Data Processing Agreement

This agreement is between the school, academy, college, nursery or other setting holding a Sensory Spark training licence (“the Controller”) and Sensory Spark, a sole trader in the United Kingdom (“the Processor”).

It supplements the school licence and governs personal data the Processor handles on the Controller's behalf. Where the two conflict on data protection, this agreement takes precedence. Terms such as personal data, processing, controller, processor and data subject carry the meanings given in UK GDPR and the Data Protection Act 2018.

Subject matter: delivery of the Sensory Spark staff CPD training platform, including issuing and verifying certificates.

Duration: for the term of the licence, plus the retention period set out in clause 9.

Nature and purpose: collecting, storing and displaying staff training completion records so that individual staff, the Controller's nominated administrator and, where asked, an inspector can evidence and verify completed CPD.

Data subjects: employees, contractors and volunteers of the Controller who use the training platform. No pupils, and no other children.

Personal data:

• the name the staff member puts on their certificate
• their account email address
• module identifier, title, strand and content version
• quiz score, number of attempts, and time spent on the module
• certificate reference, CPD minutes credited and completion date
• a declaration that the work was their own

No special category data under Article 9, and no criminal offence data, are processed. No pupil personal data is processed at any point.

The Processor shall:

• process personal data only on the Controller's documented instructions, of which this agreement and the licence are the initial set, unless required otherwise by law — in which case it will tell the Controller first, unless legally prohibited
• never use the personal data for its own purposes, for marketing, for profiling, or to train artificial intelligence models
• never sell, rent or share the personal data
• ensure anyone authorised to process the data is bound by a duty of confidentiality
• implement the security measures in clause 5
• immediately inform the Controller if, in its opinion, an instruction infringes data protection law

• Encryption of personal data in transit (TLS) and at rest
• Row-level access control enforced at the database, so an account can reach only its own records and an administrator only their own staff's records
• Authenticated access only; administrative access limited to the service owner
• Payment data never enters the Processor's systems — card processing is handled entirely by Stripe
• Restriction of internal materials, including quiz answer keys, to authorised users
• Regular review of access rules, and prompt patching of the hosting platform
• Ability to restore availability of personal data through the hosting platform's backups

The Controller gives general written authorisation for the Processor to engage the sub-processors listed below, each bound by written terms no less protective than this agreement.

The Processor will give the Controller at least 30 days' notice before adding or replacing a sub-processor that handles staff training records. If the Controller reasonably objects, it may terminate the licence and receive a pro-rata refund for the unused period.

Where personal data is transferred outside the United Kingdom, the Processor shall ensure it is covered by an adequacy decision or by appropriate safeguards — the UK International Data Transfer Agreement, or standard contractual clauses with the UK Addendum — together with any transfer risk assessment required.

The Processor shall, taking account of the nature of the processing and the information available to it, assist the Controller with:

• Data subject rights. If a staff member contacts the Processor directly to access, correct, delete or export their record, it will action reasonable requests and notify the Controller where the record forms part of the Controller's training evidence. Requests passed on by the Controller are actioned within 10 working days.
• Personal data breaches. Notification without undue delay and within 72 hours of becoming aware, to the Controller's nominated contact, with the nature of the breach, categories and approximate number of records affected, likely consequences and the measures taken — enough for the Controller to meet its own obligations.
• Data protection impact assessments and any prior consultation with the ICO, by supplying the information described in the DPO data sheet.
• Security obligations under Articles 32 to 36 generally.

Staff training records are retained for six years from completion, so that certificates remain verifiable for staff files and inspection.

On termination of the licence, and at the Controller's written choice, the Processor will return the records in a portable format or delete them — other than the minimal entry (certificate reference, module, date) required to confirm that a certificate already issued is genuine, and anything the Processor must keep by law. Deletion is completed within 30 days of the request, and confirmed in writing.

The Processor shall make available all information reasonably necessary to demonstrate compliance with Article 28 and allow for audits, including inspections, by the Controller or an auditor it mandates. In the first instance the Processor will respond to written questions and supplier questionnaires within ten working days; on-site or deeper audits may be requested once in any twelve-month period, or following a personal data breach, on reasonable notice.

Liability under this agreement is subject to the limits in the school licence, except that nothing limits liability that cannot lawfully be limited, or either party's direct liability to data subjects or a supervisory authority under UK GDPR.

This agreement is governed by the laws of England and Wales, with disputes subject to the exclusive jurisdiction of those courts.