Last updated on 29 October 2024
This Data Processing Agreement (“Agreement“) applies when users input personal data into Classroom Stars tools and is incorporated into our Terms of Service (“Terms”, “Terms of Service”). By using our website and services, you agree to both the Terms and this Agreement.
Definitions
The Parties recognise that, under Data Protection Legislation, the User acts as the Controller and the Website serves as the Processor. The Website is only authorised to process the Personal Data entered by the User into the AI tools on the Platform as specified in the Schedule provided by the User, and it cannot determine this processing independently.
The User confirms that it has a legitimate basis (as per Data Protection Legislation) for providing all Personal Data to the Website in relation to the User’s use of the Platform and for the lawful Processing of that Data by both the User and the Website for the purposes outlined in this Agreement. The User agrees to indemnify the Website against all costs, claims, damages, expenses, losses, and liabilities incurred by the Website that arise from or relate to any failure (or alleged failure) of the User to have a lawful basis for Processing Personal Data.
The User instructs and authorises the Website to process the Data as detailed in the Schedule to this Agreement, as well as for any other reasonable activities necessary to enable the Website to deliver the Platform to the School. The Website shall promptly notify the User if it believes any instructions from the User violate Data Protection Legislation.
The Website will only process Personal Data in accordance with the Schedule unless it is legally obligated to do otherwise. If such a legal obligation arises, the Website will notify the User before proceeding with the processing, unless prohibited by law.
The Website will implement Protective Measures, which have been approved by the User, to guard against a Data Loss Event, considering:
a) the nature of the data being protected;
b) the potential harm from a Data Loss Event;
c) the current state of technology; and
d) the costs associated with implementing these measures.
The Website will ensure that:
a) Website Personnel only process Personal Data as permitted by this Agreement, particularly as stated in the Schedule;
b) all reasonable steps are taken to confirm the reliability and integrity of any Website Personnel with access to the Personal Data, ensuring they: i. are aware of and comply with the Website’s responsibilities under this clause;
ii. are subject to appropriate confidentiality obligations with the Website or any Sub-processor;
iii. understand the confidential nature of the Personal Data and do not publish, disclose, or share any Personal Data with third parties unless explicitly instructed in writing by the User or permitted by this Agreement; and
iv. have received adequate training in the handling and protection of Personal Data.
The Website will not transfer Personal Data outside the EU unless the following conditions are met:
a) The Website has established appropriate safeguards for the transfer, as outlined in UK GDPR Article 46;
b) The Data Subject has enforceable rights and effective legal remedies;
c) The Website meets its obligations under Data Protection Legislation by providing adequate protection for any transferred Personal Data, or, if not legally obligated, will make reasonable efforts to assist the User in fulfilling these obligations.
The Website will follow any reasonable written instructions provided in advance by the User regarding the processing of Personal Data and will delete the Personal Data (along with any copies) upon the termination of the Agreement at the User’s written direction unless required by law to retain the Personal Data.
The Website will inform the User as soon as reasonably possible if it:
a) receives a Data Subject Access Request (or a purported Data Subject Access Request);
b) receives a request to rectify, block, or delete any Personal Data;
c) receives any other request, complaint, or communication related to either Party’s obligations under Data Protection Legislation;
d) receives any communication from the Information Commissioner or another regulatory authority regarding Personal Data processed under this Agreement;
e) receives a request from a third party for disclosure of Personal Data where compliance is required or claimed to be required by law; or
f) becomes aware of a Data Loss Event.
The Website’s notification obligation under this clause will include providing additional information to the User in stages as it becomes available, if needed.
Considering the nature of the processing, the Website will provide reasonable assistance to the User in fulfilling its obligations under Data Protection Legislation and any complaint, communication, or request referenced in clause 9 (to the extent possible within the timelines reasonably required by the User), including by promptly supplying:
a) the User with full details and copies of the complaint, communication, or request;
b) assistance as reasonably requested by the User to enable compliance with a Data Subject Access Request within the required timelines established by Data Protection Legislation;
c) the User, upon request, with any Personal Data it holds concerning a Data Subject;
d) assistance, as requested by the User, following a Data Loss Event;
e) assistance, as requested by the User, regarding any request from the Information Commissioner’s Office, or any consultations with the Information Commissioner’s Office.
The Website will provide reasonable support to the User in preparing any Data Protection Impact Assessment.
The Website will maintain accurate records as mandated by Article 30(2) of the UK GDPR. This requirement does not apply if the Website has fewer than 250 employees, unless:
a) the Website determines that the processing is not occasional;
b) the Website determines that the processing includes special categories of data as outlined in Article 9(1) of the UK GDPR or Personal Data related to criminal convictions and offenses referred to in Article 10 of the UK GDPR; and
c) the Website determines that the processing may pose a risk to the rights and freedoms of Data Subjects.
The User must inform the Website if it believes any of the aforementioned conditions apply to the data processed on the Platform.
The Website will permit audits of its Data Processing activities by the User or the User’s designated auditor. The User will not exercise its audit rights more than once during any twelve (12) month period, unless required by a competent data protection authority or if the User believes an additional audit is necessary due to a Data Loss event experienced by the Website. The User’s information and audit rights under this clause will apply only as required by Applicable Data Protection Law. The User will provide the Website with reasonable notice of any intended audit or inspection and will ensure that it (and any nominated auditor) avoids causing (or minimises) any damage, disruption, or injury to the Website or its subcontractors. If the User appoints a third-party auditor, that auditor must not be a direct competitor of the Website.
The Website will appoint a data protection officer if required by Data Protection Legislation.
The User authorises the Website to engage the Sub-processors listed in the Schedule to perform Processing activities related to the Data. The Website will make reasonable efforts to promptly inform the User of any changes to the identity of such Sub-processors and allow the User to reasonably object to their appointment. Before permitting any Sub-processor to process any Personal Data associated with this Agreement, the Website must:
a) enter into a written agreement with the Sub-processor that incorporates the terms outlined in this clause, ensuring they apply to the Sub-processor; and
b) provide the User with any information regarding the Sub-processor that the User may reasonably require.
The Website will remain fully accountable for any acts or omissions of any Sub-processor concerning the Processing of the Data.
Each party (the “Indemnifying Party”) agrees to indemnify the other party (the “Indemnified Party”) against all losses, costs, harms, expenses (including reasonable legal fees), liabilities, or damages (“Damage”) suffered or incurred by the Indemnified Party due to the Indemnifying Party’s breach of this Agreement, provided that:
a) the Indemnified Party promptly notifies the Indemnifying Party of any circumstances known to it that may lead to an indemnity claim under this clause; and
b) the Indemnified Party takes reasonable steps to mitigate any ongoing Damage resulting from the Indemnifying Party’s breach.
The Website will not be liable to the User for any loss, interception, or corruption of any Data caused by negligence or default of any telecommunications service provider to the Website or the User; any loss arising from the negligence or default of any supplier to the User; damage to reputation or goodwill; or any indirect or consequential loss. The total aggregate liability of the Website in contract, tort (including negligence or breach of statutory duty), misrepresentation, restitution, or otherwise, arising from or in connection with the performance or anticipated performance of this Agreement shall be limited to the total fees paid for the User’s access to the Platform in the twelve months preceding the date the claim arose. This clause does not limit the Website’s liability for any death or personal injury resulting from its negligence, fraud, or fraudulent misrepresentation, or for any other matter where liability cannot be limited or excluded by law.
The Schedule
Annex A – Schedule of Processing, Personal Data, and Data Subjects
The Website will comply with any additional written instructions regarding processing from the User.
Such additional instructions will be incorporated into this Schedule.
Subject Matter of Processing
The processing involves any Personal Data inputted into the AI tools designed for the education sector, as supplied by the Website. The entry of such Personal Data is entirely at the User’s discretion.
Duration of Processing
The processing will occur for a period of 28 days unless the User requests additional processing via the feedback option within the AI tool. In that case, the duration for further processing will extend as necessary to address the User’s request adequately.
Nature and Purpose of Processing
The User defines the purpose of the processing, which primarily involves generating content to assist the User with various school-related tasks, including communication, administration, planning, preparation, and assessment.
Type of Personal Data
The types of Personal Data involved are determined by the User and may consist of names, academic performance records, health details, career information, work performance metrics, and information regarding special educational needs.
Categories of Data Subjects
The categories of individuals affected are specified by the User and may include Pupils, Parents, Carers, Guardians, Staff, or any other individuals interacting with the User.
Plan for Data Return and Destruction After Processing Completion
Data will be stored on the Platform for 28 days unless the User opts to delete it sooner. The User has the ability to delete the data at any point directly. However, if required by union or member state law, the retention of that data may be mandated.
Where the Website uses third party services to run and administer the Platform and services, only the minimal amount of information needed for the purposes of delivering their service will be shared. The Website carries out due diligence against all third-party suppliers for the purposes of ensuring their compliance with data protection, maintaining adequate security of data and ensuring they apply adequate data protection principles to the processing of the data supplied.
Thank you for joining the list to receive our newsletter! Click below to download your free sample resource pack.
Your email address has been updated. A confirmation has been sent to your previous email address.
Your new password has been created. A confirmation email has been sent to you.
Thank you for providing us with your details. A member of our team will get back to you as soon as possible with the next steps.
Thank you for getting in contact with us! A member of our team will do their best to get back to you as soon as possible.
You have joined the list to receive our newsletter! Be sure to look out for all our latest resources, news and reads from our blog.
We have sent you an email with a link to create a new password.
Remember to check the junk folder in case the link was sent there.
We use cookies to improve your experience and our website. By continuing to use Classroom Stars, you agree to our usage of cookies, as defined in our Privacy Policy.
