01Parties and conclusion
- Bildena's data protection officer: to be appointed. Until then the management answers data-protection requests at the address below.
- Data centre: Bildena is moving to another data centre in Germany in the coming weeks; the move is announced under § 7 (2).
The controller is the school or school operator using Bildena, with the details given at registration and in the school's settings (the "School"). Who is the controller under the law of the federal state (the school, represented by its head, or the school operator) is set by that law.
The processor is Bildena GmbH, Hewaldstraße 1, 10825 Berlin, Amtsgericht Charlottenburg, HRB 293476 B, represented by its management ("Bildena"). Data protection at Bildena: privacy@bildena.com.
The agreement is concluded when the School agrees to it at registration or later in the application; this is the electronic form under Art. 28 (9) GDPR. On request Bildena also signs it in writing. Where the federal state or the school operator prescribes its own model, the parties conclude that model, which takes precedence over this agreement.
02§ 1 Subject matter and term
(1) Bildena provides the School with the "Bildena" software as an online service, to the extent ordered: timetabling, cover and duties, records and student files, the register with attendance, behaviour and care, school health (the sick room, medicines, care plans, accidents), grades and reports, admissions, fees and finance, letters and messages to families, parents' evenings and an AI assistant, which the School can switch on or off at registration and at any time afterwards (Annex 5). The basis is Bildena's terms of use and the School's order (the "Main Contract"). In doing so Bildena processes personal data on behalf of the School.
(2) This agreement runs for the term of the Main Contract and beyond, as long as Bildena processes the School's data, in particular until deletion under § 12 is complete.
(3) In matters of data protection this agreement prevails over the Main Contract.
03§ 2 Nature, purpose, data and data subjects
(1) Nature and purpose: storage, organisation, display, calculation (in particular of the timetable), transmission to recipients the School designates (e.g. guardians in the application), export and deletion — solely to perform the Main Contract.
(2) The types of data and categories of data subjects are listed in Annex 1. They can include special categories of personal data under Art. 9 GDPR (health notes and school health records — sick room visits, care plans, medicines, accidents —, special educational needs, religious education or withdrawal from it, sick notes) where the School records them. The School can switch off fields its federal state does not provide for; some state rules are preset.
(3) Annex 5 records which optional processing the School orders.
04§ 3 Instructions
(1) Bildena processes the data only on documented instructions from the School (Art. 28 (3) (a), Art. 29 GDPR). Instructions are this agreement, the Main Contract and the settings authorised persons of the School make in the software (e.g. roles and permissions, the AI switch, deletions). Individual instructions are given in text form by the persons named in Annex 4.
(2) Bildena does not process the data for its own purposes; the one exception is improving the AI assistant under paragraph 5. Other analyses to improve or bill the service use only anonymised or aggregated figures that cannot identify individuals.
(3) If Bildena considers an instruction unlawful, it informs the School without delay and may suspend it until it is confirmed or changed.
(4) If Union or Member State law requires Bildena to process data, Bildena informs the School beforehand unless that law prohibits it.
(5) By this agreement the School permits Bildena to analyse conversations with the AI assistant in coded form, to improve and test the assistant. In coded form every person is replaced by a code (e.g. "Student K7QM"); the key to the codes stays on Bildena's server, and Bildena's staff do not see real names in doing so. Every access is logged. The conversation data is available for this only within the periods of the usage log (texts 30 days, Annex 2). Bildena uses it for no other purpose, does not sell it and does not use it to train third-party models. Content about health, special educational needs or safeguarding is excluded from this analysis.
05§ 4 Place of processing
(1) The application and the database run in a data centre in Germany (currently at Contabo GmbH, Annex 3). Backups are currently kept on the same server; a second copy at another location in Germany is planned (Annex 2). A change of data centre is announced under § 7 (2); the data stays in Germany. E-mail from the application (to families who do not use the app, and cover requests to teachers) is sent by a service in the EU (Lettermint B.V., Netherlands; Annex 3); the content and attachments of those e-mails leave the data centre for that, no other data does. SMS to families (notices from Communication and messages from the sick room) are sent, only when the School uses SMS (Annex 5), by ONLINECITY.IO ApS (GatewayAPI, Denmark; Annex 3); the mobile number, the text and the sender name leave the data centre for that. Not switched on yet. Questions to the AI assistant are answered, while it is switched on for the School (Annex 5), by Amazon Bedrock, called in Frankfurt am Main and processed only in EU member states (Amazon Web Services EMEA SARL; Annex 3); the question and the data the answer needs leave the data centre for that.
