Data Processing Agreement (DPA)

1. Roles of the parties

The School is the controller of the personal data of its Students, guardians, Teachers and Staff: it decides why and how that data is used. Surf Academy ([LEGAL NAME], CNPJ [CNPJ], [ADDRESS]) is the processor: it handles that data on the School's behalf, only to provide the service and under the School's instructions.

For each person's account data (access, security, preferences) and for the security and improvement of the service, Surf Academy acts as controller, as set out in the Privacy Policy (/privacidade).

2. Subject matter and duration

This agreement lasts while the School uses the service and until the data is returned or deleted under section 13. The School's instructions are the normal use of the service and this agreement. Additional instructions must be given in writing.

3. Data subjects and data categories

• Data subjects: Students (including children and teenagers), parents and guardians, Teachers, Staff and anyone else the School registers.
• Registration: name, e-mail, phone, photo, language, birth date, level, goal and preferred spot.
• Minors: the guardian's name and consent date, recorded by the School.
• Lessons: bookings, attendance, lesson plan, sea conditions, evaluations, teacher notes, feedback and progress by skill.
• Media: lesson photos and videos, which show Students' images, and training documents uploaded by Teachers.
• Sensitive data: medical certificates and health information, when the School or the Student uploads them.
• Chat messages, with attachments.
• Financial: purchases, packages, amounts, payment method (Pix, card or boleto), installments and transaction reference. Surf Academy does not store full card data.
• Technical: IP address, browser and device, audit records and push notification token.

3.1 Children's and teenagers' data

Data of people under 18 is processed in the minor's best interest (LGPD, art. 14). The School, as controller, collects and keeps the specific consent of a parent or legal guardian before registering the minor, and records it in the Student's profile. Surf Academy does not verify that consent on its own and does not use minors' data for advertising or commercial profiling.

4. Purposes and legal bases

• Purpose: to provide the service the School contracted (scheduling, lessons, progress, media, chat, notifications, payments, reports and optional AI features). The data is not sold or used for any other purpose.
• Legal bases, set by the School as controller: performance of a contract with the Student (art. 7, V), consent for image use and for minors' data (art. 7, I, and art. 14), protection of health and life in sports practice or specific consent for health data (art. 11), and legal obligation (art. 7, II).
• By default, one school's data is isolated from other schools' data, and no one from another school can access it.

5. Surf Academy's duties as processor

• Process the data only under the School's instructions and for the purposes above, telling the School if it believes an instruction breaks the law.
• Ensure that anyone who accesses the data at Surf Academy is bound by a duty of confidentiality.
• Apply the security measures in section 10.
• Keep a record of processing operations and access, and give the School the information needed to show compliance with this agreement.
• Support the School with data subject requests and communications to the ANPD (sections 11 and 12).
• Engage sub-processors only under section 8.

6. The School's duties as controller

• Have a legal basis for each processing it decides, inform data subjects and answer them.
• Collect the guardian's consent for minors and image-use authorisation where needed.
• Register only the data it needs and keep the account and Staff access secure.
• Tell Surf Academy about any instruction that affects processing, and about data subject requests that need its help.

7. Access roles in the School

The service limits what each person sees by their School Role (Staff, Teacher, Student). The School decides who gets each role and is responsible for revoking access when people leave.

8. Sub-processors

The School gives general authorisation for the sub-processors below, which Surf Academy selects and oversees, under data protection obligations equivalent to this agreement. Surf Academy is liable to the School for its sub-processors.

• Cloudflare, Inc.: app and API hosting, storage of photos, videos and documents, content delivery, technical logs and e-mail delivery.
• Neon, Inc.: PostgreSQL database.
• Expo (Expo Application Services) and, through it, Apple Push Notification service and Google Firebase Cloud Messaging: push notification delivery and app updates.
• Anthropic, PBC: the AI model behind the artificial intelligence features, only when a person uses those features. [CONFIRM: no model training on School data]
• Resend, Inc.: transactional e-mail provider, as a fallback. [CONFIRM final provider]
• Changes: Surf Academy tells the School by e-mail or in the panel, with [NOTICE PERIOD] notice, about adding or replacing a sub-processor. The School may object on reasonable grounds and, if there is no solution, end the contract without penalty.

9. International transfers

The sub-processors above may process data outside Brazil, especially in the United States and the European Union. Surf Academy only makes those transfers with the safeguards in art. 33 of the LGPD, such as standard contractual clauses, and keeps those clauses available to the School. [CONFIRM mechanism, per ANPD regulation]

10. Security

• Encrypted connections (HTTPS) and data encrypted at rest by the infrastructure providers.
• Per-school data isolation in the database, with rules in the database itself that stop one school from reading or changing another's data, on top of the application's controls.
• Passwords stored only as hashes, optional passkeys and two-step verification, short-lived media links and audit records.
• Internal access limited to what is necessary, with access reviews and logging.
• Backups and a recovery plan. [CONFIRM backup periods]

11. Security incidents

If Surf Academy becomes aware of a security incident affecting the School's data, it tells the School without undue delay, within [48 hours], with the available description of what happened, the data and data subjects affected, the measures taken and the risks, and cooperates with the School. The School, as controller, decides on and makes the communication to the ANPD and data subjects (LGPD, art. 48), with Surf Academy's support.

12. Data subject rights

Data subjects may ask the School for confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information about sharing and withdrawal of consent (LGPD, art. 18). Surf Academy forwards to the School, within [5] business days, the requests it receives about the School's data, and provides tools in the app and the panel to fulfil them, such as downloading a copy of the data and deleting the account.

13. Retention, return and deletion

• Data is kept while the contract lasts.
• After termination the School has [30] days to export its data. After that Surf Academy deletes or anonymises the School's data within [90] days, including backups, which expire in their normal cycle.
• Only the data the law requires may be kept, such as access logs for at least 6 months (Marco Civil da Internet, art. 15) and tax records for the legal period.
• When a Student asks for deletion, the School and Surf Academy delete or anonymise their data, unless the law requires it to be kept.

14. Audit

The School may ask, once a year or after an incident, for the information needed to check compliance with this agreement. Surf Academy answers in writing and, if needed, allows a reasonable audit, with prior notice, limited to the service and without exposing other schools' data. [CONFIRM costs and format]

15. Liability

Each party's liability for damage arising from data processing follows the LGPD (arts. 42 to 45) and the limits in the Terms of Use for schools, to the extent the law allows.

16. Governing law and venue

This agreement is governed by the laws of Brazil and the venue in the Terms of Use for schools: [CITY/STATE].

17. Contact

Surf Academy's Data Protection Officer (DPO): [DPO NAME], [DPO E-MAIL]. The school's data controller contact: the School contact registered on the account.