Why German microschools have it hard
DSGVO + KJSG + Berlin school-data regulations are some of the strictest in the world. Most US-built edtech platforms aren't reviewed by German DPOs because the data-flow documentation isn't ready out of the box. Kleine Schule had been on a German-only platform with limited functionality.
What the DPO needed
Article 30 register entries for every data flow. Sub-processor list with German equivalents documented. Standard contractual clauses for any US data transfer. Clear minor-consent flow. The Koydo DPA + trust-center artifacts covered all four out of the box.
What 'covered out of the box' actually meant
Not that the DPO didn't have questions — she had 14. The Koydo trust team answered all 14 inside 48 hours, in writing, with specific references to the underlying contracts. That responsiveness is what closed the review, more than the documentation itself.
Operational outcome
34 students across 3 cohorts (English, French, math). The school's pedagogical autonomy is preserved — Koydo provides infrastructure, not curriculum. The previous in-house platform required the school to use its prescriptive curriculum; Koydo doesn't.