Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between AI & Assessment Solutions Pty Ltd (trading as Thinking Mode) ABN 78 685 561 906 ("Thinking Mode", "we", "us") and the school or educational institution that has agreed to Thinking Mode's Terms of Service ("School", "you").

By using the Thinking Mode platform, the School agrees to the terms of this DPA. If you are entering into this DPA on behalf of a School, you represent that you have the authority to do so.

1. Definitions

• "Personal Data" Any information relating to an identified or identifiable natural person, as defined under applicable privacy law including the Australian Privacy Act 1988, the EU General Data Protection Regulation (GDPR), and the US Children's Online Privacy Protection Act (COPPA).
• "Student Data" Personal Data relating to students of the School that is processed by Thinking Mode in connection with the Services, including student first names, session transcripts, and AI interaction records.
• "Services" The Thinking Mode AI-powered conversational assessment platform made available at thinkingmode.com.
• "Processing" Any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

2. Roles of the Parties

For the purposes of this DPA and applicable privacy law:

• The School is the data controller (or equivalent) with respect to Student Data. The School determines the purposes and means of processing Student Data within the context of its educational activities.
• Thinking Mode is the data processor (or equivalent), acting on the School's instructions when processing Student Data to provide the Services.
• Thinking Mode may be an independent data controller with respect to the personal data of registered educators and coordinators (account profile, email address, login history) for the purpose of administering the platform.

3. Lawful Basis for Processing

3.1 Australian Privacy Act (Australian Schools)

Thinking Mode complies with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Relevant to this DPA:

• APP 3 (Collection): Thinking Mode collects Student Data only as instructed by the School and only to the extent necessary to provide the Services.
• APP 8 (Cross-border Disclosure): The School acknowledges and consents to the cross-border transfer of Personal Data to the countries listed in Schedule A (Sub-processors) for the purposes of providing the Services. Thinking Mode takes reasonable steps under APP 8.1 to ensure overseas recipients handle data consistently with the APPs.
• APP 12 & 13 (Access and Correction): Individuals may access or correct their data by contacting Thinking Mode at privacy@thinkingmode.com.

3.2 GDPR (EEA/UK Schools)

Where the GDPR applies, the School's lawful basis for instructing Thinking Mode to process Student Data is legitimate interests (Article 6(1)(f)) in providing educational services, or performance of a task carried out in the public interest (Article 6(1)(e)) where applicable. The School is responsible for establishing and documenting its own lawful basis.

3.3 COPPA (US Students Under 13)

Thinking Mode does not knowingly collect personal information from children under 13 except through the School Operator Exception under COPPA (16 C.F.R. § 312.2). By entering into this DPA, the School:

• confirms it has obtained verifiable parental consent on behalf of parents, or that consent is not required under applicable law for the educational context;
• acknowledges it is acting as an operator for purposes of COPPA; and
• agrees to direct any parent or guardian data-access or deletion requests to Thinking Mode at privacy@thinkingmode.com.

4. Thinking Mode's Obligations

Thinking Mode agrees to:

• process Student Data only on documented instructions from the School and only for the purpose of providing the Services, unless required to do otherwise by applicable law;
• ensure that persons authorised to process Student Data are bound by appropriate confidentiality obligations;
• implement appropriate technical and organisational security measures to protect Student Data against unauthorised access, disclosure, alteration, or destruction (see Section 6);
• notify the School within 3 business days of confirming or reasonably suspecting that a Personal Data breach has affected Student Data, providing sufficient information for the School to meet its own notification obligations, and without waiting for completion of Thinking Mode's internal assessment or any regulatory notification process;
• assist the School, at the School's reasonable request and cost, in responding to data subject rights requests, data protection impact assessments, and regulatory enquiries;
• delete or return all Student Data upon termination of the Services in accordance with Section 7; and
• make available to the School such information as is reasonably necessary to demonstrate compliance with this DPA.

