For Schools: Data Processing Agreement

Effective October 13, 2026

When a teacher uses HexoQuest in school, the school is the controller of its students' data and BOREA IT, Računalniške rešitve, d.o.o. is the processor. This agreement sets out the terms of processing under Article 28 of the GDPR (and the UK GDPR). A teacher who creates classes for students of a school accepts it on behalf of the school. If your school needs a signed copy, write to info@hexoquest.com.

1. Subject matter and duration

The processor provides the controller with an online classroom for learning to code. Processing lasts while the school's teachers use their classes and ends when a class, a student or the teacher account is deleted.

2. Types of data and data subjects

• Students: nickname, PIN hash, class membership, progress in the levels, work they build, dates of joining and last activity, optional level ratings and comments, and usage statistics (which levels were opened and solved; kept for 2 years).
• Teachers (school staff): name, email, school, password hash, plan information.

No special categories of data are processed. HexoQuest is designed so that students do not enter names or contact details.

3. Purpose and nature of processing

Storing and showing students' progress to their teacher for teaching purposes. Data is not used for any other purpose: not for advertising, profiling or training AI models.

4. Obligations of the processor

• Processes data only on the documented instructions of the controller, given through the features of HexoQuest (creating, editing and deleting classes and students).
• Ensures that persons with access to the data are bound by confidentiality.
• Implements appropriate technical and organizational measures: HTTPS, hashed passwords and PINs, database outside the public web root, rate limiting, regular security updates and backups.
• Uses only the hosting provider as a sub-processor: [DOPOLNI: hosting provider and country, e.g. Hetzner Online GmbH, Germany]. Gives at least 30 days' notice of any change on this page. Student data is not shared with the payment provider.
• Does not transfer student data outside the European Economic Area.
• Assists the controller with data subject requests; most can be handled directly by the teacher (deleting a student, exporting data).
• Notifies the controller without undue delay, and at the latest within 48 hours of discovery, of a personal data breach.
• Deletes the data at the end of processing: immediately when a class or account is deleted, and from backups within 30 days.
• Makes available the information needed to demonstrate compliance and allows reasonable audits by prior arrangement.

5. Obligations of the controller

• Ensures a legal basis for the processing and informs students and parents. A template letter for parents is available in the teacher dashboard.
• Makes sure that class codes are given only to its students and that students do not enter personal data.
• Deletes students' data when it is no longer needed.

6. Contact

BOREA IT, Računalniške rešitve, d.o.o., Budanje 6G, 5271 Vipava, Slovenia, info@hexoquest.com.