data-processing-terms - Evidence for Learning

Data Processing Agreement

Background

(A) This a data processing agreement entered into between TeacherCloud and the Client (both as defined below) and is entered into as required by the Data Protection Legislation (as defined below).

(B) In consideration of the Client and TeacherCloud entering into the Contract (as defined below) the parties agree to assume the obligations set out in this data processing agreement.

(D) This agreement is supplemental to any Contract (as defined below) and introduces further contractual provisions to ensure the protection and security of the Client Data passed from the Client to TeacherCloud for processing.

Agreed terms

1. Interpretation

1.1 The following definitions and rules of interpretation apply in this agreement.

Affiliate: in relation to the Client, any school, college or other learning organisation or entity that is directly or indirectly controlled by the Client or is in some other way connected to the Client.

Business Day: a day other than a Saturday, Sunday or public holiday in England when banks in London are open for business.

Business Purpose: the purpose or purposes as detailed in clause 2.3.

Charges: the charges payable by the Client to TeacherCloud for the supply of the Services as set out in the Contract.

Claim: has the meaning given in clause 6.3.

Client: means the party that enters into a Contract with TeacherCloud and who enters into this data processing agreement at, or around, the same time.

Client Data: means the data or information, in whatever form, described in clause 2.3 as supplied by the Client (or its Permitted Affiliates) to TeacherCloud (and in relation to which TeacherCloud is providing the Services) which falls within the meaning of “data” defined by Data Protection Legislation and relates only to “personal data”, or any part of such personal data, of which the Client (or its Permitted Affiliate) is a “data controller” (each having the meaning set out in Data Protection Legislation).

Client System: any information technology system or systems owned or operated by the Client (or its Permitted Affiliates) from which Data is received in accordance with this agreement.

Contract: any separate agreement entered into between the parties in respect of the provision of the Services (as defined below) by TeacherCloud.

Confidential Information: all confidential information (however recorded or preserved) disclosed by a party or its employees, officers, representatives, advisers or subcontractors involved in the provision or receipt of the Services who need to know the confidential information in question (Representatives) to the other party and that party’s Representatives in connection with this agreement, which is either labelled as such or else which should reasonably be considered as confidential because of its nature and the manner of its disclosure.

Commencement Date: the date of this agreement.

Data Protection Legislation: all applicable data protection and privacy legislation in force from time to time in the UK including without limitation the UK GDPR, the DPA 2018 (and regulations made thereunder) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003) as amended by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (SI 2011/1208).

DPA 2018: Data Protection Act 2018.

Permitted Affiliate: an Affiliate of the Client identified in the Contract or otherwise approved in writing by the Client and TeacherCloud as a recipient of the Services and for whose acts and omissions the Client shall be responsible.

Processed Data: any Client Data that has been processed.

Services: the services to be supplied by TeacherCloud under the Contract, namely access to the Evidence for Learning software (and associated software and services) for Clients and its Permitted Affiliates, based on a subscription service provided by TeacherCloud.

TeacherCloud: means TheTeacherCloud Ltd, a company registered in England and Wales under company number 06686436 whose registered office is at Orchard House, 34 Sagars Road, Handforth, Wilmslow, Cheshire, SK9 3EE.

TeacherCloud System: any information technology system or systems owned or operated by TeacherCloud to which Data is delivered or on which the Services are performed in accordance with this agreement.

Term: has the meaning given to it in clause 8.1.

UK GDPR: has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.

1.2 “Data subject”, “personal data”, “processing”, “process” and “appropriate technical and organisational measures” shall bear the meanings given to those terms respectively in Data Protection Legislation.

1.3 Clause headings shall not affect the interpretation of this agreement.

1.4 A person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).

1.5 A reference to a company shall include any company, corporation or other body corporate, wherever and however incorporated or established.

1.6 Unless the context otherwise requires, words in the singular shall include the plural and in the plural shall include the singular.

1.7 Unless the context otherwise requires, a reference to one gender shall include a reference to the other genders.

1.8 A reference to a statute or statutory provision is a reference to it as amended, extended or re- enacted from time to time.

1.9 A reference to a statute or statutory provision shall include all subordinate legislation made from time to time under that statute or statutory provision.

1.10 A reference to writing or written includes email.

1.11 Any words following the terms including, include, in particular or for example or any similar phrase shall be construed as illustrative and shall not limit the generality of the related general words.

1.12 In the case of conflict or ambiguity between any of the provisions of this agreement and the provisions of any Contract, the provisions of this agreement shall prevail.

