Data Processing Agreement

1. Purpose and Scope

This Data Processing Agreement ("DPA") explains how TrackEDU Ltd (Company Number: 17216557, Registered Office: 128 City Road, London, United Kingdom, EC1V 2NX) processes school-controlled personal data when providing TrackEDU House Points, the Teacher App, Student Portal, Behavior Tracker, TrackEDU Facilities, and TrackEDU Class Board (together, the "Platform").

This DPA forms part of the terms under which TrackEDU processes school-controlled personal data on behalf of a school. Where a school requires a separately executed copy for procurement or regulatory purposes, TrackEDU can provide a signed version.

If a separate written agreement between TrackEDU Ltd and a school contains data processing terms that conflict with this DPA, the separately agreed written terms will take precedence for that school.

2. Controller and Processor Roles

For school-managed use of TrackEDU, the school or educational organisation will generally act as the Data Controller, and TrackEDU Ltd will generally act as the Data Processor, processing school data on the school's instructions.

This means the school determines the purposes and means of processing student and staff data within TrackEDU, and TrackEDU Ltd processes that data only to provide the Platform as instructed by the school.

The allocation of controller and processor roles may vary depending on the applicable jurisdiction, contract, implementation arrangement, or specific feature use. Where TrackEDU Ltd determines the purposes and means of processing (for example, for its own operational analytics or security logs), TrackEDU Ltd acts as a controller for that specific processing activity.

3. Categories of Data Processed

TrackEDU Ltd may process the following categories of data on behalf of schools:

• Staff account information: name, school email address, professional role, school affiliation, and authentication records.
• Student profile information: first name, last initial or last name, grade or year group, class assignment, house, group, or team assignment.
• House point records: points awarded, point history, leaderboard positions, and point-related activity.
• Student Portal activity: badges earned, daily streaks, house power boost contributions, poll participation, mystery word mission progress, and engagement metrics.
• Behavior Tracker records: incident logs, behaviour types, severity levels, tier progression, action notes, follow-up notes, and parent or guardian communication records entered by authorised school staff.
• Technical and operational data: device type, browser type, error logs, performance information, and non-identifying interaction metrics needed to secure, maintain, and improve the Platform.

4. Processing Instructions and Confidentiality

TrackEDU Ltd will process school-controlled personal data only on the school's documented instructions, including instructions expressed through the school's authorised use and configuration of the Platform, unless TrackEDU is required to process the data by applicable law.

If applicable law requires TrackEDU to process school-controlled personal data other than on the school's instructions, TrackEDU will inform the school of that legal requirement before processing unless the law prohibits such notification.

TrackEDU will notify the school if, in TrackEDU's reasonable view, an instruction infringes applicable data protection law.

Persons authorised by TrackEDU to process school-controlled personal data are required to keep that data confidential and to access it only where necessary for their authorised role.

Processing activities may include:

• operating TrackEDU House Points, the Teacher App, Student Portal, Behavior Tracker, TrackEDU Facilities, and TrackEDU Class Board;
• authenticating staff and managing role-based access;
• storing and displaying student point records, badges, leaderboards, and engagement features;
• storing and displaying behaviour records, tier interventions, and pastoral information;
• storing and displaying facility booking and operational information where a school uses TrackEDU Facilities;
• providing export, deletion, troubleshooting, onboarding, and support functions requested by the school;
• monitoring platform reliability, preventing misuse, and improving security; and
• using aggregated or non-identifying information to understand platform performance and improve TrackEDU.

Schools are responsible for ensuring they have appropriate authority, notices, consents, or lawful bases for uploading and managing student and staff data in TrackEDU.

5. Data Security

TrackEDU Ltd uses technical and organisational measures designed to protect school data against unauthorised access, loss, misuse, alteration, and disclosure.

• Secure authentication: staff access is managed through Google sign-in where available. We do not store staff passwords.
• Role-based access: teachers, counsellors, administrators, and school leaders have different permission levels based on role.
• Student access controls: students use auto-generated ID tokens and class passcodes rather than email/password accounts.
• Protected infrastructure: TrackEDU uses Google Firebase cloud infrastructure with database security rules, access controls, and encryption in transit.
• Privacy-conscious display: where appropriate, student names may be displayed in shortened form, such as first name and last initial.
• Access management: access to production systems and school-controlled data is restricted to authorised persons according to operational need.

No online service can guarantee absolute security. Schools should also follow appropriate internal access, device, staff training, and safeguarding procedures when using TrackEDU.

