Last updated: September 2026
This Data Processing Agreement (DPA) applies where an institution uses SKOOLES to process personal data. It forms part of our Terms of Service. Institutions in the EEA or UK, and those subject to FERPA, should read this alongside our Privacy Policy.
1. Roles
The institution is the controller. SKOOLES is the processor. Where the institution is itself a processor for a public education authority, SKOOLES acts as a sub-processor and these terms apply accordingly.
2. Scope of processing
| Subject matter | Provision of the SKOOLES education platform |
| Duration | The term of the subscription, plus the deletion periods in section 9 |
| Nature and purpose | Hosting, storage, synchronisation, messaging, analytics and support, to deliver education administration and learning |
| Categories of data subject | Students, parents and guardians, teachers, administrative staff, bus drivers |
| Categories of personal data | Identity and profile data, academic records, attendance, transportation and location events, communications, and where enabled by the institution, health and welfare data |
| Special category data | Health data, where the institution enables the medical records module. Processed only on the institution’s instructions and subject to section 4 |
3. Our obligations as processor
- We process personal data only on the documented instructions of the institution, including for international transfers, unless law requires otherwise, in which case we will inform the institution first unless prohibited.
- We ensure that personnel authorised to process personal data are bound by confidentiality.
- We implement the technical and organisational measures described on our Security page.
- We assist the institution in responding to requests from data subjects, and in meeting its obligations on security, breach notification and data protection impact assessments.
- We make available the information needed to demonstrate compliance and allow for audits as described in section 8.
4. Instructions and special category data
The institution is responsible for ensuring that its instructions, and the data it enters, comply with applicable law, including having a lawful basis and, for special category data such as health information, an applicable Article 9 condition. We will inform the institution if, in our opinion, an instruction infringes data protection law.
5. Sub-processors
The institution gives general authorisation for the sub-processors listed at skooles.com/subprocessors. We will give notice before adding or replacing a sub-processor that processes personal data, and the institution may object on reasonable data protection grounds; if we cannot resolve the objection, the institution may terminate the affected service. Each sub-processor is bound by obligations no less protective than these, and we remain fully liable for their performance.
6. Security
We maintain tenant isolation, OAuth 2.0 and OIDC authentication, role and permission based access control, AES-256 encryption at rest, TLS in transit, encrypted device databases, and audit logging. Full detail is on the Security page, which is incorporated into this DPA by reference.
7. Personal data breach
We will notify the institution without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting its data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide reasonable assistance with the institution’s own notifications to a supervisory authority or to affected individuals.
8. Audit
On reasonable written notice, and no more than once in any 12 month period unless required by a supervisory authority, we will provide information necessary to demonstrate compliance with this DPA and will allow an audit conducted by the institution or an independent auditor bound by confidentiality. Audits must not disrupt the service or compromise the confidentiality of other customers.
9. Return and deletion
On termination the institution has 30 days to export its data through the facilities we provide. After that period we delete or irreversibly anonymise the data within 90 days, and it is purged from encrypted backups within a further 35 days, unless law requires us to retain it, in which case we will tell the institution what is retained and why.
10. International transfers
Where personal data is transferred out of the EEA or UK, we rely on the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another approved mechanism, supported by encryption in transit and at rest. Institutions with data residency requirements should raise them before deployment; core components can be deployed on infrastructure controlled by the institution.
11. Student data commitments
For institutions subject to FERPA, we act as a school official with a legitimate educational interest, under the direct control of the institution with respect to education records, and we do not re-disclose education records except as directed by the institution or as required by law. For institutions subject to COPPA, parental consent is obtained by the institution on the school’s behalf. In all cases:
- We do not sell student personal information.
- We do not use student data for targeted advertising.
- We do not build a commercial profile of a student for any purpose other than delivering the educational service.
- We do not use student data to train third-party AI models.
- Ownership of student data stays with the institution at all times.
12. How to execute this DPA
If your institution requires a signed copy, or a DPA on your own template, email [email protected] and we will provide a countersigned version.
This DPA should be reviewed by qualified counsel before execution.