Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between [to be confirmed] (company number [to be confirmed], registered at [to be confirmed]) (“CentreHQ”, the processor) and the subscribing tuition centre (the controller). It applies to all personal data the centre puts into the platform.

1. Roles

The centre is the data controller for the personal data of its families, children and staff. CentreHQ is the data processor and processes that data only on the centre’s documented instructions — using the platform as designed constitutes those instructions.

2. Scope and duration of processing

• Subject matter: operation of the centre’s tuition business — enquiries, study plans and homework, sessions and attendance, safeguarding records, billing and contracts, staff management, material stock and communications.
• Categories of data subjects: parents and guardians, children, enquirers and centre staff.
• Categories of data: contact details, dates of birth, academic progress, attendance, safeguarding consents and collector details, financial records (invoices and payments), signed contracts, staff employment records.
• Duration: for the life of the centre’s subscription, plus the export and deletion window in section 7.

3. Processor obligations

CentreHQ will:

• process personal data only on the centre’s instructions, unless required by law;
• ensure everyone authorised to process the data is bound by confidentiality;
• implement the technical and organisational measures in section 5;
• assist the centre with data subject requests, including the built-in GDPR data export;
• assist the centre with its security, breach-notification and impact-assessment obligations;
• delete or return the data at the end of the agreement (section 7);
• make available the information needed to demonstrate compliance, and allow reasonable audits.

4. Sub-processors

The centre gives general authorisation for the sub-processors listed below. CentreHQ will give notice before adding or replacing a sub-processor, giving the centre the chance to object, and remains responsible for its sub-processors’ performance.

5. Security measures

• Mandatory two-factor authentication for all staff-level accounts, with passkey support
• Login lockout after repeated failed attempts
• Passwords stored hashed; integration credentials encrypted at rest with AES-256
• Role-based access control — every query is scoped to the centre’s own tenancy
• Full audit log of significant actions
• Data hosted in the UK; encrypted in transit (HTTPS)
• Child accounts authenticate by centre code and PIN — no child email addresses or passwords

6. Personal data breach notification

CentreHQ will notify the centre without undue delay after becoming aware of a personal data breach affecting the centre’s data, and will provide the information the centre needs to meet its own notification obligations to the ICO and to data subjects.

7. Deletion and return on termination

On termination of the subscription, the centre may export all of its data from the platform. After the export window agreed at termination, CentreHQ will delete the centre’s personal data from live systems, and from backups as they expire in the normal cycle, except where retention is required by law (for example, billing records for CentreHQ’s own accounts).

8. International transfers

Personal data is hosted in the UK. Standard Contractual Clauses are not currently required. If a future sub-processor involves a restricted transfer, CentreHQ will put an appropriate safeguard in place (UK IDTA or Addendum) before the transfer happens and update this DPA.

9. Contact

Questions about this DPA: [to be confirmed].