Data Processing Agreement (DPA)

Version 1 of July 8, 2026

Between

The Data Controller ("the Institution"): the educational institution (or its managing body, or the competent academic authority) on whose behalf the teacher using Examino acts in the course of their duties.

Name:

Address:

Represented by:

DPO contact:

And:

The Processor ("Examino"): EXAMINO, a French simplified joint-stock company (SAS) with a share capital of EUR 1,000, whose registered office is at 49 RUE DE PONTHIEU 75008 PARIS, France, registered with the Paris Trade and Companies Register under number 989 510 375, represented by Mr. Dimitri Nicolas, duly authorised in his capacity as President. DPO contact: dpo@examino.ai

Preamble

Examino publishes an application that assists with the grading of exam papers. The teacher, an agent or employee of the Institution, subscribes to the service and imports student exam papers in the course of their duties. In accordance with the doctrine of the CNIL (the French data protection authority), the Institution is the data controller and Examino the processor within the meaning of Article 28 of the GDPR.

This agreement is entered into unilaterally by Examino for the benefit of the Institution as soon as the teacher first imports exam papers. The Institution may ratify it by counter-signature; failing that, continued use after being informed constitutes acceptance of these processing terms. It prevails over any conflicting provision of the Terms of Use as regards the processing of student data.

1. Subject matter, nature and purpose of the processing

2. Categories of data and data subjects

Data subjects: students of the Institution (including minors); the teacher using the service.

Data processed: content of exam papers (school work); where applicable, residual identifying elements that escaped automatic redaction; suggested and then validated grades and comments; exam questions and grading scales.

Minimisation: Examino applies automatic redaction upon import (the student's first and last name and detected direct identifying elements are masked on the image upon import; the redacted version is used for most of the processing by the AI models and transmissions of the original version are limited to the minimum necessary, in particular for detecting the elements to be masked) and, wherever possible, grades the digital transcription rather than the handwritten image (neutralising handwriting). These measures constitute pseudonymisation, not anonymisation (details and limits: redaction technical sheet, available on request).

Special categories of data (Art. 9): no collection intended; the free content of an exam paper may incidentally reveal such data - Examino makes no use of it.

3. Documented instructions

Examino processes the data only on the documented instructions of the Institution, embodied in this agreement and in the functional use of the application by the teacher. Examino informs the Institution if, in its opinion, an instruction infringes the GDPR.

Examino does not use imported content to train AI models, nor for any purpose of its own other than providing, securing and billing the service.

4. Confidentiality and personnel

The persons authorised to process the data are bound by a contractual confidentiality obligation. Access is limited to authorised personnel under the principle of least privilege (RBAC).

5. Security (Art. 32)

Main measures: encryption in transit (TLS 1.2+), hosting in the European Union, role-based access control, logging of access and processing, managed redundant backups. Details in Examino's security sheet (available on request).

6. Sub-processors

The Institution grants a general authorisation for the engagement of the sub-processors listed below. Examino informs the Institution of any change (objection period: 30 days) and imposes on each sub-processor obligations equivalent to those set out herein. The up-to-date and detailed version of this list (precise data location, transfer mechanisms) is published at: https://examino.ai/en/legal/subprocessors.

Infrastructure subprocessors:

* Subprocessors that never process student data (billing data, product events without student data, teacher dictation audio, business contacts, registered users' email addresses, support conversations).

AI model providers: each contractually commits not to use the submitted content to train its models; retention is limited to a short period (abuse detection, 30 to 55 days depending on the provider, extendable for flagged content), after which the content is deleted.

Transfers outside the EU: where sub-processors are established in a third country, the transfer is governed by an adequacy decision (including the EU-US Data Privacy Framework) or by Standard Contractual Clauses, supplemented by a transfer impact assessment. Details per subprocessor on the page referred to above.

7. Assistance to the Data Controller

Examino assists the Institution, insofar as this is possible and taking into account the nature of the processing:

• in responding to data subject rights requests (access, rectification, erasure, restriction, objection, portability) - requests received directly by Examino are forwarded to the Institution without being answered on the merits, unless instructed otherwise;

• with the obligations under Articles 32 to 36: security, breach notification (the Institution is informed without undue delay and at the latest within 48 hours of Examino becoming aware of it, with the elements of Art. 33(3)), DPIA and prior consultation (Examino provides a pre-filled DPIA).

8. Fate of the data

At the end of the contract, or at the Institution's request, Examino deletes all exam papers and associated data (effective deletion, files included) or returns them in a structured format and then deletes them, unless legally required to retain them. Default periods during performance: exam paper data retained for the school year + 1 year (secondary education) or the duration of the programme + appeal periods (higher education), then deleted - modifiable on the Institution's instructions.

9. Automated decision-making

The service takes no decision producing legal effects by exclusively automated means (Art. 22 GDPR): every grade and comment is a suggestion subject to review and validation by the teacher, who remains the sole decision-maker. The application logs this review (time-stamped edit history).

10. Audit and documentation

Examino makes available to the Institution all the documentation necessary to demonstrate compliance with Article 28 (Art. 30(2) record, security sheet, list of subprocessors, model providers' no-training and retention terms) and allows audits, including by a mandated third party, subject to reasonable notice of 30 days, at most once a year except in the event of an established breach, at the Institution's expense and without access to other customers' data.

11. Term, applicable law

This agreement takes effect upon the first import of the Institution's student exam papers and remains in force for as long as Examino processes data on its behalf. French law; jurisdiction of the administrative or judicial courts depending on the nature of the Institution.

For Examino
Mr. Dimitri Nicolas, President

For the Institution
Name, capacity, date, signature: