Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the SchoolJewel Terms and Conditions between Vladimir Keves, a sole trader trading as LD Pro, of 6 Coldhams North, Huntingdon, England, PE29 1UB (the "Processor", "we"), and the school, academy, trust or other educational organisation that registers for the Service (the "School", the "Controller"). It is included to meet Article 28 of the UK GDPR. It takes effect automatically when the School first enters personal data into the Service, and applies for as long as we process that data. A printable record for your files is in the School and Trust Compliance Centre.

Terms such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR. In this DPA:

• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended from time to time (including by the Data (Use and Access) Act 2025), and any other applicable UK data protection legislation.
• School Personal Data means personal data processed by us on behalf of the School through the Service, as described in Annex 1.
• Sub-processor means any third party appointed by us to process School Personal Data.
• Service has the meaning in the Terms.

2.1 For School Personal Data, the School is the controller and we are the processor.

2.2 We are an independent controller (not a processor) of the personal data described in our Privacy and Cookies Policy as being used for our own purposes: account and billing administration, support correspondence, website security, basic website visit statistics (Google Analytics, which never receives School Personal Data) and the improvement of the Service using anonymous statistics. This DPA does not apply to that processing.

2.3 If the person registering is an individual teacher or other member of staff, they confirm that they act on behalf of the School and that the School has authorised them to enter into this DPA.

3.1 We will process School Personal Data only on the School's documented instructions, which are: (a) the Terms and this DPA; (b) the School's use and configuration of the Service (including creating, editing and deleting classes, pupils, Houses and prizes, and awarding or removing points); and (c) any other written instruction agreed by us. We will tell the School if we think an instruction breaches Data Protection Law, and may suspend the instruction until it is changed or confirmed.

3.2 We will not process School Personal Data for our own purposes, including advertising, marketing, profiling, or training of artificial intelligence systems. We may use anonymous, aggregated statistics that cannot identify any School, individual or pupil, to run and improve the Service.

3.3 Where law requires us to process School Personal Data otherwise than on the School's instructions, we will tell the School before doing so unless the law prohibits it.

3.4 The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subject are set out in Annex 1.

The School is responsible for:

• deciding what information about pupils and staff is entered into the Service, and ensuring it is adequate, relevant and limited to what is necessary (data minimisation);
• having a lawful basis (and, where relevant, a condition under Article 9 or Schedule 1 of the Data Protection Act 2018) for the processing it instructs us to carry out;
• giving pupils, parents and carers, and staff the information required by Articles 13 and 14 of the UK GDPR (we provide a template notice in the Compliance Centre);
• carrying out any Data Protection Impact Assessment it considers necessary (we provide a template and will assist under clause 10);
• keeping information accurate and up to date and removing pupils who have left;
• ensuring that only appropriate staff have accounts, that login details and login cards are kept secure, and that staff follow its own data protection and safeguarding policies; and
• responding to requests and complaints from data subjects about its own use of the Service.

Pupil names. The Service does not need full names. We recommend that pupils are identified only by a first name and the initial of their surname (for example "Alex M."), a first name, or a class-based identifier. If the School chooses to enter full names or any other information, the School confirms that it has considered whether this is necessary and proportionate, and accepts responsibility as controller. The School must not enter special category data, safeguarding information, special educational needs information, dates of birth, contact details, photographs, or free-text comments about pupils.

We will ensure that everyone who is authorised by us to process School Personal Data is subject to a duty of confidentiality, receives appropriate data protection training, and processes School Personal Data only as necessary to provide and support the Service.

6.1 We will implement appropriate technical and organisational measures to protect School Personal Data, taking into account the state of the art, costs, the nature of the processing and the risks to data subjects. The measures in effect at the date of this DPA are summarised in Annex 2.

6.2 We may update these measures, provided that the update does not materially reduce the overall level of protection.

7.1 The School gives us general authorisation to use the Sub-processors listed in Annex 3.

7.2 We will give the School at least 30 days' notice (by email to the School Leader and by updating Annex 3) of any new Sub-processor or replacement of an existing one. The School may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the School may terminate the affected part of the Service and we will refund any pre-paid fees for the unused period.

7.3 We will have a written contract with each Sub-processor that imposes data protection obligations no less protective than this DPA, and we remain responsible to the School for each Sub-processor's performance.

8.1 We host School Personal Data in the European Union, and keep encrypted backups in storage in the European Union. We will not transfer School Personal Data to a country outside the UK or the European Economic Area, or to an international organisation, unless the transfer complies with Data Protection Law, for example because the destination is covered by UK adequacy regulations, or an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place, with any required transfer risk assessment.

8.2 Any such transfer will be notified to the School under clause 7.2 before it takes place.

9.1 Taking into account the nature of the processing, we will assist the School by appropriate technical and organisational measures to respond to requests from data subjects to exercise their rights (for example access, rectification, erasure and restriction).

9.2 If we receive a request directly from a pupil, parent, carer or member of staff relating to School Personal Data, we will not respond substantively, but will promptly (and normally within 5 working days) pass it to the School.

9.3 The School can correct and delete School Personal Data itself within the Service. Where the School needs an export of the data held about a particular pupil, we will provide it within a reasonable time on request to info@schooljewel.com.

We will provide reasonable assistance to the School in meeting its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, impact assessments and prior consultation with the ICO), taking into account the nature of the processing and the information available to us. Reasonable requests are free of charge. We may charge a reasonable fee for requests that are manifestly excessive or that require significant additional work.

11.1 We will notify the School Leader by email without undue delay, and aim to do so within 48 hours, after becoming aware of a personal data breach affecting School Personal Data.

11.2 Our notification will, as far as we know at the time, describe: the nature of the breach (including categories and approximate numbers of data subjects and records); the likely consequences; the measures taken or proposed to address it; and a contact point for more information. We will provide further information as it becomes available.

11.3 We will take reasonable steps to contain and remedy the breach, and will cooperate with the School so that it can meet its own duty to notify the ICO (normally within 72 hours of the School becoming aware) and to inform data subjects where required. We will not tell data subjects or the ICO about a breach on the School's behalf unless the law requires us to or the School asks us to.

12.1 We will make available to the School the information reasonably necessary to demonstrate our compliance with this DPA and Article 28 of the UK GDPR.

12.2 The School may, on reasonable notice (normally at least 30 days) and no more than once in any 12-month period (unless a breach has occurred or a regulator requires it), carry out or appoint an independent auditor to carry out an audit of our compliance, subject to reasonable confidentiality, security and scheduling requirements. The School bears the cost of any audit it initiates, unless the audit reveals a material breach of this DPA by us.

12.3 We may satisfy requests under this clause by providing completed security questionnaires, summaries of independent assessments and written answers, where these are sufficient.

13.1 The School can delete pupils, classes and its whole School at any time using the Service. Deleting a pupil permanently removes their account and the points, prize and message records linked to them. Deleting a class removes its Teacher account and all of its pupil accounts.

13.2 When the Agreement ends, or on the School's written request, we will delete School Personal Data from our live systems within 30 days, and will confirm deletion in writing on request. Backups are encrypted and overwritten on a rolling basis. A backup is kept for up to 90 days from the date it was created, so School Personal Data disappears from backups within that time. We will keep a copy only where the law requires, and will then keep it securely and process it only for that purpose.

13.3 If a paid membership ends without renewal, we will retain School Personal Data for 90 days so that the School may renew or request an export, and will then delete or anonymise it. A School on the free level that has been inactive for 12 months may have its data deleted after we have emailed a reminder.

13.4 Before deletion, the School may ask for an export of its School Personal Data in a commonly used electronic format.

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in clause 19 of the Terms, to the extent permitted by law. Nothing in this DPA limits any liability that cannot lawfully be limited, or affects the rights of data subjects against either party under Data Protection Law.

15.1 This DPA continues for as long as we process School Personal Data, even if the Terms have otherwise ended.

15.2 We may update this DPA to reflect changes in Data Protection Law or the Service. We will give School Leaders at least 30 days' notice of any material change by email. If the School does not agree, it may end the Agreement and ask us to delete its data.

15.3 If there is a conflict between this DPA and the Terms or the Privacy and Cookies Policy about the processing of School Personal Data, this DPA prevails.

15.4 This DPA is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

15.5 Agreement to the Terms is acceptance of this DPA. If the School's policies require a signed copy, email info@schooljewel.com and we will return a countersigned version.

Vladimir Keves, a sole trader trading as LD Pro, 6 Coldhams North, Huntingdon, England, PE29 1UB. Email: info@schooljewel.com (please put "Data protection" in the subject line). We are not required to appoint a Data Protection Officer. Data protection enquiries are handled by the owner.

Hosting and network

• Hosted with Websupport s. r. o. (EU), within the European Union. All traffic is encrypted in transit using HTTPS.
• Website software, themes and plugins are kept up to date.

Access control

• Strict role separation: School Leaders manage their own school; Teachers manage only their own class; pupils can only see their own information and can manage nothing.
• Every request to the Service is checked for a valid session, a security token and ownership of the information concerned. Identifiers sent by a browser are never trusted without those checks.
• Teacher and Pupil accounts have no access to the WordPress administration area, and the standard WordPress password-reset-by-email route is disabled for them.
• Teacher passwords are randomly generated (14 characters), shown once and stored only in hashed form. A new password logs out all open sessions.
• Pupil login details are randomly generated, printed on login cards and held in a form that allows the teacher to reprint cards. They protect only the pupil's own points, prizes and messages, which contain no sensitive information. A teacher can issue a new password at any time.
• The QR codes on login cards are generated in the browser. The login details are carried in the part of the address that browsers do not send to the server.
• Administrative access by our staff is limited to named individuals and used only to provide support or maintain the Service.

Data protection by design

• No pupil email addresses are collected. Pupils cannot upload content or message anyone.
• Thank-you messages come from a fixed, pre-approved list.
• Deleting a pupil, class or School removes the linked records.
• Per-School locks prevent concurrent changes from corrupting points balances, and every change is recorded in a history.

Backups and recovery

• Backups of the database, which holds all personal information, are encrypted on our server before they leave it, and are then copied to encrypted storage with Amazon Web Services (AWS) S3 in the European Union.
• Each backup is kept for up to 90 days from the date it was created, and is then overwritten.
• Security incidents are logged and reviewed; breaches are handled under clause 11.

Organisational measures

• Confidentiality commitments and data protection awareness for anyone with access.
• A documented incident response process and regular review of these measures.

Payment provider. Our payment provider, Stripe, processes card payments for School Leaders as an independent controller and does not receive pupil information. It is not a Sub-processor.

Software. The WordPress platform and the plugins that provide memberships (Paid Memberships Pro) and points (GamiPress) run on our own hosting and do not send School Personal Data to their developers.

Website statistics. Basic visit statistics for our public website are provided by Google Analytics. This is our own activity as controller. It does not receive School Personal Data and is not a Sub-processor.

We will update this list and give notice under clause 7.2 before changing it.