Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Volume Media Limited (trading as SchoolCentralX), a company registered in England and Wales with its registered office at 20-22 Wenlock Road, London, N1 7GU, England, United Kingdom ("SchoolCentralX", "Processor", "we", "us", "our") and the school, trust, nursery, college, academy group, or other educational organisation using the Services ("Customer", "Controller").

This DPA applies where SchoolCentralX processes Personal Data on behalf of the Customer in connection with the SchoolCentralX website, web platform, mobile applications (designed for parents and guardians), and related services (the "Services").

Where SchoolCentralX processes personal data for its own business purposes (such as billing, security monitoring, fraud prevention, legal compliance, support operations, or service improvement), SchoolCentralX acts as a controller and this DPA does not apply to that processing.

1. Definitions

In this DPA:

• "Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and any other applicable data protection or privacy laws.
• "Customer Personal Data" means any Personal Data processed by SchoolCentralX on behalf of the Customer in connection with the Services.
• "Data Subject", "Personal Data", "Controller", "Processor", "Processing", "Personal Data Breach", "Special Category Data", and "Sub-processor" have the meanings given in Applicable Data Protection Law.
• "UK GDPR" means the United Kingdom General Data Protection Regulation.

Capitalised terms not defined in this DPA have the meanings given in the Main Agreement (including any subscription agreement, order form, or Terms and Conditions).

2. Purpose and Scope

2.1 This DPA sets out the terms under which SchoolCentralX processes Customer Personal Data as a Processor when providing the Services.

2.2 This DPA applies only to the extent that SchoolCentralX acts as a Processor.

2.3 In the event of any conflict between this DPA and the Main Agreement regarding the processing of Customer Personal Data, this DPA shall prevail.

2.4 The details of the processing are set out in Schedule 1.

3. Customer Instructions and Responsibilities

3.1 SchoolCentralX shall process Customer Personal Data only:

• on the documented instructions of the Customer;
• as necessary to provide the Services in accordance with the Main Agreement and the Customer's configuration and use of the Services; or
• as required by applicable law (in which case SchoolCentralX shall inform the Customer of that legal requirement, unless prohibited by law).

3.2 The Customer instructs SchoolCentralX to process Customer Personal Data as reasonably necessary to deliver, host, secure, support, maintain, and improve the Services.

3.3 The Customer remains responsible for:

• ensuring it has all necessary lawful bases, notices, permissions, and consents to provide Customer Personal Data to SchoolCentralX (including for any student or children's data);
• the accuracy, legality, and appropriateness of its instructions and uploaded data;
• configuring appropriate user roles and permissions, particularly for parent/guardian access;
• responding to Data Subject requests where the Customer is the Controller;
• its own controller obligations under Applicable Data Protection Law, including COPPA, FERPA, and safeguarding requirements.

3.4 The Customer acknowledges that SchoolCentralX is not responsible for reviewing the legality of the Customer's instructions or data uploads, except as required by Applicable Data Protection Law.

4. Personnel and Confidentiality

SchoolCentralX shall ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations (contractual or statutory) and access Customer Personal Data only as necessary for their duties. Reasonable steps shall be taken to ensure the reliability and training of such personnel.

5. Security Measures

5.1 SchoolCentralX shall implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures take into account the nature, scope, context, purposes of processing, and the risks involved (see Schedule 2 for a summary).

5.2 SchoolCentralX may update its security measures from time to time, provided that such updates do not materially reduce the overall level of protection.

6. Sub-processors

6.1 The Customer grants general written authorisation for SchoolCentralX to engage Sub-processors to provide the Services.

6.2 SchoolCentralX shall maintain an up-to-date list of current Sub-processors and make it available to the Customer on request (or via a publicly accessible page).

6.3 When engaging a new Sub-processor, SchoolCentralX shall notify the Customer at least 30 days in advance where practicable. The Customer may object on reasonable data protection grounds. If the parties cannot reach a mutually acceptable solution, the Customer may terminate the affected portion of the Services on written notice.

6.4 SchoolCentralX shall impose data protection obligations on each Sub-processor that are substantially equivalent to those in this DPA and shall remain liable for the Sub-processor's performance to the extent required by Applicable Data Protection Law.

7. International Transfers

7.1 SchoolCentralX may process or transfer Customer Personal Data outside the United Kingdom where necessary for the provision of the Services.

7.2 For any restricted international transfer, SchoolCentralX shall ensure an appropriate lawful transfer mechanism is in place, such as:

• UK adequacy regulations or decisions;
• the UK International Data Transfer Addendum (IDTA);
• EU Standard Contractual Clauses together with the UK International Data Transfer Addendum; or
• any other mechanism recognised under Applicable Data Protection Law.

7.3 SchoolCentralX shall provide information about the transfer mechanisms used upon reasonable request, subject to confidentiality and security considerations.

8. Assistance to the Customer

SchoolCentralX shall provide reasonable assistance to the Customer (taking into account the nature of the processing and information available to SchoolCentralX) with:

• handling Data Subject requests (SchoolCentralX shall forward any request received directly to the Customer and shall not respond unless instructed or required by law);
• Personal Data Breach notification and investigation;
• data protection impact assessments (where relevant to the Services);
• prior consultation with supervisory authorities; and
• reasonable regulator enquiries relating to the Services.

Assistance beyond standard legal obligations may be subject to reasonable fees.

9. Personal Data Breaches

SchoolCentralX shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification shall include available details to enable the Customer to comply with its obligations under Applicable Data Protection Law. SchoolCentralX shall take reasonable steps to investigate, mitigate, and remediate the breach.

10. Audit Rights

10.1 SchoolCentralX shall make available to the Customer such information as is reasonably necessary to demonstrate compliance with this DPA (including completed security questionnaires, summaries, or third-party audit reports where available).

10.2 The Customer may request an audit of SchoolCentralX's relevant processing activities at most once per calendar year. Any audit must be:

• conducted on reasonable prior written notice (at least 30 days unless otherwise agreed);
• carried out during normal business hours and in a manner that minimises disruption;
• subject to appropriate confidentiality obligations; and
• limited so as not to compromise the security or rights of SchoolCentralX, its other customers, or third parties.

SchoolCentralX may satisfy the audit obligation through provision of independent third-party audit reports where appropriate. The Customer shall bear its own costs and SchoolCentralX's reasonable external costs, unless the audit reveals a material breach by SchoolCentralX.

11. Deletion or Return of Customer Personal Data

11.1 Upon termination or expiry of the Services, and at the Customer's documented request, SchoolCentralX shall delete or return all Customer Personal Data within a reasonable period (typically 30–90 days), subject to the Main Agreement and Applicable Data Protection Law.

11.2 If the Customer does not provide instructions within a reasonable time, SchoolCentralX may delete the data in accordance with its standard retention practices.

11.3 SchoolCentralX may retain limited copies of Customer Personal Data to the extent required by law, for safeguarding or security purposes, dispute resolution, or within secure backup/archival systems, provided such data remains protected in accordance with this DPA.

12. Children's Data

The Services are parent-facing. The mobile applications are designed for use by parents and guardians only; students do not have direct access to the mobile app.

Where the Customer uploads or manages student data (including data relating to children under 13) for sharing with parents/guardians, the Customer remains the Controller and is fully responsible for determining the lawful basis, providing notices, and obtaining any required consents or authorisations under applicable laws, including COPPA (US), FERPA, GDPR, and safeguarding requirements. SchoolCentralX processes such data solely as a Processor for school-authorised educational and parent-communication purposes and does not use children's personal data for advertising, targeted advertising, sale, or unrelated commercial purposes.

13. Liability and General Provisions

13.1 Each party's liability under this DPA shall be subject to the exclusions and limitations of liability set out in the Main Agreement, except to the extent such limitations are not permitted under Applicable Data Protection Law.

13.2 Nothing in this DPA excludes or limits liability for matters that cannot lawfully be excluded or limited.

14. Governing Law and Jurisdiction

This DPA is governed by the laws specified in the Main Agreement. If the Main Agreement does not specify governing law, this DPA shall be governed by the laws of England and Wales, and the courts of England and Wales shall have exclusive jurisdiction (except where Applicable Data Protection Law requires otherwise).

15. Contact

For privacy and data protection matters relating to this DPA:

Registered Office: 20-22 Wenlock Road, London, N1 7GU, England, United Kingdom

Related Documents

• Privacy Policy — Full details on data collection, retention, and your rights
• Terms and Conditions — Master Services Agreement governing platform use
• Legal Overview — All legal and compliance documentation