Data processing agreement
Template: to be reviewed by a solicitor before use. This is a working draft (draft v1.3, 12 October 2026) prepared from the product as built on 12 October 2026. It is not legal advice and has not been reviewed by a lawyer. Square-bracketed text must be completed or confirmed.
This agreement meets the requirements of Article 28(3) of the UK GDPR (https://www.legislation.gov.uk/eur/2016/679/article/28) and follows the ICO's guidance on contracts between controllers and processors (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/).
1. Parties
- The Controller: [School legal name], [maintained school / academy trust / independent school], of [address], [URN], acting through [name and role]. Where the school is an academy, the controller is the academy trust: [trust legal name], company number [number].
- The Processor: After Hours Education Ltd, trading as Benchmark.Pulse, company number 17051217, registered office Wellesley House, Duke Of Wellington Avenue, London SE18 6SS, ICO registration number ZC198439.
2. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
- Services: the Benchmark.Pulse survey service described in the Processor's terms of service, including survey set-up, distribution of personal survey links, collection of responses, and production of reports.
- Applicable Data Protection Law: the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and the Data (Use and Access) Act 2025, each as amended.
- Sub-processor: any third party engaged by the Processor to process Controller personal data.
3. Scope and roles
3.1 The Processor processes personal data on behalf of the Controller to provide the Services. For that processing the Controller is the controller and the Processor is the processor.
3.2 This agreement does not cover processing for which the Processor is itself a controller, which is:
- (a) the Processor's own customer records: school user account details, billing, invoices and correspondence; and
- (b) benchmarking across schools, if and only if the Controller has opted in. That processing uses aggregated, thresholded figures only, and is described in a separate benchmarking privacy notice [to be written].
4. Details of the processing (Article 28(3))
| Item | Detail |
|---|---|
| Subject matter | Running anonymous surveys of staff, parents and carers, and pupils, and producing analysed reports for the Controller |
| Duration | The term of the Controller's use of the Services, plus the retention periods in the retention schedule, plus the deletion period in clause 13 |
| Nature | Collection, storage, structuring, statistical analysis, automated redaction, automated checking of free text for safeguarding concerns, AI-assisted summarising of redacted free text where the Controller has switched it on, and deletion |
| Purpose | To give the Controller an anonymous picture of the views of its staff, parents and carers, and pupils, so it can meet its duties as an employer and improve the school, and to pass comments that may raise a safeguarding concern to its named safeguarding leads |
| Categories of data subjects | (1) Staff invited to respond, including current staff and, for the staff exit survey, leavers. (2) Parents and carers invited to respond. (3) Pupils who respond, through an open link or QR code. (4) Members of the Controller's staff who hold Benchmark.Pulse user accounts. (5) Any person named or described in a free-text answer |
| Categories of personal data | (1) Invitation data: email address of a member of staff or a parent or carer (deleted as soon as the link is used, 30 days after the link was sent, or when the survey closes, whichever comes first), a SHA-256 hash of the single-use link token, a flag showing whether the link was used (no date of use), and the days the link was sent and reminded. (2) Response data: answers to scale and choice questions, free-text answers, the respondent's self-selected group (for example role or year group), the channel (personal link or open link), the submission date (day only), and a list of any answers withheld for safeguarding. No name, email, token, user ID, IP address or device information is stored with a response. (3) Safeguarding alert data: the original, unredacted text of a comment flagged as a possible safeguarding concern, the question it answered, the words that matched, when the alert arrived (to the second), and who reviewed it with what outcome. (4) School user data: email address used to sign in, role in the account, whether the person is named a safeguarding lead, and audit log entries of actions taken |
| Special category data | Not sought. Free-text answers, and therefore safeguarding alerts, may contain health information (for example about wellbeing, stress or self-harm) or other special category data if a respondent chooses to give it. The Controller's DPIA must address this |
| Criminal offence data | Not sought. It may appear in free text by the respondent's choice |
5. Controller obligations
5.1 The Controller is responsible for:
- (a) having a lawful basis for the processing and, where relevant, an Article 9 condition;
- (b) giving respondents a privacy notice (a template is provided in this pack);
- (c) completing a DPIA before the first survey (a pre-filled template is provided);
- (d) the accuracy of the email addresses it uploads;
- (e) deciding whether to opt in to benchmarking; and
- (f) controlling who in the school holds a Benchmark.Pulse account and with which role; and
- (g) naming at least one safeguarding lead before opening a survey, and acting on safeguarding alerts under its own safeguarding policy.
5.2 The Controller must upload into the invitation list only the email addresses of the staff, or parents and carers, it is asking to respond. It must never upload pupil personal data. Pupils respond through an open link or QR code.
6. Processor obligations
The Processor shall:
6.1 Instructions. Process the personal data only on the Controller's documented instructions, including with regard to international transfers, unless required to do so by law. This agreement, the Controller's configuration of each survey, and the Controller's actions in the product are the Controller's instructions. If the Processor believes an instruction infringes data protection law it will tell the Controller promptly.
6.2 Confidentiality. Ensure that anyone authorised to process the personal data is under a duty of confidentiality.
6.3 Security. Take the measures required by Article 32, as described in Annex B and in the security overview.
6.4 Sub-processors. Comply with clause 7.
6.5 Data subject rights. Comply with clause 9.
6.6 Assistance. Help the Controller meet its obligations under Articles 32 to 36 (security, breach notification, DPIAs and prior consultation), taking into account the nature of the processing and the information available to the Processor.
