Data Processing Agreement

Scope and application

This Data Processing Agreement ("DPA") forms part of the agreement governing the Customer's use of OarClass, including the OarClass Terms of Service, an order form, subscription agreement, proposal or other written agreement that incorporates this DPA (collectively, the "Agreement").

This DPA applies where OarClass processes Personal Data on behalf of the Customer in connection with the OarClass Services.

It is intended to establish the contractual protections required where the Customer acts as a Controller and OarClass acts as its Processor, or where the Customer acts as a Processor and OarClass acts as its Sub-processor.

This DPA does not apply to Personal Data for which OarClass independently determines the purposes and means of processing. Such processing is governed by the OarClass Privacy Policy .

Definitions

For purposes of this DPA:

• "Applicable Data Protection Law" means data protection, privacy and security laws that apply to the relevant processing under the Agreement.
• "Controller" means the party that determines the purposes and means of processing Personal Data, or the equivalent term under Applicable Data Protection Law.
• "Customer" means the school, academy, education organisation or other entity that has entered into the Agreement with OarClass.
• "Customer Data" means data submitted to, transmitted through or otherwise processed through the Services on behalf of the Customer.
• "Data Subject" means an identified or identifiable person to whom Personal Data relates.
• "Personal Data" means information defined as personal data, personal information or an equivalent term under Applicable Data Protection Law.
• "Processing" includes any operation performed on Personal Data, including collection, storage, use, transmission, modification, retrieval, disclosure or deletion.
• "Processor" means a party that processes Personal Data on behalf of a Controller.
• "Security Incident" means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Personal Data processed under this DPA.
• "Sub-processor" means a third party engaged by OarClass to process Personal Data on behalf of the Customer.

Terms such as controller, processor, personal data and processing will be interpreted consistently with Applicable Data Protection Law where that law provides a specific definition.

Roles of the parties

For Personal Data processed by OarClass on behalf of the Customer:

• The Customer acts as Controller, or as a Processor acting on behalf of another Controller, as applicable.
• OarClass acts as Processor, or as Sub-processor where the Customer itself acts as Processor.

Each party is responsible for complying with the obligations that Applicable Data Protection Law imposes on it in its respective role.

Nothing in this DPA changes the Customer's responsibility for determining the lawfulness, purpose and appropriateness of the Personal Data it directs OarClass to process.

Processing on documented instructions

OarClass will process Personal Data only on the Customer's documented instructions, unless processing is required by applicable law.

The Agreement, this DPA, the Customer's configuration and use of the Services, support requests and other written instructions provided by authorised Customer personnel constitute documented instructions.

The Customer instructs OarClass to process Personal Data as reasonably necessary to:

• Provide the Services.
• Host and maintain Customer Data.
• Authenticate authorised users.
• Deliver school management and learning functionality selected by the Customer.
• Provide technical support.
• Maintain platform security, reliability and integrity.
• Perform other processing expressly requested through the Customer's authorised use of OarClass.

If OarClass believes an instruction infringes Applicable Data Protection Law, OarClass may inform the Customer and may suspend the affected processing until the parties resolve the issue, to the extent permitted by law.

If OarClass is legally required to process Personal Data contrary to the Customer's instructions, OarClass will inform the Customer before the processing unless applicable law prohibits such notice.

Confidentiality

OarClass will ensure that persons authorised to process Personal Data on its behalf are subject to appropriate confidentiality obligations or another binding duty of confidentiality.

Access to Customer Personal Data will be limited to personnel who require access for legitimate operational, technical, support, security or compliance purposes.

OarClass personnel must not use Customer Personal Data for purposes unrelated to the Services or their authorised responsibilities.

Security of processing

Taking into account the nature, scope, context and purposes of processing and the risks presented to Data Subjects, OarClass will maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The measures OarClass may use include the controls described in Annex 2 of this DPA.

Security controls may evolve as technology, risks, infrastructure and the OarClass platform develop, provided that OarClass does not materially reduce the overall level of protection for Personal Data during the applicable service period.

The Customer acknowledges that no online system can guarantee absolute security and that security also depends on the Customer's own account management, devices, permissions and user practices.

Sub-processors

The Customer gives OarClass general written authorisation to engage Sub-processors where reasonably necessary to provide, secure, maintain or support the Services.

OarClass will require Sub-processors that process Customer Personal Data to enter into written obligations providing data protection safeguards appropriate to the processing and materially consistent with OarClass's obligations under this DPA.