2. Scope of Processing

2.1 Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause 2.1 is in addition to, and does not relieve, remove or replace, a party’s obligations under the Data Protection Legislation.

2.2 The parties acknowledge that for the purposes of the Data Protection Legislation, the Client is the data controller and TeacherCloud is the data processor (where “data controller” and “data processor” have the meanings as defined in the Data Protection Legislation).

2.3 The Client (and/or its Permitted Affiliates) will typically (but not always) be some form of organisation responsible for minors (e.g. schools, nurseries, child minders etc) or some other form of organisation that monitors and looks after people within its care (e.g. care homes, residential homes, charitable organisations and others responsible for special educational needs and disabilities etc), in each case using Evidence for Learning and any other TeacherCloud assessment software to record information relating to the development and progress of those individuals; the information can include video content, pictures, teaching or learning notes and comments and other relevant assessment data against those individuals that allows the Client or its Permitted Affiliates to track and support the individuals progress against stated learning goals using a number of different metrics either provided as part of the evidence based learning app by TeacherCloud or as determined by the Client at its discretion.

As a consequence, TeacherCloud will process the personal data of those individuals for whom the Client or its Permitted Affiliate is responsible for. This will include photos and videos of those individuals, comments placed against those individuals and other statistics and metrics relating to those individuals in respect of their development whilst being monitored and observed via the evidence based learning app by the Client or its Permitted Affiliate.

TeacherCloud will process the above data and information by hosting such information on its servers and providing the Client and its Permitted Affiliates with access to such information via the evidence based learning app. This is necessary in order for TeacherCloud to provide the Services it is contractually obliged to provide under the Contract (Business Purpose). The duration of the processing shall be for the period as set out in any Contract between the parties from time to time, or otherwise, for the duration of this agreement and until this agreement is terminated in accordance with clause 8.

2.4 Without prejudice to the generality of clause 2.1, the Client will ensure that it and its Permitted Affiliates have all necessary appropriate consents and notices in place to enable lawful transfer of the Client Data to TeacherCloud for the duration and purposes of this agreement whether that be direct or via a third party.

2.5 During the Term, TeacherCloud shall process the Client Data it receives from the Client or its Permitted Affiliates:

(a) solely for the Business Purpose, only to the extent is reasonably necessary to achieve the Business Purpose and for no other purpose except with the express written consent of the Client (and shall only make copies of the Client Data to the extent reasonably necessary for the Business Purpose (which, for clarity, includes back-up, mirroring (and similar availability enhancement techniques), security, disaster recovery and testing of the Client Data); and

(b) only in accordance with the Client’s written instructions from time to time (provided TeacherCloud shall not be required to do so where such actions may breach any law or regulation of any country with jurisdiction over TeacherCloud’s affairs, in which case the Data Processor shall notify the Data Controller of the reasons for any breach it considers to be possible or likely unless the law or regulation of any country with jurisdiction over TeacherCloud’s affairs prohibits TeacherCloud from so notifying the Client).

2.6 The Client acknowledges that TeacherCloud is under no duty to investigate the completeness, accuracy or sufficiency of the Client’s instructions or the Client Data.

3. Obligations of TeacherCloud

3.1 Without prejudice to the generality of clause 2.1, TeacherCloud shall, in relation to any Client Data processed in connection with the performance by TeacherCloud of its obligations under this agreement:

(a) ensure that it has in place appropriate technical and organisational measures as set out in clause 5;

(b) ensure that all personnel who have access to and/or process Client Data are obliged to keep the Client Data confidential;

(c) not transfer any Client Data outside of the European Economic Area unless the prior written consent of the Client has been obtained and the following conditions are fulfilled:

(i) the Client or TeacherCloud has provided appropriate safeguards in relation to the transfer;

(ii) the data subject has enforceable rights and effective legal remedies;

(iii) TeacherCloud complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Client Data that is transferred; and

(iv) TeacherCloud complies with reasonable instructions notified to it in advance by the Client with respect to the processing of the Client Data;

(d) assist the Client, at the Client’s cost, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(e) notify the Client without undue delay on becoming aware of a security breach concerning the Client Data, or if the Client Data is lost or destroyed or becomes damaged or corrupt or unusable (Data Breach);

(f) at the written direction of the Client, delete or return Client Data and copies thereof to the Client on termination of the agreement in accordance with clause 8.3, unless it is required by any law or regulation of any country with jurisdiction over TeacherCloud’s affairs to keep copies of the Client Data;

(g) where the Client gives notice to TeacherCloud that it considers a Data Breach to be likely to result in a “high risk” (given the meaning set out in the UK GDPR) to data subjects, TeacherCloud shall provide the Client with reasonable cooperation and assistance in relation to any notification or other communication that is given to the data subjects affected by the Data Breach; and

(h) maintain complete and accurate records and information to demonstrate its compliance with this clause 3.1 and allow for audits by the Client or the Client’s designated auditor in accordance with clause 4.

