Data processing agreement for schools

The short version

• When your teachers use helloworld classes, your school is the controller of the class data (who is in each class, the accounts teachers make for pupils, and what teachers see), and Camau Training and Consultancy Ltd acts for you as processor.
• We only use that data to run helloworld for you. We never sell it, use it for advertising, or let anyone use it to train AI.
• It's hosted in the UK. We delete accounts your teachers made 3 months after they're in none of your classes, and everything else on request.
• This agreement meets the requirements of Article 28 of the UK GDPR. It forms part of the terms between your school and Camau.

1. Who the parties are

• The school (or other organisation) whose teachers hold helloworld teacher accounts and use classes: the controller.
• Camau Training and Consultancy Ltd, company number 12295821, registered office 11 Parc Bryn, Skewen, Neath SA10 6YY, ICO registration ZB037861, which runs helloworld.org.uk: the processor.

A school agrees to this agreement when a teacher, acting for the school, accepts it on setting up classes, or when the school signs a copy. A signed copy is available from info@camau.org.uk.

2. What is processed

Where a pupil joins a class from an account they made themselves, that account stays theirs and Camau is its controller under our privacy notice; the school is controller of what its teachers see and do in its classes.

3. What Camau does

Camau will:

1. process the data only on the school's documented instructions, which are this agreement and what its teachers do in helloworld, unless the law requires otherwise (in which case we tell the school first, unless the law forbids it);
2. make sure everyone who can access the data is bound to keep it confidential;
3. keep it secure (section 5);
4. use other processors only as in section 6;
5. help the school respond to requests from pupils and parents exercising their rights, within the service where it can (teachers can see, remove and reset pupils' accounts) and otherwise on request;
6. help the school meet its own security, breach and DPIA duties, given what Camau knows about the processing;
7. delete or return the data at the end (section 7);
8. give the school the information it needs to show this agreement is met, and allow reasonable audits (section 8);
9. tell the school straight away if an instruction seems to break data protection law.

4. What the school does

The school will:

• make sure it has a lawful basis for its pupils using helloworld (usually public task, for teaching), and tell pupils and parents through its own privacy notice;
• only add pupils its teachers teach, and use only names that are needed (a first name and initial is enough);
• keep teachers' sign-ins and printed pupil log-in sheets safe, and remove teachers' access when they leave (an admin of helloworld can help);
• remove pupils from classes when they no longer need them;
• not use helloworld to make decisions about pupils without a teacher's own judgement.

5. Security

Camau's measures include:

• hosting in the UK (Hostinger), with backups in Germany, both covered by UK adequacy regulations;
• HTTPS everywhere, with strict security headers;
• names, email addresses and usernames encrypted by the site itself (AES-256), with the key held outside the database;
• passwords stored only as slow one-way hashes, by an established sign-in library; two-factor sign-in required for teachers and for all helloworld staff;
• every request checked on the server so teachers see only their own classes, and only each class's subject; every view of a class or pupil logged;
• helloworld's content editors can't see any pupil or teacher data; admins see account details only for support, and every look is logged;
• weekly checks of software dependencies, and a written breach procedure.

6. Sub-processors

The school agrees to Camau using these sub-processors, each under a written contract with the same data protection obligations:

Camau will tell schools (through their teachers' email addresses) at least 30 days before adding or replacing a sub-processor, so a school can object. If it does and we can't resolve it, the school can stop using classes and have its data deleted.

7. When it ends

• An account a teacher made is deleted 3 months after it's in none of the school's classes with a teacher on a current plan. The pupil sees the date on their account page and can download their results first.
• When a pupil leaves a class, its teachers lose access to that pupil's results straight away.
• The school can ask us at any time to delete all its classes and the accounts its teachers made, or to send it a copy of the class results first. We do this within 30 days.
• Deleted data drops out of backups within 30 days.

8. Breaches, audits and help

• Camau will tell the school without undue delay, and within 48 hours of becoming aware of a personal data breach affecting its data, with what it knows, and will keep it updated.
• Camau will answer reasonable questions and questionnaires about its processing, and provide copies of the relevant policies. Audits beyond that are by agreement, with reasonable notice.

9. Liability, law and contact

• Each party is responsible for its own compliance with data protection law. Liability between the parties is as set out in the terms between them.
• This agreement is governed by the law of England and Wales.
• Contact for data protection: Melanie Beynon, data protection lead, info@camau.org.uk.