Data Processing Agreement

The one thing that matters most

Each student keeps their own record. The School’s view of it ends when the School leaves. A student’s experiences and the sign-offs on them live in the student’s own Powstik account, free, for as long as they want them. When the School stops using Powstik, its coordinators lose access to the cohort view and its workspace data is deleted as set out in section 8 — but nothing is taken from any student.

1. Who is responsible for what

1.1 For the School workspace (the roster, invite lists, cohort views, assignments, settings, exports and the audit log), the School is the controller and Powstik is the processor. Powstik processes this data only to provide the workspace, and only on the School’s documented instructions: the functions of the product as the School uses them, and this agreement.

1.2 Each student’s own Powstik account is held by the student under Powstik’s Terms and Privacy Policy. The School sees a student’s CAS record only while that student is a member of the School’s workspace.

1.3 The School confirms it has a lawful basis for the processing, including parental consent for students under 18 where the law requires it (the School attests this when it starts the workspace).

2. What data, and why

2.1 People: staff (coordinators, principals, supervisors) and students who join the workspace; supervisors named on a sign-off request, who need no account.

2.2 Data: names, email addresses, birth year (to apply age rules), cohort, CAS experiences students log and the evidence links they add, supervisor confirmations and comments, and a log of who did what (section 6).

2.3 Purpose: to run CAS for the School — logging, sign-off, reminders, cohort views and exports. Powstik never sells this data, never shows ads, and never uses it to train AI models.

3. Powstik’s duties

3.1 Process the data only as described in section 1.1, and tell the School if an instruction would break the law.

3.2 Make sure everyone at Powstik who can access the data is bound to keep it confidential.

3.3 Keep it secure: encrypted in transit (TLS) and at rest; the public key used by browsers can read and write nothing, so data is reached only through Powstik’s own servers; every sign-off sealed with a cryptographic signature so tampering is detectable; and an append-only audit log.

3.4 Help the School answer requests from students, parents and staff to see, correct or delete their data, within 30 days.

3.5 Tell the School without undue delay, and within 72 hours of becoming aware, of any personal data breach affecting the School’s data, with what is known and what is being done.

4. Sub-processors

Powstik uses these companies to provide the service. Each is bound to protect the data at least as well as this agreement requires.

Powstik will email the workspace owner at least 30 days before adding or replacing a sub-processor. The School may object; if we cannot resolve it, the School may leave and receive a pro-rata refund of any prepaid term.

5. Where the data is

The data is stored and processed in the United States: the database in AWS us-east-1 (North Virginia), the application in Washington, D.C. Copies of public pages are cached worldwide; the School workspace is never cached. If the School’s law requires a specific mechanism for transfers to the United States, tell us and we will sign it with you.

6. The audit log

Powstik records sign-offs given, role changes, invites sent, exports taken, plan changes, reminder emails and deletions, each with who, what, when and the workspace. It never records the content of an experience or a message. The workspace owner can read and export it; a student can see the entries about their own record. Entries can be added, never edited or removed.

7. Export, at any time

The School can export all of its data (every experience, the roster, the audit log, and a print-ready evaluation pack) at any time and in every plan state, including after it stops paying.

8. Retention and deletion

8.1 Powstik keeps the workspace data for as long as the School uses Powstik.

8.2 On request, and when the School leaves, Powstik deletes the School workspace (roster, invite lists, assignments, settings and the School’s membership links to students) within 30 days, and confirms in writing. The School should export first; the export stays available until deletion.

8.3 Not deleted: each student’s own account and record (section 1.2), which the student controls; and the audit log, which holds no content and is kept as the security record of what happened. Backups roll off within 30 days of deletion.

8.4 Deletion requests: the workspace owner writes to us through the contact page (topic “privacy”).

9. Checking we keep our word

Powstik will answer the School’s reasonable security questionnaires and provide the information needed to show it meets this agreement. Other audits are by agreement, at reasonable notice, at the School’s cost.

10. Everything else

This agreement forms part of the Terms between the School and Powstik and lasts as long as Powstik processes the School’s data. Liability, governing law (India) and courts (Hyderabad, Telangana) are as in the Terms. If this agreement and the Terms disagree about personal data, this agreement wins.