OarClass remains responsible for the performance of its Sub-processors to the extent required by Applicable Data Protection Law.

Changes to Sub-processors

OarClass may add or replace a Sub-processor. Where Applicable Data Protection Law requires the Customer to have an opportunity to object, OarClass will provide reasonable advance notice of a material new Sub-processor where practicable.

The Customer may raise a reasonable objection based on legitimate data protection concerns.

The parties will work in good faith to address the objection. If no reasonable alternative is available, the parties may agree to discontinue the affected functionality or other appropriate remedy.

Data Subject requests

Taking into account the nature of OarClass's processing, OarClass will provide reasonable assistance to the Customer in responding to requests from Data Subjects to exercise rights available under Applicable Data Protection Law.

Such rights may include access, correction, deletion, restriction, objection, portability or withdrawal of consent where applicable.

If OarClass receives a request relating primarily to Personal Data controlled by the Customer, OarClass may direct the Data Subject to the Customer or notify the Customer, unless OarClass is legally required to handle the request differently.

OarClass will not independently respond to a request relating to Customer-controlled Personal Data except on Customer instructions or where required by law.

Personal Data breaches and security incidents

OarClass will notify the Customer without undue delay after becoming aware of a Security Incident affecting Personal Data processed by OarClass on behalf of the Customer.

To the extent information is reasonably available, the notification may include:

• The nature of the Security Incident.
• The categories of affected data where known.
• The categories of affected Data Subjects where known.
• The likely consequences where reasonably identifiable.
• Measures taken or proposed to contain, investigate or mitigate the incident.
• Information reasonably required by the Customer to meet applicable notification obligations.

OarClass may provide information in phases where all relevant facts are not immediately available.

Notification of a Security Incident does not constitute an admission of fault or liability by OarClass.

The Customer remains responsible for determining whether notification to a regulator, Data Subject or other party is required, except where Applicable Data Protection Law assigns that obligation directly to OarClass.

Compliance assistance

Taking into account the nature of the processing and information available to OarClass, OarClass will provide reasonable assistance to the Customer with obligations that apply to the Customer's use of the Services.

This may include reasonable assistance relating to:

• Security of processing.
• Security Incident assessment and notification.
• Data protection impact assessments.
• Prior consultation with a supervisory authority where applicable.
• Responses to Data Subject rights requests.
• Information reasonably necessary to demonstrate compliance with applicable processor obligations.

The Customer remains responsible for its own legal assessment, DPIAs, regulatory filings and decisions concerning its processing activities.

International transfers

OarClass or its authorised Sub-processors may process Personal Data in countries other than the country in which the Customer or Data Subject is located.

Where Applicable Data Protection Law restricts an international transfer, the parties will rely on an appropriate lawful transfer mechanism where required.

Depending on the applicable jurisdiction, such mechanisms may include:

• An applicable adequacy decision or equivalent recognised mechanism.
• Approved standard contractual clauses.
• A recognised UK international data transfer mechanism.
• Another valid transfer safeguard permitted by Applicable Data Protection Law.

Where required, OarClass will provide information reasonably necessary for the Customer to assess the applicable transfer mechanism and relevant safeguards.

Government and legal requests

If OarClass receives a legally binding request from a government authority, court, regulator or law-enforcement body seeking Customer Personal Data, OarClass will evaluate the request and respond only as required by applicable law.

Unless legally prohibited, OarClass will seek to notify the Customer where the request relates to Customer Personal Data and where such notice is appropriate.

Where reasonably possible and lawful, OarClass may challenge or seek to narrow a request that appears unlawful, excessive or inconsistent with applicable legal requirements.

Information, audits and inspections

OarClass will make available information reasonably necessary to demonstrate compliance with its processor obligations under this DPA and Applicable Data Protection Law.

Where reasonably sufficient, the parties will first seek to satisfy audit requirements through security documentation, policies, responses to questionnaires or other available compliance information.

If additional verification is reasonably required, the Customer may conduct or appoint an independent auditor to conduct an audit of controls relevant to processing under this DPA, subject to:

• Reasonable advance written notice.
• Appropriate confidentiality obligations.
• Reasonable scope and duration.
• Avoidance of unnecessary disruption to OarClass or other customers.
• Protection of information relating to other customers, systems and security controls.

