Legal
Data processing agreement
Customers who use the Simblia learning platform sign one standard data processing agreement. It is built on the European Commission's standard contractual clauses, so public-sector lawyers recognise it.
This page summarises the agreement. The signed version is attached to the order form. To receive the full text, write to privacy@simblia.com.
Roles
The customer, for example a municipality as school authority, an independent school or a business, is the data controller. Simblia ApS is the data processor and only processes personal data on the customer's documented instructions.
Built on the EU standard clauses
The agreement incorporates clauses 1 to 10 of the standard contractual clauses in Commission Implementing Decision (EU) 2021/915, word for word and unchanged. In case of conflict, the standard clauses take precedence. Danish law applies.
What data and why
- People: pupils, teachers and other school staff, administrators, and employees of business customers.
- Data: account details (name, pseudonymous user ID, school, class or team, role, and work email for staff), learning progress and results, and security logs. Pupils don't need an email address.
- Sensitive data: none intended. Free-text fields remind users not to enter it.
- Purpose: to provide the platform, support and the security of the service. No advertising, no profiling for marketing, no sale of data.
Where data is processed
In Scaleway data centres in the Paris region, France. Data does not leave the EU/EEA except as listed for sub-processors below.
Sub-processors
| Provider | Service | Location |
|---|---|---|
| Scaleway SAS | Hosting, databases, backups and transactional email | France (Paris data centres) |
| Microsoft Ireland Operations Limited | Sign-in and identity management (Microsoft Entra) | EU (EU Data Boundary). Some sign-in and multi-factor authentication data may be processed in the USA, under standard contractual clauses. |
| Proton AG | Email for support correspondence | Switzerland (EU adequacy decision), Germany or Norway. Proton's support staff may access data from outside the EU/EEA. |
Full details of each sub-processor, including data centres and transfer safeguards, are available on request. We give at least [30] days' written notice before adding or replacing a sub-processor. The website has its own sub-processors list.
Security
The agreement lists our technical and organisational measures: least-privilege access with multi-factor authentication, encryption in transit and at rest, EU hosting, backups, security logging and a documented incident response process. Read more in the trust centre.
Breaches, audits and deletion
- Breach notification: without undue delay and no later than 24 hours after we become aware of a personal data breach affecting the customer's data.
- Audits: we share our security documentation, and customers may audit once a year with 30 days' notice, or after a breach.
- End of contract: customers can export their data for 30 days. We then delete it, including copies, except backups that are overwritten within 35 days.
One agreement for everyone
We use only our own standard agreement, not customers' templates, so every customer gets the same protections. Questions from your lawyer or data protection officer are welcome at privacy@simblia.com.
Summary of LEG-001 version 0.2.0-draft. Last updated: 3 November 2026