Data Processing Agreement

This agreement is dated …………………………………

PARTIES:

1. (School Name) ……………………………….. known as “the School”

2. Boom Apps (BoomReader and BoomWriter) known as “the Provider”

BACKGROUND

The Customer and the Provider entered into [SERVICE PROVIDER AGREEMENT] (Master Agreement) on [INSERT DATE] that may require the Provider to process Personal Data on behalf of the Customer.

This Personal Data Processing Agreement (Agreement) sets out the additional terms, requirements and conditions on which the Provider will process Personal Data when providing services under the Master Agreement. This Agreement contains the mandatory clauses required by Article 28(3) of the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR) for contracts between controllers and processors.

DEFINITIONS

Definitions and Interpretation

The following definitions and rules of interpretation apply in this Agreement.

Definitions:

Controller

has the meaning given to it in section 6, DPA 2018.

Processor

a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

Data Protection Legislation

all applicable data protection and privacy legislation in force from time to time in the UK, including without limitation the UK GDPR and the Data Protection Act 2018 (and regulations made thereunder) (DPA 2018), or any successor legislation.

Data Subject

the identified or identifiable living individual to whom the Personal Data relates.

Personal Data

means any information relating to an identified or identifiable living individual that is processed by the Provider on behalf of the Customer as a result of, or in connection with, the provision of the services under the Master Agreement; an identifiable living individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

Processing, processes, processed, process

any activity that involves the use of the Personal Data. It includes, but is not limited to, any operation or set of operations which is performed on the Personal Data or on sets of the Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing also includes transferring the Personal Data to third-parties.

Personal Data Breach

a breach of security leading to the accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of, or access to, the Personal Data.

Processor

a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

UK GDPR

has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.

1 DATA PROTECTION

1.1 Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause 1 is in addition to, and does not relieve, remove or replace, a party's obligations under the Data Protection Legislation. In this clause 1, Applicable Laws means (for so long as and to the extent that they apply to the Provider) Domestic UK Law; and Domestic UK Law means the UK Data Protection Legislation and any other law that applies in the UK.

1.2 The parties acknowledge that for the purposes of the Data Protection Legislation, the School is the data controller and the Provider is the data processor (where Data Controller and Data Processor have the meanings as defined in the Data Protection Legislation). Schedule One sets out the scope, nature and purpose of processing by the Provider, the duration of the processing and the types of personal data (as defined in the Data Protection Legislation, Personal Data) and categories of Data Subject.

1.3 Without prejudice to the generality of clause 1.1, the School will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Personal Data to the Provider for the duration and purposes of this agreement.

1.4 Without prejudice to the generality of clause 1.1, the Provider shall, in relation to any Personal Data processed in connection with the performance by the Provider of its obligations under this agreement:

(a) process Personal Data only on the written instructions of the School unless the Provider is required by Applicable Laws to otherwise process that Personal Data. The Provider will not process the Personal Data for any other purpose or in a way that does not comply with this Agreement or the Data Protection Legislation. The Provider must promptly notify the Customer if, in its opinion, the Customer's instructions do not comply with the Data Protection Legislation.

(b) ensure that it has in place appropriate technical and organisational measures, reviewed and approved by the School to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);

(c) ensure that all personnel who have access to and / or process Personal Data are obliged to keep the Personal Data confidential; and

(d) not transfer any Personal Data outside of the UK unless the prior written consent of the School has been obtained and the following conditions are fulfilled:

(i) the School or the Provider has provided appropriate safeguards in relation to the transfer;

(ii) the data subject has enforceable rights and effective legal remedies;

(iii) the Provider complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred; and

(iv) the Provider complies with reasonable instructions notified to it in advance by the School with respect to the processing of the Personal Data;

(e) assist the School at the School’s cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(f) notify the School without undue delay on becoming aware of a Personal Data breach;

(g) at the written direction of the School, delete or return Personal Data and copies thereof to the School on termination of the agreement unless required by Applicable Law to store the Personal Data; and

(h) maintain complete and accurate records and information to demonstrate its compliance with this clause.

