Personal Data Assistant Agreement
Grow Planet — Data Processing Agreement
1. Parties and scope
This agreement forms part of the agreement for trial or paid use of Grow Planet between the customer identified in the service order or registration ("Customer") and Gro Play Digital AB, corporate identity number 556895-7566, Magnus Ladulåsgatan 39, SE-118 65 Stockholm, Sweden ("Gro Play").
The Customer is the controller of personal data processed on its behalf in Grow Planet. Gro Play is its processor. If the Customer acts for another controller, it must have authority to appoint Gro Play as a subprocessor. Data protection enquiries may be sent to privacy@groplay.com.
2. Processing instructions
The Customer instructs Gro Play to process personal data to provide, administer, support and secure the Grow Planet game and learning management system, including accounts, schools and classes, agreed integrations and student activities and progress. Processing includes collection, storage, retrieval, updating, authorised disclosure, export and deletion.
Data subjects are students, teachers, school administrators and other users covered by the agreed service. Data includes names or pseudonyms, account and authentication information, contact details, school/class membership, game login codes, activity/progress records and necessary technical and security data. Students may use pseudonyms where full names are unnecessary. Special-category data and criminal-offence data must not be supplied without a separate agreement.
Processing continues for the agreed trial or paid service and the return/deletion period below. These terms are the Customer's documented instructions; additional instructions may be agreed in writing.
The Customer is responsible for its lawful basis, information to data subjects and authorised use of the service. Gro Play shall process Customer personal data only on documented instructions, including for transfers outside the EU/EEA, unless EU or Member State law requires otherwise. Gro Play shall inform the Customer before legally required processing unless prohibited by law, and shall immediately inform it if an instruction appears to infringe applicable data protection law.
3. Confidentiality and security
Gro Play shall ensure that authorised personnel are bound by confidentiality and have access only as necessary for their duties. Gro Play shall implement appropriate technical and organisational measures under Article 32 GDPR, taking account of the processing and risks to individuals. These include appropriate access controls, protection of authentication information, secure transmission, backup/recovery arrangements and regular assessment of security. Gro Play shall not use Customer personal data for unrelated advertising or sell it.
4. Assistance, incidents and oversight
Taking account of the nature of processing, Gro Play shall assist the Customer by appropriate technical and organisational measures, insofar as possible, with data subject requests. Taking account of the information available, Gro Play shall also assist with security, breach notifications, data protection impact assessments and prior consultation under Articles 32–36 GDPR.
Gro Play shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. It shall provide available information about the breach, affected data and people, likely consequences, mitigation and a contact point, with updates as information becomes available.
Gro Play shall provide information necessary to demonstrate compliance with Article 28 GDPR and allow and contribute to audits, including inspections, by the Customer or its mandated auditor. Audits shall be reasonably coordinated without preventing effective oversight.
5. Service providers and international transfers
The Customer gives general written authorisation for Gro Play to use the subprocessors identified in the provider list below. Gro Play shall impose the same applicable data protection obligations by written agreement and remains fully liable to the Customer for their performance.
Gro Play shall notify the Customer in writing at least thirty days before an intended addition or replacement, giving the provider, purpose and locations. The Customer may object on data protection grounds during that period. The affected processing shall not start while a relevant objection is unresolved; the parties shall seek an alternative or agree termination of the affected service.
Customer personal data shall be processed within the EU/EEA unless the Customer has given prior written approval and instructions for other locations. Transfers outside the EU/EEA additionally require an applicable Chapter V GDPR safeguard and any necessary assessment and supplementary measures.
Provider list
| Provider / service | Purpose and relevant data | Location |
|---|---|---|
| Microsoft — Azure | Application hosting, SQL database, media/file storage, Redis caching and abuse-control counters, and operational logging. Processes account, school/class, progress and relevant technical data as used by these services. | Primary application, SQL, storage, Redis and Log Analytics resources are configured in Azure North Europe (Ireland). This resource region does not establish the location of every backup, support operation or onward transfer. |
| Loopia — email hosting and SMTP | Sending and hosting service email, including account verification, password resets, contact messages and reports where used. Processes recipient/sender addresses, email contents and delivery metadata. | Loopia states that its email service is stored in Sweden and identifies its Swedish server hall as Västerås. |
| Cloudflare — Turnstile | Protecting the public forms described in section 6. Technical signals include IP address, TLS fingerprint, User-Agent, sitekey and associated origin. The server verification request does not include the form's email address or message text. | Processing is not restricted to the EU/EEA. See section 6 for processing roles and international-transfer requirements. |
Diagnostic monitoring: Gro Play uses Sentry for application diagnostics, with data storage in the United States. The application removes the event's user object and applies filtering intended to redact personal data. These measures are not a guarantee that all diagnostic data is anonymous. To the extent that Sentry processes Customer personal data on Gro Play's behalf, the subprocessor and international-transfer requirements of this section apply.
Loopia location source: Where are your servers located? (checked 16 October 2026).
Cloudflare source: Turnstile Privacy Addendum (last updated 18 June 2025; checked 16 October 2026).
6. Cloudflare Turnstile
Grow Planet uses Cloudflare Turnstile to protect contact, manual registration, password-reset and email-verification resend forms against automated abuse. Visitors' browsers connect to Cloudflare, which processes technical signals such as IP address, TLS fingerprint, browser information, sitekey and associated website origin. Grow Planet verifies the resulting token with Cloudflare; the server's verification request does not include the form's email address or message text.
Cloudflare states that it acts as a processor for website protection and as a separate controller when processing signals to improve its bot detection. Cloudflare states that it relies on legitimate interests for its own improvement processing; this does not determine the lawful basis for Gro Play's or the Customer's processing.
Turnstile processing is not guaranteed to take place exclusively within the EU/EEA and may involve processing outside the EU/EEA. The location of Grow Planet's Azure hosting does not restrict where Cloudflare processes Turnstile signals. Cloudflare's Turnstile Privacy Addendum does not specify storage countries or a fixed retention period.
Where Customer personal data is involved, the instructions, authorisation and international-transfer requirements in section 5 apply. Any required Chapter V GDPR safeguards must be established under the applicable arrangements; this agreement does not assert that a specific transfer mechanism has been verified. Listing Cloudflare here does not itself authorise its separate-controller processing or override stricter existing Customer agreements. Any required Customer approval and amended instructions must be obtained separately.
See the Turnstile Privacy Addendum, Cloudflare Privacy Policy and Cloudflare Data Processing Addendum. Grow Planet's privacy policy describes processing for which Gro Play is itself the controller. Roles depend on actual processing, not just the form used.
7. End of service and deletion
At the end of a trial without an agreed continuation, or at the end of paid use, Gro Play shall, at the Customer's choice, return or delete Customer personal data and delete existing copies, unless EU or Member State law requires retention. Confidentiality and protection continue while data remains held.
Backups awaiting deletion shall remain protected and unavailable for ordinary use. If restored, required deletions shall be reapplied.
8. Acceptance and applicable law
This agreement may be incorporated into the service order or accepted electronically by an authorised representative. The accepted version, date and Customer identity must be retained. No separate paper signature is required where valid electronic acceptance is used.
Publishing or changing this page does not by itself amend existing signed agreements. Changes require valid agreement, except for subprocessor updates under the notice and objection procedure above. This agreement takes priority over conflicting service terms concerning processor obligations, without limiting mandatory rights or liability under GDPR.
Swedish law applies, subject to mandatory applicable law. Disputes shall be determined by the competent Swedish courts.
Version: version 2, date: 2026-10-16