(2) Data is transferred to a third country or an international organisation only on the School's instructions and only where Art. 44 et seq. GDPR are met. Annex 3 lists the cases with a third-country link and their safeguards.
06§ 5 Confidentiality
(1) Bildena only uses persons who are bound to confidentiality or under a statutory duty of secrecy (Art. 28 (3) (b) GDPR) and who have been made familiar with data-protection law. The obligation continues after their work ends.
(2) Only staff who need it for their task (operation, support at the School's request, fixing faults) get access to the School's data. Every access of a Bildena account to a school is logged with its reason; the School sees the list in the application (School › Data protection).
07§ 6 Technical and organisational measures
(1) Bildena takes the measures under Art. 32 GDPR described in Annex 2, including the points marked there as planned and their status.
(2) Bildena may adapt the measures to technical progress as long as the level of protection does not fall. Bildena informs the School of significant changes in text form and updates Annex 2.
08§ 7 Sub-processors
(1) The School gives its general authorisation to engage the sub-processors listed in Annex 3 (Art. 28 (2) GDPR). For sub-processors used only for optional features the authorisation applies only once the School orders the feature under Annex 5.
(2) Bildena informs the School in text form at least 30 days in advance of any intended addition or replacement of a sub-processor. The School may object within 14 days of receipt for an important data-protection reason. If the parties find no solution, the School may terminate the Main Contract for the services concerned for cause; until then Bildena does not use the new sub-processor for the School's data where technically possible.
(3) Bildena binds every sub-processor by contract to the same data-protection obligations as in this agreement (Art. 28 (4) GDPR) and is liable to the School for their compliance.
(4) Ancillary services without access to the School's data (e.g. domain administration, telecommunications) are not sub-processing. Maintenance or audits by third parties with possible access to data are.
09§ 8 Data subjects' rights
(1) Bildena supports the School with appropriate technical and organisational measures in answering requests under Art. 12 to 22 GDPR. The software lets the School view, correct, export and delete records.
(2) A feature that exports or deletes all data of one person across all modules at once is planned. Until then Bildena compiles or deletes a person's data on the School's instruction within 10 working days.
(3) If a data subject contacts Bildena directly, Bildena forwards the request to the School without delay and does not answer it itself.
10§ 9 Support with further obligations
Taking into account the information available to it, Bildena supports the School in complying with Art. 32 to 36 GDPR, in particular with the data-protection impact assessment (Bildena provides a template with the details of the product) and any prior consultation of the supervisory authority.
11§ 10 Personal data breaches
(1) Bildena reports every personal data breach affecting the School's data without undue delay and at the latest 24 hours after becoming aware of it — to the contact named in Annex 4, in text form and, where possible, by phone first.
(2) The report contains, as far as known, the information under Art. 33 (3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records, a contact person, the likely consequences and the measures taken or proposed. What is not yet known follows without delay.
(3) The School notifies the supervisory authority (Art. 33 GDPR) and informs data subjects (Art. 34 GDPR); Bildena supports this and informs third parties only on instruction. Bildena documents every breach and the measures taken.
12§ 11 Evidence and audits
(1) Bildena makes available to the School the information needed to demonstrate compliance with Art. 28 GDPR and allows audits, including inspections, by the School or an auditor it appoints who is bound to confidentiality (Art. 28 (3) (h) GDPR).
(2) Evidence is in particular Annex 2 in its current version and, once available, certificates and audit reports. Bildena is not currently certified to ISO/IEC 27001.
(3) The School announces on-site audits four weeks in advance, after a breach under § 10 without notice. They take place during normal business hours without disproportionate disruption, as a rule at most once a year. Bildena tolerates and supports audits by the competent supervisory authority.
13§ 12 Return and deletion
(1) The School can export its data itself at any time until the contract ends (lists as Excel or CSV, finance lists, the letter archive per school year). On request within 30 days after the contract ends, Bildena also provides a complete extract of the School's data in a common machine-readable format (CSV files and the uploaded files, as a ZIP archive).
(2) Bildena deletes the School's data from the production system 30 days after the contract ends. Backups expire with the backup cycle, at the latest 14 days after deletion. Bildena confirms the deletion in text form.
(3) If the School requests the deletion of the school in the software, it can be restored for 30 days and is then deleted automatically with all records and files; the School receives a deletion certificate without personal data. Paragraph 2 applies to backups.
(4) The School's statutory retention duties (e.g. student files, copies of reports, the duty to offer records to the archive) remain the School's; it exports the data concerned before the contract ends.
