This agreement is between the school that opens a Kudolings school account (“the School”) and [Company name] Ltd(“Kudolings”). It sets out how Kudolings processes personal data on the School’s behalf, as required by Article 28 of the UK GDPR. It applies together with the Terms of Use and Privacy Notice.
1. Roles
For pupil information added by the School’s teachers, the School is the controller and Kudolings is the processor. Kudolings is the controller for the account details of teachers, parents and school administrators.
2. Details of the processing
- Subject matter and purpose: providing the Kudolings classroom service — recognising positive behaviour, the register, class tools, parent access to their own child’s progress, reports and the school overview.
- Duration: while the School uses Kudolings, and until data is deleted or returned under section 8.
- Data subjects: pupils; and, for the school overview, the School’s teachers.
- Personal data: pupil first name and optional surname, pupil number and birthday (day and month); class; attendance; rewards, points and points taken away; teacher comments and report comments. No special category data is required, and teachers are asked not to add any.
3. Kudolings’ obligations
- Process the personal data only on the School’s documented instructions (these terms and the School’s use of the service settings), unless the law requires otherwise.
- Make sure everyone who can access the data is bound by confidentiality.
- Keep appropriate technical and organisational security measures, including encrypted connections, one-way password encryption and restricted administrative access.
- Help the School respond to requests from individuals exercising their rights, and with data protection impact assessments where reasonably needed.
- Tell the School without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the School’s data.
- Make available the information the School reasonably needs to show compliance, and allow for audits on reasonable notice.
4. Sub-processors
The School gives general authorisation for the sub-processors listed under Our Service Providers. Kudolings will give notice of any new sub-processor so the School can object, and will put equivalent data protection terms in place with each one.
5. International transfers
Personal data is transferred outside the UK only with appropriate safeguards (such as the International Data Transfer Addendum or an adequacy decision).
6. The School’s responsibilities
- Have a lawful basis for the processing and give pupils and parents the privacy information they need (for example in the School’s privacy notice).
- Decide which teachers may use Kudolings and what pupil information they add.
- Appoint the school administrator(s) who can see the school overview.
7. School overview
The School’s administrator can view, for teachers who have joined the school account: teachers’ names and classes; pupils’ names, their Kudoling’s level and points; positive behaviour records and teacher comments from the last 60 days; points taken away; and whether a parent is linked. Administrators can view but not change or delete records.
8. End of the agreement
When the School’s account ends, the administrator’s access ends. At the School’s choice, Kudolings will delete the School’s pupil data or return it in a common format, unless the law requires it to be kept. The administrator can download the school account’s data at any time on their profile page (Download my data: a ZIP of CSV spreadsheet files). Teachers keep their own accounts and classes, can download their classes’ full records the same way, and the arrangements in the Privacy Notice apply to them. Deleted data is removed from backups within 30 days. [Deletion timescale after the agreement ends to be confirmed.]