Data Processing Agreement

CodeChest Ltd, company number 16912070, of 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom is the Processor. The legal person or self-employed education provider represented by the Academy Owner is the Customer and Controller.

Academy Personal Data means personal data entered, generated or stored in EduPortal for the Customer's Academy and processed by CodeChest on the Customer's behalf. Data Protection Law means the UK GDPR, Data Protection Act 2018 and other data-protection law applicable to the processing.

If this DPA conflicts with the Terms about processing Academy Personal Data, this DPA prevails. Mandatory Data Protection Law prevails over both.

The subject matter is hosting and operating the Academy-management, teaching and learning functions requested by the Customer. Processing continues while the Academy uses EduPortal and for the deletion and retention periods in the Terms and Privacy Notice.

CodeChest may collect, record, organise, store, retrieve, display, transmit, restrict, delete and otherwise process Academy Personal Data only to provide, secure, maintain and support EduPortal, comply with this DPA and the Terms, and follow lawful documented instructions from the Customer.

The Terms, the Customer's authorised use of EduPortal and written support requests are documented instructions. CodeChest will tell the Customer if it believes an instruction infringes Data Protection Law, unless law prohibits that notice. If law requires processing outside the Customer's instructions, CodeChest will notify the Customer before processing unless prohibited.

Data subjects may include Academy owners, administrators, managers, instructors, mentors, students, invited users, parents or guardians whose details are entered, and people appearing in Academy content or support communications.

Processing may cover the following categories, according to the features the Customer uses:

The Customer determines the purposes and lawful bases for Academy Personal Data and is responsible for the legality, fairness and accuracy of its instructions. The Customer must provide required privacy information, obtain any legally required permissions, use proportionate data, configure roles carefully, and set and follow appropriate retention periods.

The Customer must not instruct CodeChest to process data unlawfully and must promptly tell CodeChest about an inaccurate instruction, unauthorised use, rights request or security concern relevant to the service.

CodeChest will ensure that people authorised to process Academy Personal Data are bound by confidentiality and receive access only as needed for their duties.

CodeChest will maintain appropriate technical and organisational measures proportionate to the risk, including access controls, authentication, encryption in transit, protected storage, role-based permissions, logging, vulnerability and patch management, backup or resilience measures appropriate to the service, and processes for securely deleting data. Security measures may evolve provided the overall level of protection is not materially reduced.

The Customer gives general written authorisation for CodeChest to appoint sub-processors needed to provide EduPortal. Current providers and their functions are listed in the Privacy Notice, including hosting, storage, email and optional connected services.

CodeChest will impose data-protection obligations on sub-processors that provide protection equivalent in substance to this DPA and remains responsible for their performance as required by law. CodeChest will give reasonable advance notice of a material new or replacement sub-processor. The Customer may object on reasonable data-protection grounds; the parties will work in good faith on a practical solution, which may include disabling the affected feature or ending it if no reasonable solution exists.

CodeChest will not transfer Academy Personal Data outside the United Kingdom or European Economic Area without a lawful transfer mechanism and any required supplementary safeguards. Applicable mechanisms may include adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another mechanism recognised by Data Protection Law. Processing locations and transfer information are described in the Privacy Notice.

Taking account of the nature of processing, CodeChest will provide reasonable technical and organisational assistance for the Customer to respond to data-subject requests. If CodeChest receives a request concerning Academy Personal Data, it will normally direct the requester to the Customer and will not respond on the Customer's behalf unless instructed or legally required.

Taking account of available information and the nature of processing, CodeChest will reasonably assist the Customer with security obligations, breach assessment and notification, data-protection impact assessments and prior consultation with a regulator. CodeChest may charge reasonable costs for exceptional assistance beyond normal service operation where permitted and agreed in advance.

CodeChest will notify the Customer without undue delay after becoming aware of a personal data breach affecting Academy Personal Data. The notice will include available information about the nature of the breach, likely consequences, affected data and people, mitigation and a contact point, and may be provided in phases as facts become available.

Notification is not an admission of fault. The Customer remains responsible for deciding whether and when it must notify people or regulators, with CodeChest's reasonable assistance.

During the service, the Customer may retrieve data through available EduPortal features or request reasonable export assistance. When the relevant services end, CodeChest will delete or return Academy Personal Data according to the Customer's lawful choice and the deletion periods in the Terms and Privacy Notice, unless law requires storage.

Where the Customer does not communicate a different lawful choice before Academy deletion, the deletion process in the Terms is the Customer's instruction. Data retained because of law will be isolated and used only for that legal purpose.

CodeChest will make available information reasonably necessary to demonstrate compliance with Article 28 obligations. The Customer may request an audit no more than once each year, and additionally after a material breach or regulator request, first using current independent reports and written information where sufficient.

Any further audit must be on reasonable notice, during business hours, conducted by an independent qualified auditor bound by confidentiality, avoid disruption and exposure of other customers' data, and be paid for by the Customer unless it identifies a material breach by CodeChest. CodeChest will cooperate with a competent supervisory authority as required by law.

This DPA remains effective while CodeChest processes Academy Personal Data. CodeChest may update it where needed for law, security or service changes and will give reasonable notice of material changes. A change will not reduce mandatory rights or retrospectively legitimise unlawful processing.

Notices and data-protection questions may be sent to [email protected]. This DPA is governed by the law and dispute provisions in the Terms. The English version is the primary contractual version; translations are provided for accessibility.