14§ 13 The School's obligations
(1) The School is responsible for the lawfulness of the processing, in particular that the data recorded is permitted under its state's school law, that any required approvals or notifications (e.g. to the school operator or the school authority) are in place, for informing data subjects (Art. 13, 14 GDPR), for consents and for the record of processing activities. Bildena provides templates for these.
(2) The School assigns roles and permissions in the software as needed and decides when data is deleted.
(3) If the School notices errors or irregularities in the processing, it informs Bildena without delay.
15§ 14 Liability
Liability follows Art. 82 GDPR. Otherwise the Main Contract applies.
16§ 15 Final provisions
(1) Changes and additions require text form (Art. 28 (9) GDPR); this also applies to waiving this requirement. Bildena announces changes to this agreement in text form at least 30 days before they take effect; § 7 (2) remains unaffected.
(2) If a provision is invalid, the rest of the agreement remains valid.
(3) German law applies. The place of jurisdiction is Berlin where permitted by law. The German version is binding; the English version is a translation.
17Annex 1 — Data and data subjects
Which data actually arises depends on the modules and fields the School uses. Marked *: special categories under Art. 9 GDPR or comparably sensitive.
| Data subjects | Categories of data (extract) |
|---|---|
| Students | name, gender, date of birth, class, student number, photo (optional), e-mail, address, home languages, religious education*, previous school, entry date, measles status, all-day care, health note*, support-plan flag*, course choices, groups, timetable, attendance and reasons for absence*, behaviour records and measures, grades, report texts, observation notes, consents, documents, fees and payments; school health*: sick room visits (the reason, the care given, the temperature, what happened next, a doctor or hospital, who collected the child), the care plan with conditions, allergies and emergency steps, medicines the School holds and the doses given, accidents and accident reports; user account (if given) |
| Guardians and other contacts | name, contact details, language, relationship to the child, custody, collection rights, emergency contact, messages to the school, replies to letters, the School's messages from the sick room (a call, an SMS, the app) and whether they reached them, appointments, payers, bank details (mandate reference, IBAN), evidence for fee help; user account |
| Applicants and their families (admissions) | name, date of birth, address, previous school, guardians' details, admission criteria (e.g. siblings, hardship*), documents, decision and reasons |
| Teachers and other staff | name, short name, contact details, subjects, teaching load, planning wishes and blocked times, duties, cover and extra hours, absences with reason*, role, working hours; user account |
| Paying organisations, the School's suppliers and their contact persons | name of the organisation or person, address, e-mail, contact person, VAT ID or tax number; for suppliers also the IBAN |
| Users of the software | e-mail, display name, password hash, role, sign-ins, two-factor setting, log entries (changes, exports, AI use), conversations with the AI assistant |
18Annex 2 — Technical and organisational measures (Art. 32 GDPR)
The School receives the detailed version with the status of every measure on request in the data-protection pack. The main measures:
- Tenant separation: every school is its own tenant; every query filters by the school; automated tests check that schools cannot see each other.
- Access: roles with permissions per module and screen as needed; families and students see only their own child or themselves.
- Sign-in: passwords stored only as hashes; two-factor sign-in (required for Bildena staff; the school or operator can require it for its staff); lock-out after five failed attempts; blocking an account and revoking sessions take effect at once.
- Transmission: encrypted only (TLS 1.2/1.3, HSTS), content security policy.
- Stored data: health notes, school health records (sick room visits and what happened in them, care plans, medicines and doses, accidents) and the text of the sick room's SMS, religion, measles status, reasons for absence, behaviour records and measures, observation and document notes, families' replies to letters, IBANs/account numbers and all uploaded files are encrypted per school with its own key (AES-256-GCM); the keys are protected by a master key that is kept neither in the database nor in the backups. The other fields (e.g. names, classes, grades, messages, photos) and the backup files as a whole are not additionally encrypted at application level.
- Logs: changes are logged with person and time; every access of a Bildena account to a school is logged with its reason and shown to the school (kept 2 years); logs are deleted or anonymised after fixed periods. AI assistant: questions and answers in the usage log are emptied after 30 days (the School can choose 1 to 90 days), after which only counters remain; each conversation in a person's chat list is deleted 30 days after its last use, and only that person sees it and can delete it sooner.
- Server: sign-in by SSH key only, no passwords; only a small, named group of people has access.
- Backups: hourly (kept 48 hours) and daily (kept 14 days), each backup's readability checked automatically. Being set up: an encrypted daily copy at a second location in Germany; planned: regular restore tests.
