Schools Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the agreement between:

• Baje Associates Limited, trading as Curriculum Circle, a company registered in England and Wales under company number 08137041, with its registered office at 14 Millers View, Ipswich, IP1 4QB ("Curriculum Circle", "Processor"), and
•  , of   ("School", "Controller").

each a "Party" and collectively the "Parties".

This DPA is incorporated into and forms part of the Curriculum Circle Schools Subscription Agreement (the "Main Agreement") signed by the Parties on  , and governs Curriculum Circle's processing of personal data on behalf of the School when the School enrols its students (and/or staff) on the Curriculum Circle platform.

This DPA is drafted to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Privacy and Electronic Communications Regulations 2003 (PECR), and (where relevant for staff data of non-UK residents) the EU General Data Protection Regulation (EU GDPR).

1. Definitions

• "Applicable Law" — UK GDPR, DPA 2018, PECR, and other data protection law applicable to the Parties.
• "Authorised Sub-Processor" — a third party Curriculum Circle uses to process Personal Data, as listed in Annex 2.
• "Controller" — the School, who determines the purposes and means of processing.
• "Data Subject" — an identified or identifiable natural person whose Personal Data is processed; here, primarily students and school staff enrolled on the Service.
• "Personal Data" — any information relating to a Data Subject as defined in the UK GDPR.
• "Personal Data Breach" — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• "Processor" — Curriculum Circle.
• "Service" — the Curriculum Circle revision platform and related services as described in the Main Agreement.
• "Sub-Processor" — see Authorised Sub-Processor.

2. Roles and scope

2.1 Controller and Processor

For the purposes of Applicable Law, the School is the Controller of the Personal Data of students and staff it enrols on the Service. Curriculum Circle is the Processor acting on the School's documented instructions.

Where Curriculum Circle determines its own purposes for processing (e.g. for its own service-improvement, anti-fraud, or analytics purposes that go beyond providing the Service to the School), it does so as an independent Controller under the terms of the consumer-facing Privacy Policy.

2.2 Subject matter, duration, nature, purpose

2.3 Compliance with documented instructions

Curriculum Circle will process Personal Data only on documented instructions from the School. The Main Agreement, this DPA, and the technical configuration of the Service are taken as the School's documented instructions. Any further instructions must be agreed in writing by both Parties.

Curriculum Circle will notify the School immediately if it considers an instruction infringes Applicable Law.

3. Curriculum Circle's obligations

3.1 Confidentiality

Ensure that any person authorised to process Personal Data is bound by a written confidentiality obligation or a statutory duty of confidentiality.

3.2 Security

Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk — see Annex 3.

3.3 Sub-processing

Engage Sub-Processors only in accordance with section 4 below.

3.4 Data Subject rights

Assist the School in responding to Data Subject rights requests under Articles 12-23 of UK GDPR.

3.5 Article 32-36 assistance

Assist the School in ensuring compliance with the obligations under Articles 32 (security), 33-34 (breach notification), 35 (DPIA), and 36 (prior consultation) of UK GDPR.

3.6 Records of processing

Maintain a record of processing activities under Article 30 of UK GDPR, available to the School on reasonable request.

3.7 Personal Data Breach

Notify the School without undue delay and in any event within 48 hours of becoming aware of a Personal Data Breach, providing:

• a description of the nature of the breach;
• the categories and approximate number of Data Subjects affected;
• the categories and approximate number of records affected;
• the likely consequences;
• the measures taken or proposed to address the breach.

3.8 Audit

On reasonable written notice (not less than 30 days, save in case of genuine urgency), permit and contribute to audits, conducted by the School or a third-party auditor, subject to confidentiality. Curriculum Circle may provide an up-to-date third-party audit report (e.g. SOC 2, ISO 27001) in lieu of an on-site audit. Audit frequency: no more than once per 12 months unless following a Personal Data Breach.

3.9 Cooperation with regulators

Cooperate with the Information Commissioner's Office on request, and notify the School promptly of any regulatory enquiry relating to the School's data.

4. Sub-Processors

4.1 Authorised Sub-Processors

The School consents to Curriculum Circle engaging the Sub-Processors listed in Annex 2.

4.2 New Sub-Processors

Curriculum Circle will give the School at least 30 days' notice before engaging any new Sub-Processor. The School may object on reasonable data-protection grounds. If unresolved, the School may terminate the affected part of the Service with a pro-rata refund of pre-paid fees.

