EduTrace
For schools

Data Processing Agreement

How EduTrace looks after your school's data.

This agreement is between the school that starts a free trial or subscription to the EduTrace platform ("the School", the Controller) and EduTrace Ltd ("EduTrace", the Processor), company no. 17527972, registered office 128 City Road, London, EC1V 2NX. It forms part of the contract for the School's use of the platform ("the Service"), including any free trial, and applies from the date the School starts one.

Version 1.0 · Effective 23 October 2026

1. Definitions

1.1  "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any other UK law on personal data. "Personal Data", "Process", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings in the UK GDPR. "School Data" means the Personal Data EduTrace Processes for the School through the Service, as described in Annex 1. "Sub-processor" means a third party engaged by EduTrace that Processes School Data.

2. Roles

2.1  For School Data the School is the Controller and EduTrace is the Processor. The School decides why and how School Data is Processed, and is responsible for having a lawful basis, for the accuracy of the data it enters, and for telling Data Subjects how it is used.

2.2  For its own business records (billing, enquiries, and the record that this agreement was accepted) EduTrace is an independent Controller. These contain no student or assessment data.

3. What EduTrace will do

3.1  Process School Data only on the School's documented instructions (this agreement and the School's use of the Service), and never for its own purposes, for sale or for marketing. EduTrace will tell the School promptly if it thinks an instruction breaches Data Protection Law.

3.2  Make sure everyone with access to School Data is bound by confidentiality and has access only as needed. EduTrace's platform administrators cannot see student or assessment data through the Service, and EduTrace will access it only to fix a fault or security issue, at the School's request or as the law requires, and will keep a record of that access.

3.3  Protect School Data with appropriate technical and organisational measures (Article 32 UK GDPR), as set out in Annex 2. The School is responsible for having a lawful basis, and where needed an Article 9 condition, for the support flags it records (such as SEN and EHCP), which may reveal sensitive information.

3.4  Tell the School without undue delay, and within 48 hours, after becoming aware of a Personal Data Breach affecting School Data, with what is known about it, and help the School decide whether to report it to the ICO or to Data Subjects.

3.5  Pass to the School without undue delay any request from a Data Subject, and help the School to respond. Routine help is free; EduTrace may charge reasonable costs for work that goes beyond the Service's normal features.

3.6  Help the School with its obligations on security, impact assessments and consulting the ICO (Articles 32 to 36 UK GDPR).

4. What the School will do

4.1  Make sure it has the right to give EduTrace the School Data and to give these instructions, and enter only the data it needs.

4.2  Keep its staff sign-in details secure, decide which staff can access which subjects and classes, remove access when staff leave, and tell EduTrace promptly if it suspects an account has been compromised.

5. Sub-processors and transfers

5.1  The School authorises the Sub-processors in Annex 3. EduTrace will give at least 30 days' notice by email before adding or replacing one. The School may object on reasonable data protection grounds within that time; if it cannot be resolved, the School may end the subscription and receive a refund of the unused part of the paid term.

5.2  EduTrace will have a written contract with each Sub-processor with equivalent data protection obligations, and remains responsible for them.

5.3  EduTrace will keep School Data in the UK and will not transfer it outside the UK without the School's prior written agreement.

6. Audit

6.1  EduTrace will give the School the information it reasonably needs to show compliance with this agreement. The School may audit EduTrace on at least 30 days' written notice, once a year (or after a Personal Data Breach), in working hours, with an auditor bound by confidentiality, and without access to other schools' data. The School bears its own costs and EduTrace's reasonable costs of any audit after the first in a year.

7. Return and deletion

7.1  While the subscription or trial is active the School can view and export its data in the Service and ask EduTrace to delete any of it.

7.2  When a subscription or trial ends, access stops on the end date. EduTrace keeps School Data for 3 months so the School can renew or convert, then permanently deletes all of it, including backups within 30 days. The School may ask for earlier deletion in writing, which EduTrace will complete within 30 days and confirm.

7.3  EduTrace may keep, as an independent Controller, records the law requires it to keep, such as billing records, and the record of the School agreeing to this agreement, for 7 years after the contract ends.

8. General

8.1  Agreement: this agreement is incorporated into the terms on which EduTrace provides the Service and applies when the School starts a free trial or subscription. When the School's head of department first signs in they confirm the School's agreement and that they are authorised to give it, and EduTrace records who, when and which version. EduTrace publishes the current version at this address and will give the School at least 30 days' notice of any material change. A signed copy is available on request.

8.2  Term: this agreement lasts as long as EduTrace Processes School Data, including the retention period in clause 7.2. Clauses 7 and 8 survive its end.

8.3  Liability under this agreement is subject to the limits and exclusions in the terms on which EduTrace provides the Service, except where the law does not allow liability to be limited. If this agreement conflicts with the Terms on the Processing of School Data, this agreement prevails.

8.4  This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.