Letros

Data Processing Agreement

This Data Processing Agreement ("DPA") is between the school, teacher or organisation that uses Letros ("the School") and TOTORO TEACHER DOO BAR, Topolica III, Bar, Montenegro ("Letros", "we"). It is part of our Terms of Service and applies whenever we process personal data on the School's behalf. The School accepts it by using Letros; no signature is needed. To keep a copy, print this page or save it as PDF.

Terms such as "personal data", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the EU General Data Protection Regulation ("GDPR"). This DPA is written to meet Article 28 GDPR and applies in the same way under the UK GDPR and the Swiss data protection act.

1. Roles

For the data of students, teachers and other people that the School puts into Letros, the School is the controller and Letros is the processor. For our own account, billing, security and usage records we are the controller, as described in the Privacy Policy.

2. Subject, duration, nature and purpose

  • Subject: providing Letros, an online platform for language teaching, to the School.
  • Duration: while the School uses Letros, and after that until the data is deleted under section 10.
  • Nature: storing, organising, displaying, transmitting, analysing (including with AI features the School chooses to use) and deleting data.
  • Purpose: letting the School run classes, live lessons, courses and homework, check written work, communicate with students and manage accounts. We do not use School data for advertising, do not sell it, and do not use it to train AI models.

3. Data subjects and categories of data

  • Data subjects: the School's students (who may be children under 16, or under 13), teachers and administrators.
  • Data: name, username, email address, class membership, role; lessons, homework, answers, essays and their photos, comments, grades, points and attendance; uploaded files; sign-in and activity records (time, approximate location from the IP address, browser type).
  • Special categories: none are required. The School should not put health, religious or similar sensitive data into Letros; if a student writes such content in an essay, it is processed only to provide the service.
  • Children: the School is responsible for having a lawful basis to create accounts for children, including the consent of parents or guardians where the law requires it. We process children's data only to provide the service to the School.

4. Instructions

We process School personal data only on the School's documented instructions: the Terms, this DPA, and what the School does and configures in Letros. If EU or member-state law requires other processing, we tell the School first unless the law forbids it. If we believe an instruction breaks data protection law, we tell the School.

5. Confidentiality

Only people who need access to provide or support the service can access School data, and they are bound by confidentiality obligations. We access a School's content only to provide the service, to answer the School's support request, or when the law requires it.

6. Security

We apply the technical and organisational measures in Annex 1 and keep them at a level appropriate to the risk, as Article 32 GDPR requires. We may improve them over time but will not lower the overall level of protection.

7. Sub-processors

The School gives a general authorisation for us to use sub-processors. The current list, with what each one does, which data it receives and where, is on the sub-processors page. We update that page at least 30 days before a new sub-processor starts processing School data and notify School administrators by email. The School may object in that period on reasonable data protection grounds; if we cannot resolve the objection, the School may stop using Letros and receive a refund of any unused prepaid period. Each sub-processor is bound by data protection terms that give at least the same protection as this DPA, and we remain responsible for its work.

8. Help with data subject requests and compliance

School administrators can view, correct, pause and delete student and teacher accounts in Letros; an account that already has lesson or homework history is deleted by us on the School's request. If a data subject contacts us directly about School data, we pass the request to the School without undue delay and do not answer it ourselves unless the School asks us to. We help the School, taking into account the nature of the processing and the information available to us, with requests we cannot handle through the app (for example an export), and with data protection impact assessments and consultations with supervisory authorities.

9. Personal data breaches

We notify the School without undue delay, and no later than 48 hours after we become aware of a personal data breach affecting School data. The notice goes to the School's administrator email and describes, as far as known, what happened, the data and number of people affected, the likely consequences, and what we have done and recommend. We add information as it becomes available and take reasonable steps to contain the breach.

10. Deletion or return at the end

When the School stops using Letros, it can delete its data in the app or ask us to export it. Within 30 days of the School's request, or of the end of the service, we delete School personal data, unless the law requires us to keep it. Copies in backups are deleted as the backups expire, within 30 days, and are not used in the meantime.

11. Audits

We make available the information needed to show compliance with this DPA and answer reasonable security questionnaires. The School, or an independent auditor it appoints who is bound by confidentiality, may audit our compliance once a year with at least 30 days' written notice, at the School's cost, during business hours and without access to other customers' data. More often only after a personal data breach or when a supervisory authority requires it.

12. International transfers

Letros stores School data on servers in Germany (EU). TOTORO TEACHER DOO BAR is established in Montenegro. Where School data from the EEA, the UK or Switzerland is accessed from or transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply and are incorporated by reference: Module Two (controller to processor) between the School and us, and Module Three (processor to processor) with our sub-processors. For those clauses: clause 7 does not apply; under clause 9 option 2 applies with the notice period in section 7; the optional wording in clause 11 does not apply; clauses 17 and 18 choose the law and courts of Germany; Annex I is sections 1 to 3 of this DPA and Annex II is Annex 1. For the UK, the UK International Data Transfer Addendum applies alongside them, and for Switzerland, references to the GDPR include the Swiss act.

13. Schools in the United States

For schools subject to FERPA, we act as a school official with a legitimate educational interest: we use education records only to provide the service to the School, under the School's direct control, and do not disclose them except to sub-processors as described here. Where COPPA applies, the School may consent to the collection of personal information from children under 13 on behalf of their parents, for the educational purpose only; we use it for no other purpose.

14. Precedence and liability

If this DPA conflicts with the Terms on the processing of personal data, this DPA wins; the Standard Contractual Clauses, where they apply, win over both. Liability under this DPA follows the Terms, except where the law does not allow a limitation. We may update this DPA to follow changes in the law or our service; we will tell School administrators before material changes take effect, and changes will not reduce the protection of School data.

Annex 1. Technical and organisational measures

  • Hosting: dedicated servers in Germany. Server access only with SSH keys (no passwords), a firewall that allows only web and SSH traffic, automatic blocking of repeated failed logins, and regular security updates. The database is not reachable from the internet.
  • Encryption in transit: all traffic to Letros uses HTTPS (TLS). Calls to sub-processors use TLS.
  • Passwords and sessions: passwords are stored as Argon2id hashes. Passwords a school issues to students are additionally kept encrypted (AES-256-GCM) so the school can see them, until the student sets their own. Session cookies are HTTP-only and secure. Sign-in attempts and codes are rate-limited.
  • Access control: every School's data is separated by school; roles (administrator, teacher, student) limit what each user can see and change, and these rules are covered by automated tests. Only the operator's authorised staff can access servers.
  • Data minimisation: for usage statistics we store a salted hash of the IP address, not the address. Only the data a feature needs is sent to a sub-processor; pictures and speech get teaching text only.
  • Availability and recovery: the database is backed up daily, backups are kept for 30 days, and a copy is held on a second server.
  • Change management: code changes are reviewed and pass automated tests before they reach production.
  • Incidents: service health is monitored, and breaches are handled as in section 9.

Last updated: 22 October 2026. Contact: hello@letros.app. Letros is operated by TOTORO TEACHER DOO BAR, Topolica III, Bar, Montenegro.

Data location: Germany (EU). Schools: Data Processing Agreement · Sub-processors.