4. Audit

4.1 TeacherCloud shall keep at its normal place of business detailed, accurate and up-to-date records relating to the processing of the Processed Data by TeacherCloud and to the measures taken under clause 5, including the permissioning and control of the Processed Data (Records).

4.2 If the Client (either direct or via its third-party representatives) wishes to audit TeacherCloud’s compliance with its obligations under this agreement, then TeacherCloud shall give all necessary assistance to the conduct of such audits during the Term which shall include access to Records and any other relevant information held by TeacherCloud on reasonable notice. Such audit rights may be exercised by the Client only once in any calendar year during the Term.

4.3 Audit access by any third party representative of the Client shall be subject to such representative agreeing confidentiality obligations equivalent to those in clause 10 in respect of the information obtained.

5. Security Measures

5.1 TeacherCloud shall, in relation to any Client Data processed in connection with the performance by TeacherCloud of its obligations under this agreement, ensure that it has in place appropriate technical and organisational measures, to protect against accidental, unauthorised or unlawful processing or alteration of Client Data and against accidental loss or destruction of, damage or alteration to Client Data, appropriate to the harm that might result from the accidental, unauthorised or unlawful processing or loss, destruction, alteration or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures. Such measures may include, where appropriate:

(a) pseudonymising and encrypting Client Data,

(b) ensuring confidentiality, integrity, availability and resilience of its systems and services;

(d) regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it.

6. Client Warranties and Indemnity

6.1 The Client is entering into the Contract on behalf of itself and its Permitted Affiliates. The Client shall ensure that its Permitted Affiliates comply with these terms as though they were a party to them.

6.2 The Client warrants and represents that:

(a) the processing of the Client Data from time to time (including any processing for direct marketing purposes) has been carried out in accordance with the Data Protection Legislation at all times;

(b) it is not aware of any circumstances likely to give rise to breach of any of the Data Protection Legislation in the future;

(c) TeacherCloud is entitled to process the Client Data for the Business Purpose and such use will comply with all Data Protection Legislation;

(d) all data subjects relating to the Client Data (or where appropriate a parent or legal guardian) have given their valid written consent and, where required under the Data Protection Legislation, their explicit consent to the transfer of their personal data by the Client to TeacherCloud and to the processing of their personal data by TeacherCloud for the Business Purpose;

(e) all Client Data is necessary, accurate and up-to-date;

(f) the Client Data contains nothing that is defamatory or indecent; and

(g) it is registered with all relevant data protection authorities to process all Client Data for the Business Purpose.

6.3 The Client shall indemnify TeacherCloud against all claims, actions, and proceedings commenced or threatened against TeacherCloud by any third party (including liabilities, costs, expenses, damages and all other reasonable professional costs and expenses suffered or incurred by TeacherCloud) arising out of or in connection with the processing of the Client Data under this agreement (Claim), except to the extent that the Claim has arisen out of or in connection with any negligence or default of TeacherCloud.

6.4 The Client acknowledges that:

(a) TeacherCloud is reliant on the Client for direction as to the extent to which TeacherCloud is entitled to use and process the Client Data; and

(b) any Claim includes any claim or action brought by a data subject arising from any action or omission by TeacherCloud, to the extent that such action or omission resulted directly or indirectly from the Client’s instructions.

6.5 If any third party makes a Claim, or notifies an intention to make a Claim, TeacherCloud shall:

(a) give written notice of the Claim to the Client as soon as reasonably practicable;

(b) not make any admission of liability in relation to the Claim without the prior written consent of the Client;

(d) at the Client’s expense, co-operate and assist to a reasonable extent with the Client’s defence of the Claim.

7. Limitation of liability

7.1 Nothing in this agreement shall limit or exclude TeacherCloud’s liability for:

(a) death or personal injury caused by its negligence, or the negligence of its employees, agents or subcontractors;

(b) fraud or fraudulent misrepresentation; or

7.2 Subject to clause 7.1, neither party shall be liable to the other party, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with the Contract for:

(a) loss of profits;

(b) loss of sales or business;

(d) loss of anticipated savings;

(e) loss of use or corruption of software, data or information;

(f) loss of or damage to goodwill or reputation; or

(g) any indirect or consequential loss.

