Data Processing Agreement

The school is the controller for personal data it enters into Meltem about students, instructors, bookings, progression and payments. Meltem is the processor for that school data.

Meltem processes personal data only to provide, secure, maintain and support the service, or as otherwise instructed by the school in a written agreement.

The subject matter is operation of Meltem's school-management platform. The duration is the term of the school's use of Meltem plus any agreed retention or deletion period.

The categories of data subjects include students, instructors, school admins, agency contacts and gear renters. The categories of data include contact details, lesson records, IKO progression, payment records, package balances, availability, notes and account data.

Meltem will use appropriate technical and organizational measures to protect personal data, including role-based access controls, school-scoped database policies and secure authentication.

Meltem personnel and suppliers with access to personal data must be bound by confidentiality obligations suitable for the nature of the service.

Meltem may use subprocessors for hosting, database, authentication, email delivery, analytics, session recording, monitoring, customer support and payment-related infrastructure where required to provide the service.

Current subprocessors include Supabase (hosting, database and authentication), PostHog (product analytics and session recording, hosted in the European Union) and Sentry (application error monitoring), alongside the email provider used for authentication and notifications. PostHog session recording may capture personal data displayed on screen while school staff use the app; password fields are masked.

Meltem remains responsible for subprocessor performance under the DPA and will use contractual safeguards with subprocessors that process personal data.

Where personal data is transferred outside the EEA, UK or Switzerland, Meltem will use appropriate transfer safeguards such as adequacy decisions, Standard Contractual Clauses or equivalent protections.

Meltem will reasonably assist schools with data subject requests, security enquiries, DPIAs and regulator correspondence relating to Meltem's processing, taking into account the nature of the processing and information available to Meltem.

Signed-in students can download their own data export and delete their account data. Schools can also request workspace-level exports or deletion through Meltem support.

At the end of service, the school can request return or deletion of personal data, subject to legal retention duties, backup deletion cycles and records that must be retained by the controller.

Self-service student deletion removes or detaches records directly tied to that student account, including profile, login, credits, packages, payments and progression entries.