Scholé

Data Processing Agreement

Last updated: March 30, 2026

ENDEFRITESPTTR

1. Introduction

1.1 This Data Processing Agreement ("DPA") governs the processing of personal data by Scholé Sàrl, EPFL IC IINFCOM ML4ED — INF 231 (Bâtiment INF) — Station 14, 1015 Lausanne, Switzerland ("Provider") on behalf of any organization or individual that uses the Scholé platform and related services ("Customer"). This DPA forms part of the agreement between the Customer and the Provider and reflects the parties' commitment regarding the processing and security of Customer Personal Data.

1.2 The terms "data subject", "processing", "controller" (respectively "controller of the data file") and "processor" used in this DPA shall have the meanings specified in the Swiss Data Protection Legislation or the GDPR, depending on their respective scope of application. Capitalised terms are defined in Section 12.

2. Data Protection Legislations

2.1 The following data protection legislations may, depending on the circumstances, apply to the processing of Customer Personal Data:

  • The Swiss Data Protection Legislation
  • The EU General Data Protection Regulation (GDPR)
  • Other Applicable Data Protection Legislation

2.2 Unless otherwise stated, the provisions of this DPA shall apply regardless of which legislation applies to the processing of Customer Personal Data.

3. Data Processing

3.1 Roles and Compliance

3.1.1 If the Swiss Data Protection Legislation or the GDPR apply: (a) the Customer is a controller, or a processor for a third party, of Customer Personal Data; (b) the Provider is a processor of Customer Personal Data, except when it processes data to conform with legal obligations applicable to it or for its internal business operations incident to service delivery (in which case it acts as an independent controller); and (c) each party shall comply with its obligations under the applicable legislation.

3.1.2 If the Customer is a processor for a third party, the Customer warrants that it has obtained the express prior authorization of the applicable controller regarding the Customer's instructions and the designation of the Provider as another processor.

3.2 Scope of Processing

3.2.1 The Provider shall process Customer Personal Data in accordance with this DPA. When acting as processor, the Provider undertakes to process Customer Personal Data only on documented instructions from the Customer, unless legislation applicable to the Provider requires other processing, in which case the Provider shall inform the Customer of that legal requirement before processing.

3.2.2 By accepting this DPA, the Customer instructs the Provider to process Customer Personal Data only to provide and improve the Services, as documented in this DPA and the applicable Agreement. Any additional or alternate instructions must be agreed in writing.

3.3 Obligations of Customer

The Customer shall be responsible for the quality, lawfulness and relevance of the Customer Data processed in the context of the Services and shall be liable to third parties affected by the processing. In particular, the Customer shall:

  • Provide sufficient information to data subjects about the collection and processing of their personal data
  • Obtain valid consent of data subjects where required under Applicable Data Protection Legislation
  • Ensure compliance with all rights of data subjects (e.g. right of access and rectification, right to object) and obligations towards competent data protection authorities
  • Only delegate to the Provider processing operations that the Customer would be entitled to carry out itself

3.4 Responsibility

The Customer shall bear sole responsibility for the processing of Customer Personal Data within the frame of the Services. The Customer acknowledges and accepts that the Provider shall deem any processing of Customer Personal Data within the frame of the Services, as permitted under the Agreement, as compliant with all applicable laws.

4. Deletion of Data

Upon termination of the relationship, the Customer may request that the Provider transfer all Customer Personal Data (including any existing copies) to the Customer or a third party designated by the Customer. The Provider shall comply as soon as possible, unless it must retain all or part of Customer Personal Data for technical or legal reasons, in which case the Provider shall store and process such data for those reasons only and shall be able to demonstrate having taken appropriate technical and organizational safeguards.

5. Data Security

5.1 Security Measures

5.1.1 The Provider implements and maintains appropriate technical and organisational measures to protect Customer Personal Data against Security Incidents. Customer data is:

  • Stored in Switzerland on Microsoft Azure infrastructure
  • Encrypted at rest and in transit
  • Logically separated from all other customers' data
  • Protected following industry best security practices

5.1.2 The Provider takes appropriate measures to ensure compliance with the security measures by its employees and subcontractors, in particular by ensuring that all persons authorized to handle Customer Personal Data are contractually bound to maintain confidentiality or are subject to an appropriate legal obligation of confidentiality.

5.2 Security Incidents

5.2.1 If the Provider becomes aware of a Security Incident, it shall inform the Customer as soon as possible by any useful means, describing the nature of the incident, measures taken to mitigate potential risks, and recommended measures for the Customer.

5.2.2 The Provider will not review the content of Customer Data for the purpose of identifying the type of data involved. The Customer shall be solely responsible for complying with applicable notification obligations to competent authorities and/or data subjects. The Provider shall provide reasonable assistance to the Customer in this regard.

5.3 Audits

5.3.1 Where the GDPR applies, the Provider shall make available to the Customer all documents and information reasonably necessary to demonstrate compliance with its obligations under this DPA.

