Data Protection Agreement (DPA)

This is a template. It is not a legally binding agreement until it has been countersigned by both parties. Schools should ask their DPO to review this before signing. This document is drafted to satisfy UK GDPR Article 28 requirements for a processor agreement.

1. Parties

This Data Protection Agreement (the "DPA") is between:

• The Controller — the school, college, or trust named in Schedule A, whose lawful basis for processing pupil data is public task under UK GDPR Article 6(1)(e) alongside parental consent for optional processing.
• The Processor — Gist, the operator of the app at gistrevision.pythonanywhere.com, contactable at hello@gist.example.

2. Purpose & Scope

The Processor provides an online revision platform. The Controller instructs the Processor to process personal data of its pupils, and in certain cases the school's staff, solely for the purpose of delivering the service described in the Terms of Service. No other processing is authorised without a fresh, written instruction.

3. Categories of Personal Data

• Account data — username, optional email address, display name, date of birth (used to enforce the age-of-consent gate).
• Learning data — questions attempted, correct / incorrect flags, response times, notes typed into the in-app scratchpad.
• Technical data — session cookies, IP address at login time (recorded in an audit log for account-security purposes), user-agent string.

The Processor does not collect real name, home address, phone number, exam-board reference numbers, or health data. Children's data is subject to the additional measures in Section 8 below.

4. Duration

This DPA is in force for the duration of the Controller's active subscription, plus a 30-day post-termination window during which the Controller may export all pupil data. After the window expires the Processor will delete all personal data belonging to the Controller's pupils, unless retention is required by law.

5. Sub-processors

The Processor uses the following sub-processors to deliver the service. Each is bound by contractual data-protection terms at least as strict as this DPA:

• PythonAnywhere Ltd — UK-based application & database hosting.
• Google LLC — Gemini API used for AI-generated flashcards, mindmaps, and tutor chat. Only prompt content (not identifiers) is transmitted; Google is contractually barred from retaining or training on the prompts under the Gemini API Terms.
• Cloudflare Inc — CDN / DDoS protection at the edge of the app's traffic.

The Processor will give the Controller 30 days' notice before adding, replacing, or removing a sub-processor. The Controller may object and, if the objection cannot be resolved within 30 days, terminate the subscription with a pro-rata refund.

6. Technical & Organisational Measures

• TLS 1.2+ encryption in transit; all cookies flagged Secure and HttpOnly.
• Passwords hashed with PBKDF2-SHA256 with per-user salt (Django default).
• Rate-limited authentication endpoints and IP-based throttling on account-recovery flows.
• Immutable audit log of authentication, password changes, data exports, admin access, and account deletions. Retained 400 days.
• Daily database snapshots. Snapshots are pruned after 7 days.
• Least-privilege database access; the application user does not have SUPERUSER on the database.
• Separation of environments: production data never leaves the hosting environment for development or debugging.

7. Data-subject rights

The Processor will assist the Controller in responding to data-subject requests within 5 working days of the Controller's request:

• Right of access (Article 15) — machine-readable JSON export.
• Right to rectification (Article 16) — direct edit through the profile page.
• Right to erasure (Article 17) — self-service in-app deletion, which cascades every associated row, or a bulk-delete request fulfilled by the Processor within 30 days.
• Right to portability (Article 20) — same JSON export as Article 15.

8. Children's data (Article 8 UK GDPR / COPPA)

For any account whose date-of-birth places the user under 13, the Processor requires verifiable parental consent before the account becomes usable. The consent record retains: the parent's name and email, the child's username, and a timestamp of consent. It does not retain any other parent data. Consent may be revoked in writing at any time; on revocation the child's account is disabled and their data queued for deletion within 30 days.

9. Data breach notification

On becoming aware of a personal data breach affecting pupil data, the Processor will notify the Controller by email at the address in Schedule A within 72 hours, including: the nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken. This gives the Controller time to meet its own ICO-notification duty under Article 33.

10. International transfers

Application & database data is hosted in the United Kingdom. Sub-processor traffic to Google (Gemini API) crosses to the United States under the UK Extension to the EU-US Data Privacy Framework; Google is a certified DPF participant. No pupil identifiers are transmitted in that traffic.

11. Liability & audit

The Controller may audit the Processor's compliance with this DPA by written request; the Processor will provide a signed self- assessment within 20 working days. Third-party audits (e.g. an ICO-approved auditor) may be conducted at the Controller's expense with 30 days' notice.

12. Signatures

The Parties acknowledge the terms above by signature:

Schedule A — Controller details

Institution: ______________________________
DPO / Data Protection contact: ______________________________
DPO email for breach notifications: ______________________________