1.5 The School consents to the Provider appointing third-party processors of Personal Data under this agreement. The Provider confirms that it has entered or (as the case may be) will enter with the third-party processor into a written agreement incorporating terms which are substantially similar to those set out in this clause. As between the School and the Provider, the Provider shall remain fully liable for all acts or omissions of any third-party processor appointed by it pursuant to this clause.

1.6 Either party may, at any time on not less than 30 days’ notice, revise this clause 1 by replacing it with any applicable controller to processor standard clauses or similar terms forming party of an applicable certification scheme (which shall apply when replaced by attachment to this agreement).

SIGNED on behalf of

…………………………………………………….School

Date: …………………………………

SIGNED on behalf of
BoomApps

Date: ………………………………….

Schedule 1 - Processing, Personal Data and Data Subjects

Description	Details
Authorised Persons	The persons or categories of persons that the School authorises to give the Provider written personal data processing instructions and from whom the Provider agrees solely to accept such instructions.
Duration of the processing	The duration of the processing shall be for the duration of the contract.
Conditions of data processing	BoomApps (Squirrel Learning) processes data under the condition of legitimate interests as outlined in Article 6(1)(f) of the GDPR. Data is processed in ways necessary for the purposes of our legitimate interests, which typically involve educational or school-related purposes, (monitoring students' reading progress), without overriding the privacy rights of individuals.
Nature and purposes of the processing	The nature of the processing will involve the school sharing personal information of pupil’s names and classes and teacher’s names with the Provider who will process the data to establish individual pupil accounts. The anonymised data will be stored on the Provider’s Servers. It will be accessed for the purposes of supporting with technical issues and in accordance with the school’s instructions. The purpose of the processing is to assist the school with improving the reading skills of children in school
Types of personal data	The following data relating to children, staff and teachers will be shared with the Provider: School name and contact information (including school postal address, phone number and email address) Teachers’ names and contact information (including school phone numbers and school email addresses) Pupils’ names, class/year group Parent email addresses (optional). For schools subscribing to the BoomReader Data Dashboard product and/or providing access to Management Information Systems via Wonde, then sensitive personal data in the form of: Gender Ethnicity Special Educational Needs Pupil Premium entitlement English as an additional language is used to provide comparative data for the purposes of school improvement and targeting specific pupil groups or individuals. Wonde’s Privacy and Data Protection policies can be accessed here
Categories of data subject	Pupils (children aged between 4 – 16 years old) Staff (teachers and support staff) Parent email addresses (optional)
Storing personal data	Personal data is stored within Squirrel Learning’s encrypted secure data systems, hosted within the UK and EU.
Transferring personal data	BoomApps (Squirrel Learning) does not routinely share any data collected. Data would only be shared with the permission of the school(s) concerned.
Retention period	Data is retained for the duration of the subscription contract between Squirrel Learning and schools. This is updated via regular Wonde synchronisation or via a .csv upload. In the event of a school cancelling their BoomApps subscription, the personally identifiable information, of pupils and parents, is anonymised within our systems upon receipt of confirmation of the cancellation. The personally identifiable information of any pupil will be anonymised automatically after a period of 90 days, following notification of subscription cancellation or if individual pupils leave the school (for Wonde schools this will be automated, for other schools it will be the responsibility of the school to notify Squirrel Learning). At the end of an academic year, leaving cohorts will have their personally identifiable data anonymised within 90 days. This data will be retained for one academic year in order to provide schools with the opportunity to analyse comparative data and to improve the service. Squirrel Learning may retain anonymised data for longer to improve the service and undertake longitudinal data analysis.
Deletion of data	Upon a written request by the School, BoomApps (Squirrel Learning) shall destroy all Data (including all copies of the Data) in its possession or control (including any Data subcontracted to a third party for processing) Upon deletion of a pupil account all associated records/work will be anonymised. This work may feature in published outcomes of the project and will be retained by BoomApps (Squirrel Learning) and potentially used to further enhance the Product. This requirement shall not apply to the extent that the BoomApps is required by any EU (or any EU Member State) law to retain some or all of the Data, in which event the Company shall isolate and protect the Data from any further processing except to the extent required by such law.