Data Processing Agreement

Version dated: June 16, 2026

This Data Processing Agreement (“DPA”) is entered into between Fynaxis, operator of Typing Safari (the “Provider”), and the school, district, camp, or organization that uses the Service (the “Customer”). It governs the Provider’s processing of personal information — including student and children’s data — on the Customer’s behalf, and forms part of the agreement between the parties for use of Typing Safari (the “Service”). To execute this DPA for your institution, contact privacy@typingsafari.com.

1. Roles of the parties

For personal information the Customer submits or that is generated by roster members, the Customer is the controller (and, for U.S. schools, the educational agency) and the Provider is the processor / service provider. The Provider processes such data only to provide the Service and only on the Customer’s documented instructions, which include this DPA and the Customer’s configuration of the Service.

2. Scope & nature of processing

• Subjects: the Customer’s roster members (students/children), staff (teachers/counselors), and account holders.
• Data types: a display name (first name + last initial by design), an optional identifier (e.g. a student number), a login PIN, and typing activity (WPM, accuracy, lesson/game progress). No child email or contact details are required.
• Purpose: to deliver typing lessons, practice, games, progress tracking, leaderboards, and certificates for the Customer.

3. Provider obligations

• Process personal information only for the purposes above and per the Customer’s instructions; not for the Provider’s own commercial purposes.
• Never sell personal information, serve targeted advertising, build non-educational profiles, or use student/children’s data to train AI/ML models.
• Ensure personnel with access are bound by confidentiality.
• Implement reasonable administrative and technical security measures (see §6).
• Assist the Customer in responding to data-subject, parent, and regulator requests.

4. Customer obligations & authorization

The Customer represents that it is authorized to provide the personal information it submits and, where required by law, has obtained parental consent or is relying on a lawful basis (including COPPA’s school-authorization provisions) to add roster members. The Customer is responsible for the accuracy of roster data and for using first-name-plus-initial display names rather than full legal names.

5. Sub-processors

The Customer authorizes the Provider to engage the sub-processors listed in the Privacy Policy (currently: hosting/database/auth, application delivery, payment processing, transactional email, and bot protection). Each is bound by data-protection terms no less protective than this DPA. The Provider will give notice of material changes and the Customer may object on reasonable data-protection grounds.

6. Security

The Provider maintains safeguards including encryption in transit, row-level access controls, least-privilege administrative access, and audit logging of privileged actions. The Provider reviews these measures periodically.

7. Data-breach notification

The Provider will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer’s data, with the information reasonably available to support the Customer’s own notification obligations.

8. Data subject, parent & school rights

The Customer (and, through it, parents/guardians) may review, correct, export, or delete a roster member’s data at any time via the Service (roster management) or by contacting privacy@typingsafari.com. The Provider will assist with such requests and will not charge schools for them.

9. Retention, return & deletion

The Provider retains personal information only while the account or roster membership is active. On termination, or on the Customer’s request, the Provider will delete or return the Customer’s personal information within a reasonable period, except where retention is required by law. Deleting a roster member removes their data (including typing history).

10. FERPA (U.S. schools)

Where the Customer is subject to the Family Educational Rights and Privacy Act (FERPA), the Provider acts as a “school official” with a legitimate educational interest, under the Customer’s direct control. The Provider uses education records solely to provide the Service, does not re-disclose them except as directed or required by law, and returns or deletes them on request. Student data is not used for advertising, sold, or used to train AI/ML models.

11. COPPA (U.S. children under 13)

For children under 13, the Customer provides consent on behalf of parents under COPPA’s school-authorization provisions, or confirms it has obtained verifiable parental consent. The Provider collects only the limited data described in §2, provides parents/schools the right to review and delete it, and does not condition participation on collecting more than is reasonably necessary.

12. International transfers

Personal information is hosted in the United States (Oregon / AWS US-West) and may therefore be processed in a country other than the Customer’s own. Where required, the parties will rely on an appropriate transfer mechanism (e.g. Standard Contractual Clauses).

13. Term & termination

This DPA takes effect when the parties execute it (or when the Customer accepts it as part of using the Service) and remains in force while the Provider processes the Customer’s personal information. §§6–11 survive termination as to any data retained.

14. Governing law & execution

This DPA is governed by the laws of Canada, without prejudice to mandatory data-protection laws applicable to the Customer. To execute a countersigned copy for your district or institution, contact Fynaxis at privacy@typingsafari.com.

See also our Privacy Policy and Terms of Service.