4.1 Scope and Scale of Data Shared via Integrations (LTI)

Where a School connects its Learning Management System (LMS) to the Services using LTI 1.1 or LTI 1.3, the following governs that data sharing:

• Purpose to link a student's LMS identity to a Thinking Mode session and to return assessment outcomes to the LMS.
• Scope limited to the data necessary for that purpose: the LMS-provided user and context identifiers (e.g. course or class context); the assessment result or score; the teacher’s written feedback, returned as an LMS comment; and, where the teacher chooses to include them, the student’s submission file and a PDF of the student’s conversation transcript (only the sections the teacher selects). Files are fetched by the School’s LMS via signed, time-limited links. No other Personal Data is shared through the integration.
• Scale limited to current users of the connected course or class; the integration does not perform bulk export of historical records beyond that context.
• Controls in the recipient system the connected LMS is the School's own system and the School is responsible for the security and privacy controls within it. Data is exchanged only over the secure, signed LTI protocol (OAuth 2 and message signing).
• Ownership Student Data shared via the integration remains the School's Student Data, as set out in Section 2.

This scope is reviewed, and this DPA is updated, to reflect any material change to the purpose, scope, scale, controls, or ownership of data shared via integrations.

5. Sub-processors

The School grants Thinking Mode a general authorisation to engage the sub-processors listed in Schedule A below. Before it takes effect, Thinking Mode will give the School written notice (by email to the School’s nominated contact, and by updating Schedule A on this page) of: (a) any intended addition or replacement of a sub-processor; (b) any change to the country in which Student Data, or related data such as metadata, logs and backups, is stored or processed; and (c) any relocation to another country of personnel, contractors or sub-processor staff with access to unencrypted Student Data or to the means of decrypting it. The School may object to such a change by notifying Thinking Mode at privacy@thinkingmode.com within 14 days of the notice; if the parties cannot resolve the objection, either party may terminate the relevant Services on 30 days' written notice.

Sub-processor Register

The following sub-processors are authorised to process data on Thinking Mode's behalf. Thinking Mode will notify affected parties of any intended addition or replacement of sub-processors before the change takes effect.

Sub-processor	Purpose	Data location	Certifications
Amazon Web Services (AWS)	Hosting (ECS), database (RDS PostgreSQL), object storage (S3), email (SES)	ap-southeast-2 (Sydney, AU)	ISO 27001, SOC 2, IRAP
Amazon Web Services (Transcribe + Polly)	Optional speech features: speech-to-text (Transcribe) transcribes student voice input; text-to-speech (Polly) reads AI tutor replies aloud. Audio is transcribe-and-discard — not persisted. Off by default; enabled per task by the educator.	ap-southeast-2 (Sydney, AU)	AWS AI services opt-out applied — no training on customer content; region enforced by IAM
Anthropic	LLM inference for student conversations and evaluations	United States	API terms: no training on customer data
OpenAI	LLM inference for student conversations and evaluations	United States	API terms: no training on customer data
Sentry	Error and performance monitoring (PII scrubbed on error/trace telemetry). User-feedback widget also transmits user-submitted messages + optional screenshots, which are NOT scrubbed and may contain student work/PII.	Germany (EU data region)	SOC 2 Type II; PII scrubbed on error/trace telemetry — feedback messages & optional screenshots excepted
Ably	Real-time message transport	EU / global edge	Does not persist message content
Storylane	Interactive product-demo embed on the public marketing site (logged-out visitors only)	United States	No student or customer account data processed
Stripe, Inc.	Payment processing (educator subscriptions only; no student payment data)	United States	PCI DSS Level 1
Google LLC	Anonymous usage analytics (Google Analytics 4) — optional and consent-gated; loads only after the visitor accepts analytics cookies. IP anonymisation enabled; no advertising or remarketing features.	United States	No Google Signals or advertising features enabled
Cloudflare, Inc.	Bot protection on public forms (Turnstile) — processes visitor IP address + a challenge token; no student work or account content	Global (nearest edge node)	ISO 27001, SOC 2

6. Security

Thinking Mode maintains appropriate technical and organisational measures including:

• encryption of data in transit (TLS 1.2+) and at rest via AWS managed encryption (database and object storage);
• role-based access controls — student session data is isolated per organisation and never accessible across tenants;
• multi-factor authentication available for all platform administrators; enabled by default for privileged roles (superadmin, coordinator);
• security event logging, rate limiting, and automated IP blocking for anomalous access patterns;
• continuous threat detection via AWS GuardDuty across infrastructure logs, network flows, and data access events;
• regular dependency updates and automated vulnerability scanning; and
• system prompts and educator intellectual property are segregated from student-facing API responses.

