When using this app, personal data is processed by the provider. The provider always processes the data on behalf of the school. In order to work in compliance with the GDPR, an Data Processing Agreement (DPA) is required between the school and the provider. This can usually be concluded with the provider before or during the first use. A sample contract is available for download here.