6. Subprocessors

The school provides general authorisation for TrackEDU Ltd to use subprocessors where reasonably necessary to provide the Platform. TrackEDU will ensure that subprocessors processing school-controlled personal data are bound by written data protection obligations that provide an appropriate level of protection for that data.

Current categories of subprocessors may include:

• Cloud infrastructure and authentication providers: including Google Firebase services used for database hosting, authentication, real-time syncing, storage, and secure platform operation.
• Email and communication services: for essential service messages, support, onboarding, and account-related communications.
• Scheduling and demonstration tools: for booking demos or consultations.
• Video hosting services: for hosting demonstration and tutorial videos.
• Artificial intelligence services: selected AI-assisted features in TrackEDU Class Board and TrackEDU Facilities use the Google Gemini API. TrackEDU House Points and the Behavior Tracker do not use Google Gemini or any other AI/ML service.

TrackEDU Facilities may also provide an optional Google Calendar integration. Google Workspace API data used to provide that integration is used only for the requested calendar functionality and is not sent to Google Gemini or any other AI/ML service.

Where required by applicable data protection law, TrackEDU will provide reasonable notice of a material change involving a new subprocessor that will process school-controlled personal data, allowing the school to raise reasonable data protection concerns.

TrackEDU Ltd remains responsible to the school for the performance of its subprocessors to the extent required by applicable data protection law.

7. International Data Transfers

TrackEDU may be used by schools in different countries. Depending on where a school is located and which infrastructure and subprocessor services are used, data may be processed or stored in countries different from the school's location.

Where required by applicable law (including UK GDPR and EU GDPR), TrackEDU Ltd will work with schools to put appropriate safeguards in place for international data transfers, such as Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms.

8. Data Breach Notification

If TrackEDU Ltd becomes aware of a confirmed personal data breach affecting school-controlled personal data, we will:

• notify the affected school without undue delay after becoming aware of a confirmed personal data breach affecting school-controlled data;
• provide available information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach;
• support the school in meeting its own breach notification obligations where required by applicable law.

Where a specific legal deadline applies, we will work with the school to support timely compliance.

9. Data Export, Deletion and Return

Schools retain control over the student, behaviour, and operational data they enter into TrackEDU.

• Export: Schools may export relevant data, such as student rosters, point records, and behaviour records, where export features are available.
• Deletion controls: Authorised school administrators may use available deletion controls to remove school data from the active Platform.
• Deletion requests: Schools may contact TrackEDU Ltd to request deletion of school-controlled personal data.
• End of use: at the end of the relevant services, TrackEDU will, at the school's choice and subject to applicable law, return or delete school-controlled personal data and delete remaining copies where required.
• Backups and logs: where immediate deletion from backups is not technically practicable, the affected data will remain protected and put beyond ordinary use until it is deleted through the applicable backup or retention cycle, unless applicable law requires longer storage.

10. Assistance to Schools

TrackEDU Ltd will provide reasonable assistance to schools to help them meet their data protection obligations, including:

• responding to appropriate data subject access requests directed to TrackEDU Ltd where the school is the controller;
• supporting data portability, rectification, restriction, and erasure requests as instructed by the school;
• providing available information to support data protection impact assessments (DPIAs) conducted by the school;
• assisting with breach notification and security incident responses where required.

TrackEDU will make available information reasonably necessary to demonstrate compliance with applicable processor obligations and will cooperate with reasonable audits or inspections relating to the processing of school-controlled personal data, subject to appropriate confidentiality, security, scope, timing, and non-disruption requirements.

Assistance will be provided in a commercially reasonable manner. Where a request is unusually extensive, repetitive, or requires material work beyond ordinary compliance support, the parties may agree reasonable associated costs in advance where permitted by law.

11. School Responsibilities

When using TrackEDU, schools are responsible for:

• deciding whether TrackEDU is suitable for their legal, safeguarding, procurement, and policy requirements;
• ensuring they have appropriate authority, lawful basis, notices, and consents to upload and manage student and staff data;
• assigning staff permissions appropriately and reviewing them regularly;
• reviewing which staff can access behaviour and pastoral information;
• ensuring exported data is stored securely outside TrackEDU;
• avoiding unnecessary sensitive data unless the school has a clear lawful basis and appropriate safeguards;
• using the Behavior Tracker responsibly and in line with safeguarding, pastoral, disciplinary, and data protection policies;
• responding to parent, guardian, student, or staff requests relating to data the school controls within TrackEDU.

12. Contact

For data protection enquiries, DPA requests, or to request a signed copy of this agreement: