Data Processing Agreement

Version 1.2 — October 2026

1. Parties

This DPA is incorporated into and forms part of the Terms of Service between the parties. It is effective from the date the School first accesses the SchoolBoard service.

2. Definitions

In this DPA, the following terms have the meanings given:

• "UK GDPR" means the UK General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.
• "Personal Data" has the meaning given in the UK GDPR.
• "Processing" and "process" have the meanings given in the UK GDPR.
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed under this DPA — in the context of SchoolBoard, this may include school administrators and (where the School chooses to include student names) pupils.
• "Services" means the SchoolBoard platform provided by Eduraa Ltd under the Terms of Service.
• "Sub-processor" means any third party engaged by Eduraa to process Personal Data in connection with the Services.

3. Roles of the parties

The School is the data controller in respect of any Personal Data processed through SchoolBoard. Eduraa is the data processor, processing Personal Data only on behalf of, and under the documented instructions of, the School.

Each party shall comply with its obligations under the UK GDPR in respect of any Personal Data processed under this DPA.

4. Nature and purpose of processing

Eduraa processes Personal Data for the purpose of providing the SchoolBoard service: displaying animated house points leaderboards on behalf of the School.

Categories of data subjects

• School administrators (always)
• Pupils (only if the School includes student names in its Google Sheet data)

Categories of personal data

• Administrator email address and display name
• Pupil names (only if included by the School — processed transiently, never stored)

Special category data

Eduraa does not process any special category personal data (as defined in Article 9 of the UK GDPR) under this DPA. The School must not include special category data in any Google Sheet connected to SchoolBoard.

5. Eduraa's obligations as processor

Eduraa shall:

• Process Personal Data only on the documented instructions of the School (as set out in this DPA and the Terms of Service), unless required to do so by UK law, in which case Eduraa shall inform the School before processing unless prohibited by law
• Ensure that persons authorised to process the Personal Data have committed to appropriate obligations of confidentiality
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in clause 6 below
• Not engage any Sub-processor without prior general or specific authorisation from the School, and remain liable for Sub-processor performance as described in clause 8
• Taking into account the nature of processing, assist the School by appropriate technical and organisational measures in fulfilling its obligations to respond to Data Subject rights requests under the UK GDPR
• Assist the School in ensuring compliance with its obligations under Articles 32–36 of the UK GDPR (security, breach notification, data protection impact assessments, and prior consultation) taking into account the nature of processing and information available to Eduraa
• At the School's choice, delete or return all Personal Data to the School after the end of the provision of Services relating to processing, and delete existing copies unless required to retain them by applicable law
• Make available to the School all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits and inspections conducted by the School or an auditor mandated by the School (reasonable notice required; audit costs to be agreed)
• Immediately inform the School if, in Eduraa's opinion, an instruction from the School infringes the UK GDPR or other applicable data protection law

6. Security measures

Eduraa implements and maintains the following technical and organisational measures to protect Personal Data:

Technical measures

• All data in transit encrypted using HTTPS/TLS
• All data at rest encrypted by Google Firebase (AES-256)
• Google Sheets access via read-only service account — Eduraa cannot modify school data
• Firebase Authentication with Google OAuth 2.0 — passwords never seen or stored by Eduraa
• Firestore security rules enforce per-school data isolation
• Only the mapped house, points and date columns are read from the School's sheet; they are held in server memory for at most 60 seconds and never written to any database, log, or file
• Firebase infrastructure hosted in europe-west2 (London) region

Organisational measures

• Access to production systems restricted to authorised personnel only
• Eduraa Ltd is registered with the Information Commissioner's Office (ICO registration number: ZC165595)
• Data protection considerations reviewed as part of product development

7. Personal data breaches

In the event of becoming aware of a Personal Data breach affecting Personal Data processed under this DPA, Eduraa shall:

• Notify the School without undue delay and, where feasible, within 72 hours of becoming aware of the breach
• Provide the School with sufficient information to enable it to fulfil its own breach notification obligations to the ICO and affected Data Subjects under the UK GDPR
• Cooperate with the School and take such reasonable steps as directed by the School to assist in the investigation, mitigation, and remediation of each such Personal Data breach

Breach notifications shall be sent to the email address associated with the School's SchoolBoard account, or to an alternative address notified in writing by the School.

8. Sub-processors

The School provides general authorisation for Eduraa to engage the following Sub-processors, which are integral to the provision of the Services:

Eduraa will notify the School of any intended changes to Sub-processors (additions or replacements) by updating this page and by email to active subscribers, giving the School a reasonable opportunity to object before the change takes effect. Eduraa remains fully liable to the School for the performance of Sub-processors' obligations to the extent that Eduraa is itself required to perform those obligations under this DPA.

9. International transfers

Eduraa stores Personal Data (administrator accounts and dashboard configuration) within the UK / European Economic Area (EEA). One Sub-processor, Resend, processes contact-form notification emails in the USA; this transfer is safeguarded by Standard Contractual Clauses (together with the UK International Data Transfer Addendum). Where any other Sub-processor transfers Personal Data outside the UK or EEA, Eduraa ensures appropriate safeguards are in place in accordance with the UK GDPR (such as the UK International Data Transfer Agreement/Addendum or an equivalent adequacy mechanism).

10. Data retention and deletion

Upon termination or expiry of the Terms of Service, Eduraa will, at the School's written request, either delete or return all Personal Data processed under this DPA within 30 days, except where retention is required by applicable law. Configuration data is automatically deleted 90 days after account closure if no deletion request is received.

House points data is not subject to a deletion request as it is never written to persistent storage.

11. The School's obligations as controller

The School warrants and represents that:

• It has a lawful basis under the UK GDPR for any Personal Data it causes to flow through SchoolBoard
• Where student names are included in connected Google Sheet data, it has satisfied any applicable requirements under UK GDPR (including, where relevant, informing pupils and parents that their names may appear on a school display system operated by a third-party service)
• It will not include special category personal data in any data connected to SchoolBoard
• It will promptly inform Eduraa of any changes to its instructions that would affect Eduraa's processing obligations

12. Term and termination

This DPA remains in force for the duration of the Terms of Service and terminates automatically upon termination or expiry of the Terms of Service. Clauses that by their nature should survive termination (including clauses 6, 7, and 10) shall do so.

13. Governing law

This DPA is governed by the laws of England and Wales. Any disputes arising under this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Contact and signed copies

For data protection queries, to request a countersigned copy of this DPA, or to exercise Data Subject rights, contact:

Eduraa Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Email: privacy@eduraa.co.uk

← Back to SchoolBoard Privacy Policy Terms of Service