Data Processing Agreement (DPA)

This agreement is incorporated into our Terms of Service.

This Data Processing Agreement (“DPA”) is entered into between the Customer (the “Controller”) and Curriculum Tracker (the “Processor”) and governs the processing of Personal Data in connection with the Service.

1. Definitions

Terms such as “Personal Data”, “Data Subject”, “Processing”, “Controller”, and “Processor” shall have the meanings given to them in the UK General Data Protection Regulation (UK GDPR).

2. Details of Data Processing

2.1 Subject-matter: The provision of a curriculum tracking and reporting service as described in our Terms of Service.

2.2 Duration: For the term of the service agreement between the Controller and the Processor.

2.3 Purpose: To enable the Controller to manage user access, track curriculum coverage, generate reports, and facilitate internal communication related to educational delivery.

2.4 Nature of Processing: Hosting, storage, retrieval, analysis (for reporting), and management of data provided by the Controller and its users.

2.5 Categories of Data Subjects: Staff and administrators of the Controller (e.g., teachers, school admins, trust admins).

2.6 Types of Personal Data: First name, last name, email address, username, user role, and logs of user activity within the application. No Personal Data of students is processed.

3. Obligations of the Processor

The Processor agrees to:

• Process Personal Data only on the documented instructions of the Controller.
• Ensure that all personnel authorised to process Personal Data are subject to a duty of confidentiality.
• Implement and maintain appropriate technical and organisational security measures to protect the Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, or damage.
• Not engage any sub-processor without the Controller's prior specific or general written authorisation.
• Assist the Controller, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests from Data Subjects exercising their rights.
• Notify the Controller without undue delay after becoming aware of a Personal Data breach.
• Upon termination of the Service, delete or return all Personal Data to the Controller at the Controller's choice.
• Make available to the Controller all information necessary to demonstrate compliance with its obligations and allow for and contribute to audits conducted by the Controller.

4. Obligations of the Controller

The Controller warrants that it has a valid lawful basis for the processing of all Personal Data it provides to the Processor and that it will comply with its obligations under the UK GDPR.