4.3 Flow-down of obligations

Curriculum Circle will impose on every Sub-Processor written data-protection obligations no less protective than this DPA. Curriculum Circle remains fully liable for Sub-Processor acts and omissions.

5. International transfers

Where Personal Data is transferred outside the UK, Curriculum Circle will only do so if:

• The destination is the subject of a UK adequacy decision;
• The transfer is governed by the IDTA or the UK Addendum to the EU SCCs;
• The recipient is bound by ICO-approved Binding Corporate Rules;
• Another lawful UK GDPR mechanism applies.

Specific countries are listed in Annex 2.

6. Children's data

Both Parties acknowledge that many Data Subjects are minors (typically aged 11-18). The Parties will respect the heightened protection required under:

• UK GDPR Article 8 (age of consent for information society services in the UK is 13);
• the ICO Age Appropriate Design Code (the Children's Code);
• the School's Keeping Children Safe in Education (KCSIE) safeguarding obligations.

The School warrants that, where parental consent is required, the School has obtained that consent before enrolling the Data Subject. Curriculum Circle will support the School through privacy-by-default configuration of the Service.

7. School responsibilities

The School will:

• Ensure it has a lawful basis for sharing Personal Data with Curriculum Circle (typically performance of a contract for the provision of education, or legitimate interests; for special category data, additional bases under DPA 2018 Schedule 1).
• Ensure students/staff/parents have been informed about Curriculum Circle's role under Articles 13-14 UK GDPR.
• Only upload or instruct processing of data it is lawfully entitled to share.
• Promptly respond to Data Subject rights requests routed to it.
• Designate at least one Data Protection Lead as the point of contact for Curriculum Circle.

8. Liability and indemnity

The Parties' liability under this DPA is governed by the limitation and indemnity provisions of the Main Agreement, subject to the mandatory provisions of Applicable Law: neither Party may exclude or limit liability for matters that cannot lawfully be excluded.

9. Return or deletion of data on termination

Within 30 days of termination of the Main Agreement, Curriculum Circle will, at the School's choice:

• Return all Personal Data in a structured, commonly used, machine-readable format; and/or
• Delete all Personal Data and certify deletion in writing.

Subject to retention required by law (e.g. financial records for 6 years). Backups are deleted within a further 90 days.

10. General

• Order of precedence. If there is any conflict between this DPA and the Main Agreement, this DPA prevails on data-protection matters.
• Variation. Any variation must be in writing signed by both Parties.
• Notices. All notices may be given by email to the contacts in Annex 4.
• Governing law and jurisdiction. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Signatures

Annex 1 — Description of processing

Categories of Data Subjects

• Students enrolled by the School on the Service (typical age range 11-18)
• Teaching staff with administrator or teacher accounts
• Parents/guardians where they hold accounts on behalf of a student under 13
• Other School-authorised users (e.g. SENCO, exams officer) as requested by the School

Types of Personal Data processed

Special category data is not collected. If a Data Subject voluntarily includes special category data in a free-text submission, it is processed solely to deliver the Service.

Annex 2 — Sub-Processors

The following Sub-Processors are engaged at the date of this DPA. The most up-to-date list is at thecurriculumcircle.com/schools-dpa/.

Annex 3 — Technical and Organisational Security Measures

In accordance with Article 32 of UK GDPR.

Confidentiality

• TLS (HTTPS) encryption for all data in transit
• Encryption at rest for the production database and its backups (AES-256, provided by Supabase)
• Passwordless sign-in by one-time email link; any passwords are stored only as salted hashes
• Written data-processing terms with every Sub-Processor

Integrity and access control

• Database row-level security: each user can only read their own records; School reporting is limited to the School's own enrolled users
• Premium and administrative data is served only through permission-checked server functions
• Production access limited to named Curriculum Circle personnel, with multi-factor authentication on provider accounts

Availability and resilience

• Daily automated database backups through Supabase
• Managed hosting with provider-level monitoring and DDoS protection
• A documented incident response procedure, including the breach notification steps in section 3.7

Specific to children's data

• No advertising, analytics or cross-site tracking cookies (see our Cookie Notice)
• No profiling beyond what is necessary to deliver the Service
• Data minimisation: only the data listed in Annex 1 is collected
• Staff working with students hold enhanced DBS checks and follow the School's safeguarding procedures

Review

• These measures are reviewed at least annually and whenever the Service changes materially

Annex 4 — Contacts