Data processing agreement

This agreement is between the school, academy, trust or college named in the signature block (the "School") and Guided Digital Childhood Ltd, company number 17299814, of Apple Acre, Star, Winscombe, BS25 1QF ("Guided Childhood"). It forms part of the agreement made under the schools licence terms.

Its purpose is to set out what personal data passes between the parties when the School pilots or licenses Guided Childhood Schools, in what role each party handles it, and the terms that apply, including the terms that Article 28 of the UK GDPR requires wherever Guided Childhood processes personal data on the School's behalf.

"UK GDPR", "Data Protection Act 2018", "controller", "processor", "personal data", "processing" and "personal data breach" have the meanings given in UK data protection law.

Pupils: none. The Service holds no personal data about pupils. It has no pupil accounts, names, photographs, dates of birth, contact details, free text about pupils, special category data, or record of which pupil saw which lesson. Where a pupil's name appears in the teaching, it is handwritten on paper that stays in the School.

Staff: the contact data a member of the School's staff gives Guided Childhood to run a pilot or a licence, set out in Annex 1.

Records held only on the School's own devices, such as the AI governance reviews the School writes, are never sent to Guided Childhood and are outside this agreement.

For the contact data in Annex 1, Guided Childhood is an independent controller. It decides why and how that data is used, for the purposes in Annex 1 and no other, and it is responsible to the individuals concerned and to the Information Commissioner for that use. The School is a controller of its own staff data. Each party complies with UK data protection law for its own processing.

If, now or in future, the School asks Guided Childhood to process personal data on the School's behalf and on its instructions, for example if a feature is introduced that stores staff accounts, class records or pupil data at the School's request, Guided Childhood is a processor for that data and section 5 applies to it automatically, without a new agreement, unless the parties agree otherwise in writing.

Guided Childhood will use the personal data in Annex 1 only for the purposes there, and will never sell it, use it for advertising or profiling, or use it to train an AI model.

Guided Childhood will apply the security measures in Annex 2 and will limit access to people who need it to run the Service, all of whom are bound by confidentiality.

Guided Childhood will tell the School's named contact about any personal data breach affecting the School's data without undue delay, and in any case within 48 hours of becoming aware of it, with what is known and what is being done.

Guided Childhood will help the School respond to a request from an individual about their personal data, and will pass on within two working days any such request it receives that concerns the School's staff.

Guided Childhood will delete the personal data in Annex 1 at the end of the retention periods there, or sooner on the School's written request, except for what tax law requires it to keep.

Guided Childhood will give the School the information it reasonably needs for its own data protection impact assessment, starting with the data protection pack at schools.guidedchildhood.com/hub/data-protection.

process the personal data only on the School's documented instructions, including for any transfer outside the United Kingdom, unless required by law to do otherwise, in which case it will tell the School first unless the law prevents it;

ensure that everyone authorised to process the data is bound by confidentiality;

take the technical and organisational measures in Annex 2, and any further measures the nature of the data requires;

engage a further processor only from the list in Annex 3 or with the School's prior written consent, give at least 30 days' notice of any intended change to that list so that the School can object, and impose on each of them the same obligations as this section;

help the School, by appropriate measures, to respond to requests from individuals exercising their rights;

help the School meet its obligations on security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the nature of the processing and the information available;

at the School's choice, delete or return all the personal data at the end of the processing, and delete existing copies unless the law requires storage;

make available all information necessary to demonstrate compliance with this section, and allow for and contribute to audits and inspections by the School or an auditor it mandates, on at least 30 days' notice, no more than once in any twelve months unless a breach has occurred, during working hours and at the School's cost;

tell the School immediately if, in its opinion, an instruction infringes UK data protection law;

transfer personal data outside the United Kingdom only with safeguards recognised by UK law, such as an adequacy regulation or the UK International Data Transfer Addendum.

This agreement starts when the School's pilot or licence starts and continues for as long as Guided Childhood holds any personal data covered by it.

Each party's liability under this agreement is subject to the limits in the schools licence terms, save that nothing limits either party's liability to the extent that UK data protection law does not allow it to be limited.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.