7.3 Subject to clause 7.1, TeacherCloud’s total liability to the Client (and its Permitted Affiliates), whether in contract, tort (including negligence), breach of statutory duty, or otherwise, arising under or in connection with this agreement shall be limited to the total subscription fees paid by the Client under the Contract.

8. Term and termination

8.1 Subject to earlier termination in accordance with clause 8.2, this agreement shall commence on the Commencement Date and shall remain in force until termination of the Contract.

8.2 Without prejudice to any rights that have accrued under this agreement or any of its rights or remedies, either party may at any time terminate this agreement with immediate effect by giving written notice to the other party if:

(a) the other party commits a material breach of any material term of this agreement and (if such breach is remediable) fails to remedy that breach within a period of 10 Business Days after being notified in writing to do so;

(b) the other party takes any step or action in connection with its entering administration, provisional liquidation or any composition or arrangement with its creditors (other than in relation to a solvent restructuring), being wound up (whether voluntarily or by order of the court, unless for the purpose of a solvent restructuring), having a receiver appointed to any of its assets or ceasing to carry on business or, if the step or action is taken in another jurisdiction, in connection with any analogous procedure in the relevant jurisdiction;

(c) the other party suspends, or threatens to suspend, or ceases or threatens to cease to carry on all or a substantial part of its business; or

(d) the other party’s financial position deteriorates to such an extent that in the terminating party’s opinion the other party’s capability to adequately fulfil its obligations under the Contract has been placed in jeopardy.

8.3 Upon receipt of written notice of termination from the Client or upon giving written notice of termination to the Client by TeacherCloud (in either case whether in respect of this agreement or the Contract), TeacherCloud shall within 30 days the effective date of the termination of this agreement and/or the Contract (whichever occurs first):

(a) at the absolute discretion of the Client return or destroy any Client Data that is in the possession or control of TeacherCloud, its employees, agents, subcontractors and/or sub- processors. Where the Client requires Client Data to be returned, TeacherCloud shall for a period of 28 days thereafter allow the Client access to the TeacherCoud software purely for the purposes of allowing the Client access to the Client Data for the Client to download any Client Data in the format such Client Data is typically made available by TeacherCloud via the TeacherCoud software;

(b) to the extent technically and legally practicable, erase all Client Data from its computer and communications systems and devices used by it, or which is stored in electronic form. Where Client Data is erased it shall be considered erased for the purposes of this clause where it has been put beyond use by TeacherCloud;

(c) use its reasonable endeavours to procure that any third parties erase all Data to the extent technically and legally practicable which is stored in electronic form on systems and data storage services provided by third parties; and

(d) certify in writing to the Client (by a certificate signed by a director of TeacherCloud) that it has complied with its obligations under this clause 8.3.

8.4 Notwithstanding termination, all provisions of this agreement will remain in force until TeacherCloud has complied with the terms of clause 8.3. Termination of this agreement shall not affect any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of the agreement which existed at or before the date of termination.

8.5 Clauses 2.1, 6, 7, 10, and 13 shall survive termination of this agreement.

9. Force majeure

Neither party shall be in breach nor liable for delay in performing, or failure to perform, any of its obligations under the Contract if such delay or failure result from events, circumstances or causes beyond its reasonable control. In such circumstances the time for performance shall be extended by a period equivalent to the period during which performance of the obligation has been delayed or failed to be. If the period of delay or non-performance continues for 3 months, the party not affected may terminate this agreement by giving written notice to the affected party.

10. Confidentiality

10.1 TeacherCloud acknowledges that the Client’s Confidential Information includes any Client Data.

10.2 The term Confidential Information does not include any information that:

(a) is or becomes generally available to the public (other than as a result of its disclosure by the receiving party or its Representatives in breach of this clause 10);

(b) was available to the receiving party on a non-confidential basis before disclosure by the disclosing party;

(c) was, is, or becomes, available to the receiving party on a non-confidential basis from a person who, to the receiving party’s knowledge, is not bound by a confidentiality agreement with the disclosing party or otherwise prohibited from disclosing the information to the receiving party;

(d) was known to the receiving party before the information was disclosed to it by the disclosing party;

(e) the parties agree in writing is not confidential or may be disclosed; or

(f) is developed by or for the receiving party independently of the information disclosed by the disclosing party.

10.3 Each party shall keep the other party’s Confidential Information confidential and shall not:

(a) use any Confidential Information except for the Business Purpose; or

(b) disclose any Confidential Information in whole or in part to any third party, except as expressly permitted by this clause 10.

10.4 A party may disclose the other party’s Confidential Information to those of its Representatives who need to know that Confidential Information for the Business Purpose, provided that:

(a) it informs those Representatives of the confidential nature of the Confidential Information before disclosure; and

(b) at all times, it is responsible for the Representatives’ compliance with the confidentiality obligations set out in this clause 10.

10.5 A party may disclose Confidential Information to the extent required by any law or regulation of any country with jurisdiction over TeacherCloud’s affairs, by any governmental or other regulatory authority, or by a court or other authority of competent jurisdiction provided that, as far as it is legally permitted to do so, it gives the other party as much notice of the disclosure as possible.

10.6 Each party reserves all rights in its Confidential Information. No rights or obligations in respect of a party’s Confidential Information, other than those expressly stated in this agreement, are granted to the other party, or are to be implied from this agreement.

10.7 The provisions of this clause 10 shall continue to apply after termination of this agreement.

11. Assignment and Subcontracting

11.1 This agreement is personal to the Client and it shall not assign, transfer, mortgage, charge, subcontract, declare a trust of or deal in any other manner with any of its rights and obligations under this agreement without the prior written consent of TeacherCloud.

11.2 The Client confirms it is acting on its own behalf and its Permitted Affiliates and not for the benefit of any other person.

11.3 The Client consents and authorises TeacherCloud to appoint a third party (Subcontractor) to process the Client Data provided that the Subcontractor’s contract:

(a) is on terms that are substantially the same as those set out in this agreement; and

(b) terminates automatically on termination of this agreement for any reason.

11.4 As between the Client and TeacherCloud, TeacherCloud shall remain fully liable for all acts or omissions of any Subcontractor appointed by it pursuant to clause 11.3.

11.5 It is specifically acknowledged by the Client that TeacherCloud uses Amazon Web Services (AWS) to host its servers where such servers are based inside of the European Union. Accordingly, the Client specifically consents to TeacherCloud using such party as a Subcontractor and acknowledges that personal data will be transferred to such entity for the purposes of providing such sub-contract services to TeacherCloud.

12. Waiver

No failure or delay by a party to exercise any right or remedy provided under this agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy. No single or partial exercise of any right or remedy shall prevent or restrict the further exercise of that or any other right or remedy.

13. Rights and remedies

Except as expressly provided in this agreement, the rights and remedies provided under this agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

14. Notice

14.1 Any notice or other communication given to a party under or in connection with this agreement shall be in writing and shall be delivered by hand or by pre-paid first-class post or other next working day delivery service at its registered office (if a company) or its principal place of business (in any other case); or sent by email to the address specified in the Contract (if any).

14.2 Any notice or other communication shall be deemed to have been received: if delivered by hand, on signature of a delivery receipt or at the time the notice is left at the proper address; if sent by pre-paid first class post or other next working day delivery service, at 9.00 am on the second Business Day after posting or at the time recorded by the delivery service; or, if sent by email, at 9.00 am on the next Business Day after transmission.

14.3 This clause does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any other method of dispute resolution.

15. Entire agreement

15.1 This agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.

15.2 Each party acknowledges that in entering into this agreement it does not rely on, and shall have no remedies in respect of, any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this agreement.

15.3 Each party agrees that it shall have no claim for innocent or negligent misrepresentation based on any statement in this agreement.

16. Variation

Except as expressly provided in this agreement, no variation of this agreement shall be effective unless it is in writing and signed by the parties (or their authorised representatives).

17. Severance

17.1 If any provision or part-provision of this agreement is or becomea

17.1 If any provision or part-provision of this agreement is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause shall not affect the validity and enforceability of the rest of this agreement.

17.2 If any provision or part-provision of this agreement is invalid, illegal or unenforceable, the parties shall negotiate in good faith to amend such provision so that, as amended, it is legal, valid and enforceable, and, to the greatest extent possible, achieves the intended commercial result of the original provision.

s invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause shall not affect the validity and enforceability of the rest of this agreement.

18. No partnership or agency

Nothing in this agreement is intended to, or shall be deemed to, establish any partnership or joint venture between any of the parties, constitute any party the agent of another party, nor authorise any party to make or enter into any commitments for or on behalf of any other party.

19. Third-party rights

19.1 Unless it expressly states otherwise, this agreement does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this agreement.

19.2 The rights of the parties to rescind or vary this agreement are not subject to the consent of any other person.

20. Counterparts

This agreement may be executed in any number of counterparts, each of which when executed shall constitute a duplicate original, but all the counterparts shall together constitute the one agreement.

21. Governing law

This agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the law of England and Wales.

22. Jurisdiction

22.1 Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this agreement or its subject matter or formation (including non-contractual disputes or claims).