.2. Paidoria informs the School by e-mail of an intended addition or replacement of a sub-processor at least 14 days in advance and updates Annex 3 at the same time. A shorter period is possible only where the change is required by an urgent security reason or by a provider’s outage and the service could not run safely without it: Paidoria then gives notice as soon as it decides on the change — at least 5 working days in advance where possible, and always before the new provider starts processing the School’s data — and states the reason.

9.3. The School can object to the change by e-mail until the day on which the change is to take place; where the change was notified in the shorter period under point 9.2, within 14 days of the notice — even if the change has taken place in the meantime. Paidoria will try to accommodate the objection. If that is not possible, the School can end the agreement; in that case Paidoria deletes or returns the School’s data (Article 15) before the new sub-processor starts processing them and, if it is already processing them, without undue delay and within 14 days of the end of the agreement at the latest, and has them deleted at that sub-processor as well.

9.4. Paidoria imposes on every sub-processor, by contract, the same data protection obligations as it has itself under this agreement, in particular the obligation to provide sufficient guarantees of appropriate technical and organisational measures (Article 28(4) GDPR).

9.5. If a sub-processor fails to fulfil its data protection obligations, Paidoria remains fully liable to the School for the performance of those obligations.

10. Transfers outside the European Economic Area

10.1. Pupils’ results, classes and tasks are stored in a database in the European Union — in a data centre in Frankfurt am Main (Germany). The pictures for cards are stored in Cloudflare’s storage. Paidoria does not deliberately transfer the School’s data to countries outside the European Economic Area (EEA) and will not store them there without the School’s instruction. E-mail communication with the School passes through a mailbox at Websupport (Slovakia); under its general terms and conditions the data are processed in EU and EEA countries and may be transferred to a third country only on the basis of an adequacy decision of the European Commission or appropriate safeguards.

10.2. Two sub-processors, however, are established outside the EEA: Supabase (Singapore) and Cloudflare (USA). Cloudflare delivers the app and files through a worldwide network — a request is normally handled by the data centre nearest to the user — and may also process operational data (such as IP addresses) in the USA. Staff of both companies may have access to the data from countries outside the EEA for maintenance and support. It therefore cannot be ruled out that a transfer to a third country takes place.

10.3. Such a transfer is covered by the safeguards of Chapter V GDPR: for Cloudflare, the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795; Article 45 GDPR) and standard contractual clauses; for Supabase, the standard contractual clauses adopted by the Commission (Implementing Decision (EU) 2021/914; Article 46(2)(c) GDPR). By accepting the agreement the School instructs the transfer to this extent.

10.4. Paidoria will carry out any other transfer to a third country only on a documented instruction from the School and where the conditions of Chapter V GDPR are met.

11. Requests from data subjects

11.1. Paidoria assists the School in fulfilling its obligation to respond to requests from pupils and their legal guardians to exercise the rights laid down in Chapter III GDPR (Article 28(3)(e) GDPR). The app gives the teacher these tools:

• access and portability — the teacher sees all results for their tasks and can download them as a table (a CSV file);
• erasure — the teacher can delete a single result or several at once; deleting a task also deletes its results;
• restriction — the teacher can close a task or replace its link, so that the old link stops working.

11.2. What the app does not let the teacher do (for example correcting the name in a result already submitted) Paidoria does on the School’s instruction without undue delay, within 21 days of receiving the instruction at the latest.

11.3. If a data subject turns directly to Paidoria with a request concerning the School’s data, Paidoria forwards the request to the School without undue delay, tells the person that the matter belongs to the School, and does not decide on the request itself.

12. Personal data breaches

12.1. If Paidoria becomes aware of a personal data breach affecting the School’s data, it notifies the School without undue delay (Article 33(2) GDPR), within 72 hours of becoming aware of it at the latest, by e-mail to the School’s point of contact.

12.2. The notification says what Paidoria knows: what happened, which data and approximately how many persons and records are concerned, what consequences can be expected, what measures it has taken or proposes and whom the School can contact. What it does not yet know it adds without further undue delay.

