Article 28 terms for hosted ClassDrop accounts

Parties

1. Purpose and scope

1.1 The School uses the Service to run its classes: setting and marking work, keeping pupil portfolios, recording reading and times-tables practice, running class screens, timetables and seating plans, keeping safeguarding records, and letting parents follow their child's work. To do this PCL stores and processes personal data about the School's pupils, staff and parents on the School's behalf.

1.2 The School is the controller and PCL is the processor of that data. This agreement applies for as long as PCL holds any of it. "Data protection law" means the UK GDPR and the Data Protection Act 2018 as amended, and terms used here have the meanings given there.

1.3 Annex A describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject.

2. PCL's obligations as processor

PCL shall:

1. Instructions. Process the personal data only on the School's documented instructions, which are: to provide the Service as described in the terms of use and configured by the School's own staff in the app; and any further written instruction the School gives. PCL will tell the School immediately if, in its opinion, an instruction infringes data protection law. PCL will not transfer the data outside the United Kingdom unless the School instructs it to or the law requires it, and will tell the School of any such legal requirement before processing unless the law forbids that.
2. Confidentiality. Ensure that every person PCL authorises to process the data is bound by a duty of confidentiality, has had appropriate training, and has access only to the extent their role needs.
3. Security. Implement the technical and organisational measures in Annex B, keep them under review, and maintain at least that standard for the life of this agreement.
4. Sub-processors. Use only the sub-processors listed in Annex C. PCL may add or replace a sub-processor by giving the School at least 30 days' written notice; if the School objects on reasonable data protection grounds and the parties cannot resolve it, the School may end the Service without penalty and PCL will refund the unused fees. PCL imposes on each sub-processor written terms that give at least the protection in this agreement and remains fully liable to the School for the sub-processor's performance.
5. Data subject rights. Help the School respond to requests from data subjects. The Service lets the School itself download everything held about a pupil, correct records, and erase a pupil; where a request cannot be met through the app, PCL will assist within 5 working days of being asked.
6. Assistance. Help the School meet its own obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the nature of the processing and the information available to PCL, including by providing its supplier pack and answering the School's reasonable questions.
7. Deletion and return. At the end of the Service, at the School's choice, return the data (the app's export provides all of it as a file, and PCL will assist if needed) and delete it. PCL will delete all of the School's data, including backups as they expire, no later than 90 days after the Service ends, or sooner on request, unless UK law requires PCL to keep some of it, in which case PCL will tell the School what and why.
8. Demonstrating compliance. Make available to the School all information reasonably necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by the School or an auditor mandated by the School, on reasonable notice, no more than once a year unless required by a supervisory authority or following a breach.

3. Personal data breaches

3.1 PCL will tell the School without undue delay, and in any case within 24 hours of becoming aware of a personal data breach affecting the School's data, so that the School can meet its own 72-hour duty to the ICO. The first notice may be partial; PCL will follow up as facts are established.

3.2 The notice will describe the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and a contact point. PCL will keep the School informed, cooperate with its investigation and with the ICO, and will not tell data subjects or the public about a breach of the School's data without the School's agreement unless the law requires it.

3.3 Notice is given by email to the School's named contact and, where the breach is serious, by telephone. PCL's incident procedure is summarised in Annex B.

4. The School's obligations

The School is responsible for the lawfulness of the data it enters, for its own privacy notices to pupils, parents and staff, for deciding which modules to switch on, for keeping its staff's sign-in details secure, for removing people from its records when they leave, and for issuing new parent codes where a code has reached the wrong person. The Service gives the School the tools for each of these.

5. What PCL will never do

PCL will not sell the data, share it with anyone except the sub-processors in Annex C as needed to provide the Service, use it for advertising or profiling, use it to train any machine-learning or artificial-intelligence model, or use it for its own product development beyond aggregate, non-identifying operational statistics such as storage used. If PCL ever proposes to introduce an AI feature that would process pupil data, that is a material change requiring the School's prior written agreement and a fresh data protection impact assessment.

6. Liability and term

6.1 Each party is liable for damage it causes by processing in breach of data protection law or this agreement, as data protection law provides. Nothing in the terms of use limits that liability where the law does not allow it to be limited.

6.2 This agreement starts on the start date of the Service and continues until PCL has deleted all of the School's data. Where this agreement and the terms of use conflict on a data protection matter, this agreement prevails.

6.3 This agreement is governed by the law of England and Wales.

Signatures

Annex A: details of the processing

Annex B: technical and organisational measures

Access control

• Staff sign in with email and password; passwords are checked against a deny list of common choices and stored only as scrypt hashes. Two-step verification (authenticator app) is available to every staff account and the School can require it; the office can reset it for a colleague who loses their phone.
• Pupils sign in on class devices with a class code and a PIN chosen by the teacher; PINs are stored hashed; sign-ins last one day and a pupil device signs itself out after 20 idle minutes and wipes its local copy.
• Parents sign in with a code the School prints; the office can reissue a code at any time, which signs out whoever used the old one.
• Every request is authorised by role on the server: staff see their school; pupils and parents receive only that child's own work, the class's shared folder and classmates' point totals without reasons; safeguarding records go only to the designated safeguarding lead and the reporting member of staff. Removing a person from the School's records withdraws their access immediately.
• Repeated failed sign-ins are rate-limited per account and per address.

Encryption

• In transit: HTTPS only, TLS 1.2 or later, HSTS, for the app, the API and the media store.
• At rest: the database and media storage are encrypted by the platform (Azure-managed keys). Session tokens are stored only as SHA-256 hashes.

Data minimisation and retention

• The server stores exactly what the app holds for each school, nothing else; no analytics or content logging.
• Media files are referenced by content hash and removed automatically when no record refers to them; deleted records leave a tombstone that is purged after 90 days; sign-in and safeguarding access logs are kept for 6 years then purged.
• The School can download a single pupil's complete record, erase a pupil (safeguarding records are retained by design, as statutory retention requires), export everything, or delete the whole school, from within the app, with a typed confirmation. Each of these actions is logged.

Availability and backup

• Automated database backups with point-in-time restore for 35 days; media storage with 35-day soft delete. Restore is tested at least termly.
• Each device keeps a working copy, so a short outage does not stop teaching, and reconciles when the service returns.
• The service is monitored with a health check; failures alert PCL.

Organisation

• Access to production systems is limited to named PCL staff with multi-factor authentication on the cloud account; there is no shared credential. Access is reviewed termly and withdrawn when someone leaves.
• Dependencies are audited monthly and security updates applied promptly. The application carries a strict content security policy and loads nothing from third parties.
• An incident procedure is maintained (detect, contain, assess, notify the School within 24 hours, remediate, review) and rehearsed annually. A vulnerability disclosure contact is published at classdrop.co.uk/.well-known/security.txt.
• Cyber Essentials certification and an independent security review are planned; PCL will tell the School when each is complete.

Annex C: sub-processors

PCL will publish the current sub-processor list at classdrop.co.uk/dpa/ and give 30 days' notice of changes. PCL's data protection lead is Charlie Mackenzie, hello@classdrop.co.uk.