Unless a Security Incident, regulator request or demonstrated material non-compliance reasonably requires additional review, the Customer should not conduct more than one such audit in a twelve-month period.

The Customer will bear its own audit costs and any extraordinary OarClass costs reasonably incurred in supporting a Customer-specific audit, unless material non-compliance by OarClass is identified or applicable law requires otherwise.

Return and deletion of Personal Data

Upon termination or expiry of the Services involving processing of Customer Personal Data, and subject to the Customer's instructions, OarClass will return or delete Customer Personal Data where required by the Agreement and Applicable Data Protection Law.

OarClass may retain Personal Data where and for as long as applicable law requires retention.

Data retained solely because of a legal obligation will remain subject to appropriate confidentiality and security protections and will not be used for unrelated purposes.

Residual copies in backup systems may remain until they are deleted or overwritten through ordinary backup retention cycles, provided they remain protected and are not restored for ordinary business use except where reasonably necessary for recovery.

Information concerning user deletion requests is also available at: oarclass.com/legal/data-deletion/ .

Customer obligations

The Customer is responsible for ensuring that its instructions and use of the Services comply with Applicable Data Protection Law.

The Customer represents that it has, where required:

• A lawful basis for processing the Personal Data submitted to OarClass.
• Provided appropriate privacy notices.
• Obtained required consents or authorisations.
• Authority to provide Personal Data to OarClass.
• Implemented appropriate account, device and internal access controls.
• Configured user permissions appropriately.

For Personal Data relating to students or children, the Customer is responsible for satisfying applicable educational, safeguarding, parental consent and children's privacy requirements relevant to the Customer's processing.

The Customer will not instruct OarClass to process Personal Data in a manner that violates Applicable Data Protection Law.

Liability, order of precedence and conflict

The liability provisions in the Agreement apply to this DPA unless Applicable Data Protection Law requires otherwise.

If there is a conflict between this DPA and another provision of the Agreement concerning processing of Personal Data, this DPA will control to the extent of that conflict.

If an applicable international transfer mechanism contains mandatory provisions that conflict with this DPA, the mandatory transfer terms control to the extent required for the relevant transfer.

Nothing in this DPA limits the rights of Data Subjects or regulatory authorities where such rights cannot lawfully be limited by contract.

Duration and termination

This DPA becomes effective when it is incorporated into or executed with the applicable Agreement.

It remains in effect for as long as OarClass processes Personal Data on behalf of the Customer under that Agreement.

Obligations relating to confidentiality, security, return or deletion, audits, liability and other provisions that by their nature apply after termination will survive for as long as OarClass retains relevant Personal Data.

Details of the processing

This Annex describes the processing that may occur when a Customer uses OarClass.

Technical and organisational measures

OarClass maintains measures designed to provide a level of security appropriate to the risks associated with the processing.

Access and authentication

• Authentication controls for platform access.
• Role-based access and permissions.
• Separation of institutional or tenant access where applicable.
• Restriction of administrative access to authorised personnel.

Network and application security

• Security controls designed to protect production systems from unauthorised access.
• Encrypted transmission using appropriate transport security where supported by the relevant Service.
• Application and infrastructure updates and maintenance.
• Monitoring and investigation of relevant security events.

Data protection

• Logical access restrictions.
• Data minimisation practices where reasonably applicable.
• Backup and recovery procedures appropriate to relevant systems.
• Processes for deleting or restricting Personal Data where applicable.

Personnel and operations

• Confidentiality obligations for authorised personnel.
• Access limited according to legitimate business need.
• Processes for managing access when personnel responsibilities change.
• Security incident handling and escalation procedures.

Service providers

• Appropriate contractual data protection requirements for relevant Sub-processors.
• Evaluation of service providers appropriate to the nature and risk of the processing.

This Annex describes the categories of security measures and does not represent that OarClass holds a particular third-party security certification unless OarClass expressly states otherwise in writing.

Sub-processor framework

OarClass may use third-party service providers where reasonably necessary to operate the Services.

Categories of Sub-processors may include:

OarClass will maintain information concerning material Sub-processors used for Customer Personal Data and will make such information available to institutional Customers on reasonable request.

As the OarClass infrastructure matures, OarClass may publish a dedicated Sub-processor list and update process.

Contact and DPA requests

Customers may contact OarClass about this DPA, data protection terms, Sub-processors, Data Subject requests or security and privacy matters using the details below.