12.3. Paidoria documents the breach, takes remedial measures immediately and helps the School to meet its obligations towards the supervisory authority and the data subjects (Articles 33 and 34 GDPR). It does not notify the supervisory authority or the data subjects on the School’s behalf unless the parties agree otherwise.

13. Further assistance

13.1. Paidoria assists the School in ensuring compliance with the obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it (Article 28(3)(f) GDPR) — in particular it provides material on the security of processing, for a data protection impact assessment and for any prior consultation with the supervisory authority.

13.2. If a supervisory authority or another public authority asks Paidoria to disclose the School’s data, Paidoria informs the School immediately, unless the law prohibits it.

14. Demonstrating compliance and audits

14.1. Paidoria makes available to the School all information necessary to demonstrate compliance with the obligations under Article 28 GDPR and this agreement, and allows for and contributes to audits, including inspections, conducted by the School or by an auditor mandated by the School (Article 28(3)(h) GDPR).

14.2. So that an audit is proportionate to the scale of the processing, the procedure is as follows:

• in writing — Paidoria answers the School’s questions without undue delay, within 30 days at the latest, and supports the answers with the documents it has; if the School states a statutory deadline it has to meet itself (for example for a data subject’s request or a request from the supervisory authority), Paidoria answers as a priority, within 21 days at the latest;
• remotely or in person — if written material is not enough, Paidoria allows an inspection by video call or at its registered office; the date is agreed at least 14 days in advance, and the inspection takes place during working hours and without access to other schools’ data.

14.3. The data are stored in the data centres of the sub-processors. Paidoria arranges audits there to the extent its contracts with them allow, and gives the School the documents these providers make available about their security.

14.4. The School carries out a remote or on-site inspection no more than once in 12 months; more often if a personal data breach has occurred or if the supervisory authority requires it. The School can ask questions and request information at any time. An auditor mandated by the School must be bound by confidentiality. Each party bears its own costs.

15. Term, termination, deletion and return of data

15.1. The School can end the agreement at any time, without giving a reason, by a notice to info@paidoria.com. The agreement ends on the day the notice is received or on a later day the School states in the notice.

15.2. Paidoria can terminate the agreement by a notice to the School with a notice period of two months. It can end it without a notice period if the School or its teachers seriously breach the terms and conditions of the service or if continuing the processing would be contrary to the law.

15.3. When the agreement ends, the use of Paidoria by the School’s teachers in their work with pupils ends; Paidoria removes the access of the School’s teachers to the teacher part of the app.

15.4. Within 60 days of the end of the agreement Paidoria, at the choice of the School, deletes all personal data processed for the School or returns them to the School, and deletes existing copies (Article 28(3)(g) GDPR). This covers the task results, classes, tasks and card sets of the School’s teachers, including pictures. Content that Paidoria has taken over under point 16.3 (without personal data) is kept. If the School does not say by the end of the agreement what it wishes, Paidoria deletes the data.

15.5. Returning the data means handing over the task results as a table (a CSV file) and the content of the tasks and sets in a common electronic format. Teachers can also download the results themselves at any time while the agreement lasts.

15.6. On request Paidoria confirms the deletion to the School by e-mail. It keeps the data only to the extent that the law of the European Union or of the Slovak Republic requires their storage, and informs the School of this. If a sub-processor also holds the data in its technical backups, they are deleted in its regular cycle and are not used in the meantime.

15.7. The provisions on confidentiality and on the deletion of data continue to apply after the agreement ends for as long as Paidoria holds the School’s data.

16. Liability

16.1. Each party is liable for damage caused by an infringement of the GDPR or of this agreement under Article 82 GDPR and under Slovak law. This agreement does not affect or limit the rights of data subjects.

16.2. If Paidoria, contrary to this agreement, itself determined the purposes and means of processing, it is considered to be a controller in respect of that processing (Article 28(10) GDPR).

16.3. In matters of processing personal data for the School this agreement takes precedence over the terms and conditions of the service. Content created by the School’s teachers (questions, tasks, card sets and pictures) is covered by the licence under point 10.6 of the terms and conditions; the School also agrees to it on its own behalf to the extent that it exercises the rights to that content. Paidoria may use this content to create and make available further educational content in Paidoria, also after the agreement ends — always without the teacher’s name and without identifying the School, and only where it contains no personal data of pupils or other persons. Content taken over in this way is not processed by Paidoria for the School and the deletion under point 15.4 does not apply to it. The licence never extends to pupils’ personal data.