5.3.2 Where the GDPR applies, the Provider shall allow the Customer or an independent auditor appointed by the Customer to conduct audits (including inspections) to verify compliance. Unless there are exceptional circumstances, the Customer may not make more than one request per year. Audit requests must be communicated in writing, specifying the data concerned, the reasons, the specific obligations to be audited, and an undertaking that information collected will only be used to ensure compliance.

6. Provider's Assistance

6.1 The Provider shall, if requested by the Customer, provide reasonable assistance for the Customer to meet its obligations under the Swiss Data Protection Legislation or the GDPR.

6.2 If the Provider receives a request from a data subject regarding Customer Personal Data, the Provider shall direct the data subject to submit the request to the Customer. It is the sole responsibility of the Customer to respond to such requests.

6.3 The Provider shall assist the Customer in complying with its obligations to data subjects, to the extent reasonable and compatible with the functionality of the Services, covering all rights under Applicable Data Protection Legislation (access, rectification, limitation, objection, erasure and portability).

6.4 Where the GDPR applies, the Provider undertakes to assist the Customer in ensuring compliance with data protection impact assessment and prior consultation obligations pursuant to Articles 35 and 36 GDPR or the Swiss Data Protection Legislation, to the extent it can reasonably be expected to do so.

7. International Data Transfers

7.1 Unless otherwise provided, the Provider shall retain and process Customer Personal Data in Switzerland and the European Union, or in a country recognised by the European Commission and Switzerland as ensuring an adequate level of personal data protection.

7.2 The Provider shall inform the Customer prior to any transfer to a country not specified above and the Customer undertakes to authorize such transfer provided the Provider can guarantee an adequate level of protection by any useful means.

7.3 Where the Provider engages a sub-processor in a third country not recognised as ensuring adequate protection, the Provider may use Standard Contractual Clauses of the European Commission, or another lawful mechanism, to comply with the GDPR or the Swiss Data Protection Legislation.

8. Sub-Processing

8.1 The Customer authorizes the Provider to use sub-processors, which may be affiliated entities or third parties. The Provider shall inform the Customer in advance and in writing of any planned changes with respect to the addition or replacement of sub-processors, to permit the Customer to raise objections.

8.2 The Provider ensures that: (a) sub-processors only access and process Customer Personal Data to the extent necessary to perform their obligations; (b) sub-processors have contractual obligations at least equivalent to those in this DPA; and (c) where the GDPR applies, the obligations set forth in Article 28(3) GDPR have been imposed on the sub-processor.

8.3 The Customer shall have 30 days after being informed of a planned addition or replacement to submit objections. If the Provider confirms the appointment, the Customer may terminate the applicable Agreement with immediate effect by written notice within 14 days. Failure to react within these deadlines shall be deemed acceptance.

The current list of sub-processors, with the country, region of processing, purpose and transfer basis for each, is published at app.schole.ai/sub-processors.

9. Register of Processing Activities

The Customer acknowledges that the Provider may be required to collect and store certain information (including the name and contact details of each processor and/or controller, and the categories of processing carried out) and make such information available to any competent authority. The Customer undertakes to provide the Provider with all information reasonably necessary to meet these obligations.

10. Contact for Data Protection Matters

If the GDPR requires the Customer to appoint a data protection officer, the Customer must provide that person's contact details to the Provider.

All communications to the Provider relating to this DPA and/or data protection shall be addressed to: Data Protection Team, privacy@schole.ai

11. Miscellaneous

11.1 The terms of any applicable Agreement shall apply to all aspects not covered by this DPA.

11.2 In the event of a conflict between this DPA and the terms of any applicable Agreement, the terms of this DPA shall take precedence, subject to express derogations specified in the Agreement.

11.3 This DPA is effective as long as the Customer uses the Services. It shall remain in effect until the expiry or termination of the applicable Agreement, including any period during which the Provider continues to store Customer Personal Data. Either party may terminate this DPA with 6 months' written notice.

11.4 If any provision of this DPA is held to be invalid or unenforceable, the parties shall replace it with a substitute provision achieving the same legal and economic purposes. The remainder of this DPA shall remain in full force and effect.

11.5 This DPA shall be governed by Swiss law (without reference to its conflict of laws provisions). Any dispute shall be submitted to the exclusive jurisdiction of the courts at the registered office of the Provider, subject to the right to appeal to the Swiss Federal Tribunal.

12. Definitions

  • "Agreement" means any agreement between the Customer and the Provider regarding the performance of Services, including the Terms of Service.
  • "Applicable Data Protection Legislation" means the Swiss Data Protection Legislation, the GDPR, and any Other Applicable Data Protection Legislation.
  • "Customer Data" means data transmitted by the Customer to the Provider, collected by the Provider on behalf of the Customer, or generated by the Provider in connection with the Services.
  • "Customer Personal Data" means any information relating to an identified or identifiable natural person contained in Customer Data, in accordance with Applicable Data Protection Legislation.
  • "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
  • "Security Incident" means a security breach resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
  • "Services" means all services provided by the Provider to the Customer, including the Scholé platform and related services.
  • "Swiss Data Protection Legislation" means the Swiss Federal Data Protection Act and its implementing ordinances, as may be amended from time to time.