EduBoardData processing terms
For schools using the EduBoard Portal at portal.edu-board.com · Version of 27 September 2026
1. Roles
The School decides why and how personal information is processed (it is the controller; 个人信息处理者). The Provider processes it only on the School's behalf (it is the processor; 受托人). The School's instructions are these terms and what its teachers do in EduBoard, such as publishing, removing a student or changing settings.
2. What is processed
| Purpose | Letting students and families see their own classwork, grades, attendance, messages and shared material, and letting teachers see what was handed in and read. |
|---|---|
| People | The School's students, their parents or guardians, and its teachers. |
| Information | Names, student numbers, dates of birth, class names, grades, attendance rates, class points, report cards (PDF) and when they were opened, homework and answers, uploaded files, messages, Class Story posts and who has seen and replied to them, optional profile details and photo, Study Helper questions and answers, usernames, bcrypt password hashes and optional email addresses. |
| Sensitive information | Information about children, which under China's Personal Information Protection Law is sensitive for children under 14. The School should not publish health or other special information to the Portal (EduBoard does not send its extra student fields or notes there). |
| Operations | Storing, showing to signed-in users, backing up, deleting; sending the weekly digest through the School's own email account; sending Study Helper questions and translations to the AI provider the School chose, with the School's own key. |
| Duration | While the School uses portal.edu-board.com, and until deletion under section 8. |
3. What the Provider will do
- Process the information only on the School's instructions, and tell the School if it believes an instruction breaks the law.
- Never sell it, use it for advertising, profile anyone, or use it to train AI models.
- Allow only people who need it to keep the service running to reach the database, and bind them to confidentiality.
- Keep these safeguards in place: HTTPS only; passwords stored as bcrypt hashes; limits on sign-in attempts and secret links; each teacher's data kept apart by their own sync secret; server access by key or password restricted to the Provider; security updates applied; backups on the same server, the oldest deleted once there are 14.
- Not disclose the information to anyone unless the law requires it, and then tell the School first unless the law forbids that.
4. Sub-processors
The Provider uses:
- VPS.do (VpsQuan L.L.C.): the server, in Hong Kong, where the Portal runs.
- Cloudflare: domain name service only. It tells browsers which server to use; personal information does not pass through it.
The AI provider and email account the School sets up in EduBoard are used with the School's own key and account, under the School's own agreement with them; they are not the Provider's sub-processors. The Provider will tell the School at least 30 days before adding or replacing a sub-processor. The School may object, and if the objection cannot be resolved, may stop using the service and have its data deleted.
5. Security incidents
If personal information of the School's is lost, disclosed or accessed without permission, the Provider will tell the School without undue delay and within 48 hours of finding out, say what is known (what happened, whose information, what is being done), keep the School updated, and help it inform families and the authorities.
6. Helping the School
The Provider will help the School answer requests from students and families to see, correct, copy or delete their information, and give the School what it needs for a personal information protection impact assessment (个人信息保护影响评估) or similar review.
7. Where the information is kept
The information is kept in Hong Kong. Under the Personal Information Protection Law, Hong Kong is outside mainland China. A school in mainland China is responsible for any steps the law requires before sending personal information there (for example a standard contract for cross-border transfer, 个人信息出境标准合同), and the Provider will cooperate, including by signing such a contract. A school elsewhere that needs standard contractual clauses can ask for them in the same way.
8. Ending
When the School stops using portal.edu-board.com, or asks, the Provider will first give the School a copy of its data if it wants one, then delete it from the live Portal within 30 days. Copies in backups are removed as those backups are replaced, and within a further 30 days at most. The Provider will confirm the deletion in writing.
9. Checking
The Provider will answer the School's reasonable questions about how it meets these terms, including a security questionnaire once a year. An inspection by an independent auditor bound by confidentiality can be arranged with 30 days' notice, at the School's cost.
10. Other terms
If these terms conflict with any other agreement between the School and the Provider about this service, these terms win for personal information. They continue for as long as the Provider holds the School's information.
Signatures
| School | |
|---|---|
| Address | |
| Contact for data protection (name, email) | |
| Signed by (name, role) | |
| Signature and date | |
| Governing law (if agreed) | |
| Provider | The developer of EduBoard · privacy@edu-board.com |
| Signed by (name) | |
| Signature and date |