What the DPA covers

• Roles. Your school is the data controller; Viva is the data processor. We process student data only on your documented instructions.
• Scope of data. The categories of student data we handle, the purpose of each, and how long each is kept, matching the tables in our Privacy Policy.
• Subprocessors. The technology providers we use, each bound by a written agreement no less protective than the DPA. Where the law requires it, as in Korea, we add new ones only with your school's consent. The current list is in the Trust Center.
• Security. Encryption in transit and at rest, tenant isolation, access controls and access logs, and notice to your school within 72 hours of us becoming aware of a breach (sooner where your DPA says so).
• Voice ID. On by default in Grade 9–12 classes and higher education unless your school turns it off; never in Grade 6–8 classes or for students under 14 in Korea. Each student gives their own consent on a separate screen. In Illinois, only adult students who sign their own written release.
• Camera Check. Used where your school turns it on. Outside the US it is part of the school's assessment and students are told about it; in the US each student also consents, and in Illinois only adult students who sign a written release. No video leaves the student's browser.
• Deletion. Interview recordings 90 days after the grade is released, or 180 days after the interview if no grade is released, paused while an integrity flag, grade review or instructor-granted retry is open, or while the class has a documented retention hold. Voiceprints within 30 days after Voice ID is turned off or a student stops being eligible, within 90 days after account closure or the end of the contract, and in any case within 1 year after the student's last use of Viva. Camera Check data with the interview it belongs to. All other student data deleted after the contract ends, on the schedule in the DPA, with written confirmation on request.
• Student notices. Viva tells students directly. Before their account exists, they are linked to our Privacy Policy, which covers US processing, Camera Check, and AI training with the opt-out. Before each interview, they are told it is recorded and, where used, how Camera Check works. Your school doesn't need to send anything to students or parents.
• AI training and research. US universities and US Grade 9–12: de-identified data may be used to improve Viva unless your school opts out. Korea: pseudonymized data from Grade 9–12 classes, where your school authorizes it in the DPA, kept no longer than 3 years after the contract ends. Everywhere else: only with your school's written authorization. Students can always opt out, in Settings or by email, with no effect on their grades. Never voice recordings, Voice ID or Camera Check data, and never Grade 6–8 classes or students known to be under 14.
• International transfers. The mechanism your jurisdiction requires: the Korea PIPA Addendum, EU/UK Standard Contractual Clauses and the UK IDTA, or the equivalent for your country.

Jurisdiction-specific addenda

• Republic of Korea: Korea PIPA Addendum. The DPA is the written entrustment agreement under PIPA Article 26, supports the school's overseas-transfer disclosure under Article 28-8, sets out the student's own consent for Voice ID under Article 23 (never offered under 14), and covers pseudonymized data used under Article 28-2.
• EEA / UK: Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA).
• United States: FERPA "school official" terms and, for students under 13, COPPA service-provider terms.

How to get it

The DPA is signed together with an Order Form and our Master Service Agreement. Email privacy@vivaproof.com with your school name and country, and we'll send the agreement for your jurisdiction, ready for signature, with the current subprocessor list and our Vendor Security Overview.

Also see our Privacy Policy · Trust Center.