Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the provision of the seba | maths educational platform. The DPA remains in force for the duration of the service agreement between the parties.

The Processor processes personal data solely for the purpose of:

• •Providing access to the seba | maths curriculum platform
• •Maintaining the security and integrity of the platform
• •Providing technical support to the Controller
• •Generating anonymised usage analytics to improve the platform

seba | maths is a content-only platform. In its standard configuration, no student personal data is collected or processed. The only data processed is anonymised usage analytics. Where schools choose to implement additional features, the Controller is responsible for ensuring appropriate data protection measures are in place.

The Processor shall:

• •Process personal data only on documented instructions from the Controller
• •Ensure that persons authorised to process the data are bound by confidentiality
• •Implement appropriate technical and organisational security measures (Art. 32 GDPR)
• •Not engage sub-processors without prior written consent from the Controller
• •Assist the Controller in responding to data subject rights requests
• •Delete or return all personal data upon termination of the service
• •Make available all information necessary to demonstrate compliance with Art. 28 GDPR

The Processor currently uses the following sub-processors, all located within the EEA:

No personal data is transferred outside the European Economic Area. All processing takes place on EEA-based infrastructure. The Processor will not transfer data to third countries without prior written consent from the Controller and appropriate safeguards as required by Chapter V GDPR.

The Processor implements the following technical and organisational measures:

• •TLS 1.2+ encryption for all data in transit
• •Access controls and least-privilege principles
• •Regular security assessments and penetration testing
• •Incident response procedures with 72-hour breach notification
• •Data minimisation and pseudonymisation where applicable

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach. The notification shall include all information required under Art. 33(3) GDPR to the extent available at the time.

This DPA is governed by Spanish law, with particular reference to the Ley Orgánica 3/2018 (LOPDGDD) and the GDPR. Any disputes shall be subject to the jurisdiction of the courts of Barcelona, Catalonia.

For DPA enquiries, please contact our Data Protection Officer at [email protected].