7. Data Retention and Deletion

Data Retention and Disposal

The Platform Access Conditions provide that data may be stored indefinitely unless the Customer requests deletion. This standard sets operational retention schedules that apply by default; customers may request earlier deletion at any time via privacy@thinkingmode.com or through the account deletion endpoint.

Active data

• Student session data: retained per organisation configuration. Defaults: 365 days for school plans, 120 days for personal plans.
• Educator and administrator accounts: retained for the life of the account
• Task content and AI evaluations: retained for the life of the associated task

Archived data

• On soft-deletion of a student session: data moved to archive tables and held for 30 days, then permanently deleted by the nightly purge reaper
• Safety event log content: auto-redacted after 12 months by the nightly redaction reaper; metadata (type, severity, timestamp) retained
• Security and audit event logs: auto-purged after 2 years by daily security-events reaper; exportable by superadmin
• Email delivery log (recipient address, subject, message body, delivery status): auto-deleted after 12 months by the daily email-log reaper. The email suppression list of bounced and complained addresses is kept separately so those addresses are not mailed again.
• Re-entry code emails to students (optional feature): the message body — containing the student's entered identifier and the re-entry code — is auto-deleted after 90 days by the nightly reaper; the remaining delivery record is deleted with the email delivery log after 12 months. The recipient email address is never stored (redacted from the email log at send time).
• Automated database backups: retained for 14 days and expire automatically; not subject to individual deletion requests

Account closure

• On confirmed account deletion request via /api/account/delete: all associated records (tasks, sessions, messages, evaluations, rubrics) are cascade-deleted
• School-attached accounts are soft-deleted to preserve coordinator assignment integrity; fully purged on org closure
• Deletion requests logged in security_events audit table with actor identity
• The School may request earlier deletion of Student Data by contacting privacy@thinkingmode.com

8. International Data Transfers

Primary platform data (database and object storage) is hosted in AWS ap-southeast-2 (Sydney, Australia). Student Data processed by certain sub-processors (see Schedule A) may be transferred to and stored in the United States for AI inference purposes.

For Schools in the EEA or UK, Thinking Mode is working toward formal SCC coverage. Contact privacy@thinkingmode.com to discuss your school's requirements.

For Australian Schools, the School's entry into this DPA constitutes its consent to cross-border disclosure under APP 8.

9. Confidentiality

Each party agrees to keep confidential the other party's Confidential Information and to use it only for the purposes of this DPA. "Confidential Information" includes Student Data, platform system prompts, pricing, and any information marked confidential.

10. Term and Termination

This DPA commences when the School begins using the Services and continues until the School's account is terminated. Either party may terminate this DPA on 30 days' written notice. Sections relating to confidentiality, data deletion, and liability survive termination.

11. Limitation of Liability

Each party's total liability under this DPA shall be subject to the limitations set out in the Thinking Mode Customer Agreement and Terms of Service.

12. Governing Law

This DPA is governed by the laws of South Australia, Australia. The parties submit to the non-exclusive jurisdiction of the courts of South Australia, except where mandatory consumer or privacy law provisions of another jurisdiction apply. Australian Privacy Act 1988 (Cth) obligations apply nationally.

13. Contact

For privacy enquiries, data subject rights requests, or to exercise any right under this DPA, contact:

AI & Assessment Solutions Pty Ltd (trading as Thinking Mode)

Email: privacy@thinkingmode.com

This DPA will be updated when sub-processors change or applicable law requires. Schools will be notified of material changes.