This agreement applies to every school that uses Corinia. It forms part of the Terms of Service and is accepted, on behalf of the school, by the person who creates the school on Corinia. It is the data processing agreement required by Article 28 of the General Data Protection Regulation (GDPR).
1. The parties and their roles
The school is the school, college or other organisation that creates a school on Corinia. For the personal data described in this agreement, the school is the controller: it decides why and how that data is used.
Corinia is the service operated by Evolona S.R.L., whose details are on the Legal notice page. For that data, Corinia is the processor: it handles the data on the school's behalf and on its instructions.
Where Corinia is a controller in its own right. Every student and counsellor also holds a personal Corinia account. Corinia is the controller for what is needed to run those accounts: signing in, security, any payment a person makes themselves, and anything a student keeps private from the school, namely their drafts in Writing and their conversations with the assistant. The Privacy Policy covers that processing. When a student leaves the school on Corinia, Corinia becomes the controller of that student's data from then on.
2. What this agreement covers
| Subject matter | Providing Corinia to the school's students and counsellors, including the counsellor dashboard |
| Duration | From the creation of the school on Corinia until the school is closed, plus the deletion period in section 11 |
| Nature and purpose | Storing, organising, analysing and displaying student information so that students can plan university applications and counsellors can support them |
| Whose data | Students invited by the school, and the school's counsellors |
| What data | For students: name, email address, date of birth, country, school results, test scores, activities, awards, preferences, suggested and shortlisted universities, application status, plan and progress, and notes written by counsellors. For counsellors: name and email address |
| Sensitive data | None is requested. A student's own documents may contain it if the student chooses to include it |
3. The school's instructions
Corinia processes the data only on the school's documented instructions. Those instructions are this agreement, the Terms of Service, and the choices the school and its counsellors make in the product, such as inviting or removing a student, adding a note, or exporting a list.
If Corinia believes an instruction breaks data protection law, it will tell the school and may pause that instruction until the matter is resolved.
Corinia will not use the data for its own purposes, sell it, or use it for advertising or to train artificial intelligence models.
4. What the school confirms
The school confirms that:
- it has a lawful basis under data protection law for using Corinia with its students;
- it has given its students, and the parents or guardians of those under 18, the information the law requires about this use, and has obtained any consent or permission that the law or its own policies require, in particular for students under 16;
- it will invite only its own students, and will remove students who leave the school;
- its counsellors will use the information only to support students' education and applications, and will keep it confidential;
- it will tell Corinia promptly if a parent or student objects to this use, so that the student can be removed.
5. Confidentiality
Corinia ensures that everyone it authorises to handle the data is bound by a duty of confidentiality and accesses the data only when their work requires it.
6. Security
Corinia protects the data with appropriate technical and organisational measures, which include:
- encryption of data in transit;
- sign-in by one-time code, with no stored passwords;
- separation of each school's data, so that a counsellor sees only their own school's students;
- private storage for uploaded files, which are not publicly accessible;
- access to production systems limited to the few people who need it;
- regular backups, and tested restoration;
- records of sign-ins and key actions;
- review of these measures when the service changes.
The school is responsible for the security of its counsellors' email accounts, since access to an email account gives access to Corinia.
7. Other processors
The school gives Corinia general authorisation to use other processors to provide the service, in these categories: hosting and infrastructure; artificial intelligence processing; email delivery; payment processing.
Corinia has a written contract with each of them that imposes data protection obligations equivalent to those in this agreement, and remains responsible to the school for their work.
A current list of these processors is available to the school on request. Corinia will inform the school's owner by email at least 30 days before adding or replacing one. If the school objects on reasonable data protection grounds, the parties will look for a solution in good faith; if none is found, the school may end its use of Corinia and receive a refund for the unused part of any period it has paid for.
8. Transfers outside the European Economic Area
Where a processor handles data outside the European Economic Area, Corinia ensures that the transfer is covered by a European Commission adequacy decision or by the Commission's standard contractual clauses, with additional safeguards where needed.
9. Helping the school meet its obligations
Requests from individuals. Students can see, correct, download and delete their own information in the product. If Corinia receives a request about data for which the school is the controller, it will pass the request to the school without delay and will not answer it itself unless the school asks it to. Corinia will give the school reasonable help in responding.
Assessments. Corinia will give the school the information it reasonably needs to carry out a data protection impact assessment or to consult a supervisory authority.
10. Personal data breaches
If Corinia becomes aware of a personal data breach affecting the school's data, it will notify the school's owner without undue delay and no later than 48 hours after becoming aware of it. The notice will describe what happened, the data and people affected as far as known, the likely consequences, and what Corinia has done and proposes to do. Corinia will keep the school informed as more becomes known and will help it meet its own notification duties.
11. When the agreement ends
When a school is closed on Corinia, or a student is removed from it:
- the school's notes about its students are deleted;
- the school can no longer see the students concerned;
- each student keeps their personal account, for which Corinia is then the controller, unless the student or a parent deletes it.
Before closing, the school can export its student list and destinations from the dashboard. Data deleted from the live service is removed from backups within 35 days. If the school instructs Corinia in writing to delete particular students' accounts at closure, Corinia will first tell those students so that they can choose to keep their own accounts, as their accounts belong to them.
12. Information and audits
Corinia will give the school the information reasonably needed to show that this agreement is being followed. Once a year, or after a breach, the school may carry out an audit, itself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, during business hours, and without disrupting the service or exposing other customers' data. Each party bears its own costs.
13. Liability
Each party is responsible for its own compliance with data protection law. Liability between the parties under this agreement is subject to the limits in the Terms of Service, except where the law does not allow liability to be limited.
14. General
If this agreement conflicts with the Terms of Service on a matter of data protection, this agreement prevails. It is governed by the same law and subject to the same courts as the Terms of Service.
Questions about this agreement: [email protected].