Campus OS

Data Processing Addendum

Version 1.0 · 21 June 2026

1. Subject matter and duration

This Addendum governs Campus OS's processing of personal data on behalf of the Customer for the term of the underlying Subscription Agreement and any post-termination retention window.

2. Nature and purpose

Processing is necessary to operate the campus management platform: identity and access management, attendance, fees, learning, parent engagement, dashboards, audit and notifications.

3. Categories of data subject

Administrators, teachers, students (including minors), parents and guardians.

4. Roles

The Customer is the Controller; Campus OS is the Processor. Where Campus OS independently determines the means of processing for security, fraud prevention or aggregate analytics, it acts as a Controller for those limited purposes.

5. Processor obligations

  • Process personal data only on documented instructions from the Customer.
  • Ensure persons authorised to process the data are bound by confidentiality.
  • Implement technical and organisational measures appropriate to the risk — see our Trust Center.
  • Assist the Customer with data-subject requests, DPIAs and regulator notifications.
  • Notify the Customer of any personal data breach within 72 hours.
  • On termination, delete or return personal data within 30 days.

6. Sub-processors

The Customer authorises the sub-processors listed below. Campus OS will notify the Customer of any addition or replacement at least 30 days in advance.

Sub-processorPurposeRegion
Supabase (Lovable Cloud)Managed Postgres, authentication, storage, edge runtimeEU / US / APAC (selectable)
CloudflareDNS, WAF, CDN, Workers runtimeGlobal edge
ResendTransactional emailEU / US
WhatsApp Business (Meta)Optional WhatsApp notifications, where enabled by institutionGlobal

7. International transfers

Where personal data is transferred outside the UK, EEA, India or other jurisdictions with adequacy or restricted-transfer rules, transfers are protected by the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, DPDP Rules transfer mechanisms, or equivalent safeguards.

8. Audit

Campus OS will provide the Customer with documentation reasonably necessary to demonstrate compliance, and permits audits on reasonable notice not more than once per year.

9. Liability

Liability under this Addendum is governed by the limitation of liability in the Subscription Agreement.

10. Signing

Institutions on a paid plan may request a counter-signed copy at legal@campusos.app.