This is a working template Data Processing Agreement, prepared to describe how Spark2 Education acts as a processor for the Future Skills Passport. It must be reviewed by a data protection professional, and the bracketed details completed, before it is issued to or signed by any school.
When a school uses the Future Skills Passport, the school is the data controller and Spark2 Education is the data processor. This Agreement is the written contract that UK data protection law (Article 28 UK GDPR) requires between them. It sets out what Spark2 may do with pupil and staff data, the security it must keep, the sub-processors it uses, what happens if something goes wrong, and what happens to the data at the end.
This Data Processing Agreement (the “Agreement”) is made between Spark2 Education (the “Processor”) and the school identified in the signature panel (the “School” or “Controller”).
It governs the processing of personal data carried out by Spark2 Education when the School’s pupils and staff use the Future Skills Passport online learning programme (the “Service”). It takes effect on the date of the last signature below and continues for as long as Spark2 Education processes personal data on the School’s behalf. It sits alongside, and forms part of, the main agreement under which the School uses the Service.
The terms controller, processor, personal data, data subject, processing, personal data breach and supervisory authority have the meanings given to them in UK Data Protection Law.
UK Data Protection Law means the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with any guidance issued by the Information Commissioner’s Office (ICO). Sub-processor means any third party engaged by Spark2 Education to carry out processing activities under this Agreement.
The School is the controller of the pupil and staff personal data processed through the Service: the School decides that its pupils will use the Future Skills Passport, and for what educational purpose.
Spark2 Education is the processor: it processes that personal data only to provide the Service, and only on the School’s instructions. Spark2 Education is not a joint controller of pupil data under this Agreement and does not determine its own purposes for that data.
Spark2 Education will process personal data only on the School’s documented instructions — including as set out in this Agreement and in Schedule 1 — unless required to do otherwise by law. Where the law requires other processing, Spark2 Education will inform the School first, unless the law prohibits this.
The School instructs Spark2 Education to process personal data as necessary to: give pupils and teachers access to the Service; save each pupil’s lesson progress and scores; provide the teacher dashboard and class progress reports; and keep the Service secure and operational. Spark2 Education will inform the School if, in its opinion, an instruction infringes UK Data Protection Law.
Spark2 Education ensures that every person it authorises to process the personal data is bound by an appropriate duty of confidentiality, and is given access only to the personal data needed to perform their role.
Spark2 Education implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account that the personal data relates to children. The measures in place at the date of this Agreement are set out in Schedule 2. Spark2 Education may update these measures provided the level of protection is not reduced.
The School gives Spark2 Education general written authorisation to engage sub-processors to help provide the Service. The sub-processors engaged at the date of this Agreement are listed in Schedule 3.
Spark2 Education will impose on each sub-processor, by written contract, data protection obligations that are no less protective than those in this Agreement, and remains fully liable to the School for each sub-processor’s performance. Spark2 Education will give the School advance notice of any intended addition or replacement of a sub-processor, and the School may object on reasonable data protection grounds.
Taking into account the nature of the processing, Spark2 Education will assist the School by appropriate technical and organisational measures, so far as possible, in responding to requests from data subjects exercising their rights — including access, rectification, erasure, restriction, portability and objection.
Where a pupil, parent or carer contacts Spark2 Education directly with such a request, Spark2 Education will refer them to the School, as controller, and support the School in responding.
Spark2 Education will assist the School in ensuring compliance with its obligations relating to the security of processing, the notification of personal data breaches, data protection impact assessments, and prior consultation with the ICO — taking into account the nature of the processing and the information available to Spark2 Education.
Spark2 Education will notify the School without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the School’s personal data. The notification will describe, so far as known: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed to address it.
Spark2 Education will not notify the ICO or any data subject on the School’s behalf unless the School instructs it to do so.
Spark2 Education stores and processes the personal data within the United Kingdom and/or the European Union. Spark2 Education will not transfer personal data to a country outside the UK or the EU without the School’s prior written authorisation and, where required, an appropriate transfer mechanism (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
On termination of the Service, or earlier on the School’s written instruction, Spark2 Education will — at the School’s choice — delete or return all personal data processed under this Agreement, and delete existing copies, unless UK law requires the data to be retained.
Pupil records are tied to the class they belong to: deleting a class deletes the pupil records within it. At the end of a school year a class is archived and then deleted unless the School renews. A teacher may delete a class, and the pupil records within it, at any time.
Spark2 Education will make available to the School all information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, conducted by the School or an auditor it mandates. Audits will take place on reasonable written notice, during normal business hours, and no more than once per year, unless a personal data breach or a regulator’s requirement makes a further audit necessary.
This Agreement takes effect on signature and remains in force for as long as Spark2 Education processes personal data on the School’s behalf. It terminates automatically when the main agreement for the Service ends. The clauses that by their nature should continue — including confidentiality, and the return and deletion of data — survive termination.
This Agreement is governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
| Item | Detail |
|---|---|
| Subject matter | Provision of the Future Skills Passport online learning programme to the School’s pupils and teaching staff. |
| Duration | For the term of the School’s use of the Service, plus any short retention period set out in Clause 12. |
| Nature and purpose | Hosting a web-based life-skills learning programme; authenticating teachers and pupils; saving each pupil’s lesson progress and end-of-strand scores; providing a teacher dashboard and a class progress / evidence report. |
| Types of personal data — pupils | A display name (a first name or a nickname); a single age number; a chosen avatar; lesson progress and end-of-strand “Boss Battle” scores. No surnames, dates of birth, addresses, contact details, photographs of children, or special category data are collected. |
| Types of personal data — teachers | An email address (used to send a one-time sign-in link); the names of classes the teacher creates. |
| Categories of data subject | Primary-school pupils (typically Key Stage 2 / Year 6); teaching staff who create and supervise classes. |
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Cloud hosting, database and authentication for the Service. | UK / EU region |
| [Email delivery provider — to be confirmed] | Delivery of one-time teacher sign-in emails. | UK / EU |
The current named list of sub-processors is provided to the School on request and is kept up to date in line with Clause 7. Add or remove rows above to reflect the providers actually in use before this Agreement is issued.
By signing below, each party agrees to be bound by this Data Processing Agreement.
Any question about this Agreement or about how data is handled: hi@spark2.org.