- Data minimisation: fields can be switched off per school (incl. health note, support plan, religion, measles status, photo, home languages); state rules preset; the AI assistant can be switched on and off per school (the choice at registration, Annex 5). What a child came to the sick room with and what was done, the visit's timeline and the text and number of its SMS are emptied one year after the visit (the School can choose 90 days to two years); the visit itself stays as the record, and a visit with an accident report stays with that report.
- Deletion: deleting a school can be undone for 30 days, then it is automatic, with a deletion certificate (§ 12).
- Not yet in place: ISO/IEC 27001 certification (work has started), an external penetration test, automatic alerts on outages.
19Annex 3 — Sub-processors
| Company | Service | Location | Data, safeguards |
|---|---|---|---|
| Contabo GmbH, Munich | the server running the application and the database, including the backups | data centre in Germany | all of the School's data; agreement under Art. 28 GDPR |
| Amazon Web Services EMEA SARL, Luxembourg (Amazon Bedrock; AI model Claude Haiku 5.5 by Anthropic) | AI assistant — while it is switched on for the School (Annex 5) | called in the Frankfurt am Main region (eu-central-1); through the EU cross-region inference profile only in AWS regions in EU member states (Frankfurt, Stockholm, Milan, Spain, Ireland, Paris), not only in Germany | what a person types into the assistant or an AI draft, as they typed it, names included; from the School's data, what the answer needs: personal fields removed, students' names replaced by codes — in a text such as a letter or what is on the screen, where first and last name stand together —, names of teachers and staff, classes, subjects and rooms as they are. Inputs and answers are not used for training and are not stored by the provider (Amazon Bedrock's model invocation logging is switched off). Anthropic Ireland, Limited, Dublin, makes the model; it has no access to inputs or answers and is not a sub-processor. At Bildena: each conversation in a person's chat list is deleted 30 days after its last use, and questions and answers in the usage log are emptied after 30 days (Annex 2). Safeguards: the AWS Data Processing Addendum (AWS DPA, part of the AWS Service Terms), EU standard contractual clauses for links to the US parent |
| Lettermint B.V., Zwolle (Netherlands) | sending e-mail: to families without the app (letters, reminders, formal notices, finance papers, admissions) and cover requests to teachers | Netherlands (EU) | the recipient's address, the subject, text and attachments of the e-mail; agreement under Art. 28 GDPR; processing in the EU; content deleted after 28 days |
| ONLINECITY.IO ApS (GatewayAPI), Odense (Denmark) | sending SMS to families — notices from Communication and messages from the sick room —, only when the School uses SMS (Annex 5) — not switched on yet | the provider's EU platform (gatewayapi.eu) [check: the provider's sub-processors] | the mobile number, the text of the SMS, the School's sender name. Bildena adds no names to a notice. An SMS from the sick room names the child's first name and that the child is unwell, should be collected or was taken to hospital (with the hospital, if it was entered)*; the reason* only when the person sending it chooses so in that case. Agreement under Art. 28 GDPR |
For the AI assistant, Amazon Web Services is the only sub-processor: the software sends the School's data to no other AI provider, not even when Amazon Bedrock cannot be reached. The AI provider could change only under § 7 (2).
Not sub-processors: Cloudflare (name resolution of the domain only, no access to the School's data), GitHub (source code, no data of the School) and the browsers' push services (Google, Apple, Mozilla, Microsoft): Bildena sends push notifications itself, end-to-end encrypted and without names or texts, which those services cannot read (§ 7 (4)).
20Annex 4 — Contacts
| School | Bildena | |
|---|---|---|
| Instructions | the school administrators (named in the application) or the person they name in text form | privacy@bildena.com |
| Reports under § 10 | the contact the School names, also outside school hours; otherwise the school administrators | privacy@bildena.com |
| Data protection officer | as given by the School | to be appointed (see the notes above) |
21Annex 5 — Optional features
| Feature | Sub-processor | How it is ordered |
|---|---|---|
| AI assistant (drafts, analyses, help; students' names from the School's data as codes, inputs as typed — Annex 3) | Amazon Web Services EMEA SARL (Amazon Bedrock, called in Frankfurt am Main, processing only in EU member states; AI model Claude) | The school administrators choose at registration whether the AI assistant is on or off (pre-selected: on) and can switch it at any time in the school's settings (Data protection); the choice, who made it and when are recorded. Some state authorities expect an explicit decision by the school; the choice at registration is that decision. |
| SMS to families (notices from Communication; messages from the sick room) | ONLINECITY.IO ApS (GatewayAPI) | when the School buys an SMS pack; without credit no SMS goes. The School can switch SMS off in Communication's SMS settings, a family for itself in the app. Every SMS goes only when an authorised person sends it after seeing its text — not switched on yet |