Data processing addendum

Roles and instructions

The school or trust is the controller (or equivalent decision-maker) for school-site and app data. Aqualeo acts as processor and processes that data only to provide the contracted service and on documented instructions from the school.

The parties should complete the service description, data categories, data-subject categories, processing duration, and approved instructions in Schedule 1: [complete schedule].

Security and confidentiality

Aqualeo will maintain appropriate technical and organisational measures, require confidentiality from authorised personnel, support the school’s security assessments where reasonable, and notify the school of a confirmed personal-data breach without undue delay.

Subprocessors and international transfers

The approved subprocessor register is published in the subprocessors policy. The parties must complete the transfer mechanism and supplementary measures for each relevant route, including [UK IDTA / UK addendum / EU SCCs / UAE and India transfer terms].

Assistance and end of service

Aqualeo will provide reasonable assistance with data-subject requests, security incidents, impact assessments, and regulator enquiries, taking into account the nature of the processing. At the end of the service, the school may request return or deletion of school data, subject to [retention period and legal exceptions].

Schedules to complete before signature

Complete the parties’ legal names and addresses, processing details, security measures, subprocessors, transfer mechanisms, audit terms, liability allocation, retention and deletion timetable, and authorised signatories: [insert schedules and signature blocks].