17. How the agreement is concluded

17.1. The agreement is concluded electronically; Article 28(9) GDPR requires it to be in writing, including in electronic form. The wording published at this address, with its version identifier, is Paidoria’s offer to conclude the agreement. The School accepts it in one of these ways:

• at school registration — by ticking the box on acceptance of this agreement in the form at https://app.paidoria.com/skola and submitting the request; the agreement is thereby accepted on behalf of the School by the contact person named in the request;
• through a confirmation link — if the school was registered earlier, Paidoria sends its contact person a link by e-mail; on the page the link opens, a person authorised to act for the School enters their name and position and confirms the acceptance.

17.2. The agreement is concluded at the moment the School confirms the acceptance. Unless a special legal provision provides otherwise (point 17.6), it takes effect at that moment; if the School accepted it at registration, only on the day Paidoria approves the school’s registration — if Paidoria does not approve it, the agreement lapses. Before the registration is approved the School’s teachers cannot use the app with pupils.

17.3. The person accepting the agreement declares that they are authorised to act on behalf of the School — as its statutory body or as a person authorised by it.

17.4. About the acceptance Paidoria stores: the name and address of the School, the version identifier of the agreement, the date and time of acceptance, the name and position of the person who accepted it on behalf of the School, the way it was accepted (at registration or through the confirmation link) and the language in which the agreement was displayed. It does not store an IP address or any device data. Together with the published wording of the version concerned, this record captures the content of the agreement and the person who accepted it (Section 40(4) of the Slovak Civil Code).

17.5. The School can save or print the wording of the agreement from this page at any time. Paidoria keeps the wording of every version and on request sends it to the School together with a confirmation of the acceptance; on request it also issues the agreement on paper with a signature.

17.6. If the School is under an obligation to publish its contracts, it may publish this agreement; Paidoria consents to the publication. Whether this agreement is a contract the School must publish is for the School to assess. If it is, it takes effect only on the day following the day of its publication (Section 47a(1) of the Slovak Civil Code), and if it were not published within three months of its conclusion, it is deemed not to have been concluded (Section 47a(4)). On request Paidoria therefore sends the School, without delay, the wording of the agreement with a confirmation of the acceptance in a form suitable for publication. Point 17.7 applies also before the agreement takes effect.

17.7. From 5 October 2026 Paidoria observes the processor’s obligations under this agreement towards every school whose teachers use the app — even if the school has not yet confirmed its acceptance of the agreement.

18. Changes to the agreement

18.1. Every wording of the agreement has its own version identifier. Between the parties, the version the School accepted applies.

18.2. Paidoria informs the School of a new version by e-mail at least 30 days before it takes effect and explains what changes. The new version applies to the School only once the School accepts it through a confirmation link; the School’s silence is not consent.

18.3. If the School does not accept the new version, the existing version continues to apply between the parties. If Paidoria cannot continue under it (for example because the law has changed), it can terminate the agreement under point 15.2.

18.4. A change to the list of sub-processors (Annex 3) is governed by Article 9, and an update of the description of measures (Annex 2) by point 8.2; they do not require the agreement to be accepted again.

19. Final provisions

19.1. The agreement is governed by the law of the Slovak Republic and by the GDPR. Disputes are decided by the courts of the Slovak Republic.

19.2. If a provision of the agreement proves invalid, the others remain in force; the GDPR applies in place of the invalid provision.

19.3. The agreement is drawn up in Slovak. The English and Polish wordings are translations; if they differ, the Slovak wording applies.

19.4. Paidoria’s supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. The School’s supervisory authority is the supervisory authority of the Member State in which the School is established.

19.5. This version (DPA-2026-10-05) is effective from 5 October 2026.

Annex 1 — Description of the processing

Until the pupil submits the task, the attempt in progress (name, class and answers) is stored only in the pupil’s browser and disappears when the browser tab is closed.

The summary counts under point 5.7 are computed from the stored task results; no separate records about individual pupils are created in the process.

The task link works without signing in. Through it the pupil receives only the task itself and the names of the teacher’s classes; other pupils’ results and the teacher’s name or e-mail address are not shown.

Annex 2 — Technical and organisational measures (as at 5 October 2026)

Access to the data

• The tables holding schools’ data have row-level access rules in the database: a teacher sees and deletes only the results for their own tasks and manages only their own classes, tasks and sets; a teacher cannot reach another teacher’s data.
• A pupil without an account cannot read any results. A task opens only through a link with a random code, and the server releases only what is needed to do the task — for a written test, without the correct answers.
• A teacher can close a task or replace its link; the old link then stops working.
• A teacher account can be created only with a registration code Paidoria has issued to the school; the number of attempts to check a code is limited.
• A teacher’s sign-in is protected by a password, by confirmation of the e-mail address and by a check that the form is not being filled in by a robot. Passwords are stored only in a form from which the original password cannot be read. Deleting an account requires the password to be entered again.
• Access to Paidoria’s administration interface is protected by multi-factor authentication.
• Paidoria’s administrator has access in the administration interface to teachers’ tasks and sets — their content, the teacher’s name and e-mail address and the school — and can remove them or block a teacher from creating content (point 5.6). The results of individual pupils are not shown to the administrator in the app; the administrator sees only the summary counts under point 5.7.
• In the app, pupils’ results are seen only by the teacher who set the task. Direct access to the database is held only by persons Paidoria has entrusted with running the service.

Transmission and storage

• Communication between the device and the servers is encrypted (HTTPS); after the first visit the browser refuses an unencrypted connection to the app.
• According to the provider’s contractual documentation, the database is also encrypted at rest (AES-256).
• The database is backed up every day.

As little data as possible

• Pupils have no accounts or passwords. A first name or nickname is enough for a task; the field takes 60 characters at most and, on a shared device, does not suggest names other pupils have typed into it.
• No analytics and no advertising measurement run on the task pages for pupils.
• A crash report of the app contains no name, no form content and no task link.
• The camera is switched off in the app; the app does not ask for access to it.
• Task results are deleted automatically 13 months after submission; the deletion runs every night.

Protection against misuse

• The result of a written test is calculated by the server from the stored correct answers, not by the pupil’s browser.
• The number of submissions is limited — per task and per pupil — so that the list of results cannot be flooded.
• Content created by a teacher has size limits; a picture may be 1 MB at most and only a teacher may upload it, into their own folder.

Deletion

• A teacher deletes results one by one or in bulk. Deleting a teacher account deletes its classes, tasks, sets, the results for them and the uploaded pictures.

Testing the measures

• Paidoria reviews the security of the app on an ongoing basis and remedies the shortcomings it finds. Changes to the database are made in recorded steps that can be checked afterwards.

Good to know

• The link to a task belongs only to the pupils for whom the task is intended.
• Do not put photographs of pupils or other personal data into the pictures for cards — a picture can be seen by anyone who has the link to it or to the task.
• Card texts that have no recording are read aloud by the voice of the pupil’s device or browser. The app prefers a voice produced on the device itself; if there is none, some browsers send the text being read to their maker’s servers.
• Paidoria is not an archive of assessment: the results in the app should not be the only record of a pupil’s assessment.

Paidoria provides the School with a more detailed description of the measures on request (point 14.2), to an extent that does not endanger the security of the service or the data of other schools.

Annex 3 — Sub-processors (as at 5 October 2026)

Supabase, Cloudflare and Websupport use providers of their own; they publish their current lists on their websites: Supabase, Cloudflare, Websupport. The authorisation under point 9.1 covers them as well.

With all three, the data processing contract under Article 28 GDPR forms part of the contractual terms under which Paidoria uses their services: for Supabase and Cloudflare it is the Data Processing Addendum, for Websupport Part B of Article 16 of its general terms and conditions.

Paidoria uses no third-party analytics or advertising services on the data processed for the School. The payment service Stripe and the measurement tools of Google and Meta mentioned in the Privacy policy concern parent accounts and the website.

Vyskilluj s. r. o. · Ulica Veterná 8760/43, 917 01 Trnava · Company ID: 53388178 · info@paidoria.com