Data Processing Agreement

This Data Processing Agreement (the “DPA”) is between the tutor using Tuto (“Controller”) and Stepan Orlov, trading as Tuto, Schivelbeiner Str. 49, 10439 Berlin, Germany (“Processor”). It forms part of the Terms of service when the Controller uses Tuto with personal data.

The Controller decides why and how learner data is used in its teaching. Tuto processes that lesson data only on the Controller’s documented instructions, as set out in this DPA and through use of the service, unless EU or Member State law requires otherwise.

Tuto provides a lesson-follow-up workspace. Processing covers hosting, receiving, storing, organising, transcribing, analysing, generating lesson follow-up and homework, displaying, sharing at the Controller’s direction, supporting, securing, and deleting lesson data.

Processing starts when the Controller submits lesson data and continues for the service term. Tuto deletes or returns personal data after the service ends or at the Controller’s request, except where retention is required by law or a short, documented backup-retention period applies.

Data subjects may include students, lesson participants, and the Controller. Data may include names, contact or account details, language and learning information, lesson notes, uploaded images, temporary audio recordings, transcripts, speaker labels, corrections, summaries, exercises, homework responses, and technical security data.

The Controller must not intentionally submit special-category data unless it is necessary for the teaching purpose and the Controller has a valid legal basis and appropriate safeguards.

The Controller is responsible for the lawfulness of its instructions, providing required privacy information to participants, and obtaining any permission required to record, transcribe, analyse, or share lesson material. The Controller remains responsible for deciding who receives a homework link and what lesson material is included.

Tuto will ensure that people authorised to process lesson data are bound by confidentiality, use appropriate technical and organisational measures, and reasonably assist the Controller with data-subject requests, security incidents, data-protection impact assessments, and consultations to the extent required by applicable law.

Tuto will make information reasonably necessary to demonstrate compliance with this DPA available on request. Audits must be agreed in advance, take place during normal business hours, and protect Tuto’s security and other customers’ confidential information.

The Controller authorises Tuto to use the following subprocessors for the stated functions: Supabase (authentication, database, and storage); Railway (application hosting); AssemblyAI (speech-to-text); OpenAI (lesson-material analysis and generation); and, if enabled for an account, Yandex Object Storage (temporary audio storage). Sentry may receive limited technical error data after Tuto’s content-scrubbing controls are applied.

Tuto will not add or replace a subprocessor for lesson data without first obtaining the Controller’s written or electronic approval through an updated DPA or other documented agreement. Where a transfer outside the EEA is required, Tuto will use a transfer mechanism permitted by Chapter V GDPR.

Tuto will notify the Controller without undue delay after becoming aware of a personal-data breach affecting lesson data and provide available information needed for the Controller to meet its legal obligations. The Controller can report a suspected incident to stepan@hey-tuto.com.

Version 2026-10-10. By accepting this DPA in Tuto, the Controller enters into this DPA electronically. Tuto records the version and time of acceptance. Material changes require a new acceptance before the Controller continues to submit lesson data.