6.7 Deletion or return. Comply with clause 13.
6.8 Information and audit. Comply with clause 14.
6.9 No other use. Not use the personal data for any other purpose. In particular, the Processor shall not:
- (a) use survey responses to train, fine-tune or evaluate any AI model, or allow a sub-processor to do so;
- (b) sell, rent or share the personal data for marketing;
- (c) attempt to identify any respondent, or link a response to an invitation; or
- (d) use responses for benchmarking unless the Controller has opted in, and then only in aggregated, thresholded form under clause 3.2(b).
6.10 Records. Keep a record of processing activities under Article 30(2).
7. Sub-processors
7.1 The Controller gives general written authorisation for the Processor to engage the sub-processors listed in the published sub-processor list (sub-processors.md, published at [URL]).
7.2 The Processor will give the Controller at least [30] days' notice of any intended addition or replacement, by email to the account owner and by updating the published list. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may end the Services and receive a pro-rata refund of any Annual plan fee paid for the remaining term [check commercial terms].
7.3 The Processor will impose on each sub-processor, by written contract, data protection obligations that give at least the same protection as this agreement, and remains liable to the Controller for each sub-processor's performance.
8. International transfers
8.1 The Processor's primary database and file storage are hosted in the United Kingdom (Supabase, London region) [check: confirm production project region].
8.2 Some sub-processors may process personal data outside the UK, as set out in the sub-processor list. The Processor will only make or permit a restricted transfer where it is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, the "UK-US data bridge", for certified US recipients), the ICO's International Data Transfer Agreement, or the ICO's Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required. See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/.
8.3 Free text is sent for AI summarising only if the Controller has switched AI commentary on for that survey. It is on by default except for pupil surveys, where it is off by default. Nothing from a survey is sent before a full report is unlocked, and comments flagged for safeguarding are never sent. Free text is redacted before transfer (names with titles, first names, class codes, email addresses, phone numbers, links and initials are replaced automatically). Redaction reduces but does not remove the possibility that transferred text contains personal data, so the transfer is treated as a transfer of personal data.
9. Data subject rights
9.1 The Processor will notify the Controller within [5] working days if it receives a request from a data subject relating to Controller data, and will not respond to it except on the Controller's instructions.
9.2 The Processor will provide reasonable assistance, by appropriate technical and organisational measures, for the Controller to respond to requests.
9.3 The parties acknowledge that survey responses are designed so that they cannot be linked to the person who gave them: responses carry no name, email, token or IP address. It will therefore usually not be possible to find, correct or delete an individual's response. The Controller's privacy notice explains this to respondents. The Processor can find and delete a person's email address and invitation record while a survey is open, and a school user's account at any time. There is no in-product way to delete a survey or close an account: the Controller asks the Processor by email.
10. Personal data breaches
10.1 The Processor will notify the Controller without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting Controller personal data. This is shorter than the 72 hours the Controller has to notify the ICO under Article 33, so the Controller has time to assess and report.
10.2 Notification will go to the account owner and to [the Controller's DPO contact], and will include, as far as known at the time:
- (a) the nature of the breach, the categories and approximate numbers of data subjects and records concerned;
- (b) the likely consequences;
- (c) the measures taken or proposed, including to mitigate adverse effects; and
- (d) a contact point at the Processor.
Information not available at first will be provided in phases without further undue delay.
10.3 The Processor will not notify the ICO or data subjects about a breach of Controller data on the Controller's behalf without the Controller's written instruction, unless required by law.
10.4 The Processor will keep a record of all personal data breaches, including the facts, effects and remedial action.
11. Assistance with DPIAs
The Processor provides a pre-filled DPIA template (dpia-template.md) and will answer the Controller's reasonable questions about the processing to help complete it, and with any prior consultation with the ICO under Article 36.
12. Security
The Processor will implement the measures in Annex B. It will not materially reduce the overall level of security during the term.
13. Deletion or return at the end of the Services
13.1 Before deletion, the Controller may download its reports and a CSV of its results. The CSV holds the same suppressed figures as the report and the redacted comments, listed separately from all other answers; it does not contain one row per person. The Processor does not release response rows, because they would defeat the anonymity thresholds respondents were promised; where the Controller needs information to meet a legal obligation, the Processor will provide it with those thresholds applied. [Solicitor to confirm this meets the Controller's rights.]
13.2 Within [30] days of the end of the Services, or of the Controller's written request, the Processor will delete all Controller personal data from live systems, unless law requires it to be kept. Deletion from backups follows the backup cycle, which is [7] days [check: confirm backup retention with Supabase plan]. Data in backups is not restored or used except to recover from an incident.
13.3 Records the Processor holds as a controller (invoices, purchase records) are kept for the period set out in the retention schedule.
13.4 The Processor will confirm deletion in writing on request.
14. Information and audit
14.1 The Processor will make available all information necessary to demonstrate compliance with Article 28, including this pack, its records of processing, and its sub-processor contracts in redacted form.
14.2 The Processor will allow for and contribute to audits, including inspections, by the Controller or an auditor it appoints, on at least [30] days' notice, no more than once a year unless following a breach or a request from the ICO, at the Controller's cost, during normal business hours, and subject to confidentiality. The Processor may first offer a written questionnaire response or its Cyber Essentials certificate [planned] to meet the request.
15. Liability, term and law
15.1 Liability is as set out in the Processor's terms of service [solicitor to review the cap and its interaction with data protection claims].
15.2 This agreement lasts as long as the Processor processes Controller personal data.
15.3 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Signatures
| Controller | Processor | |
|---|---|---|
| Name | [ ] | [ ] |
| Role | [ ] | [ ] |
| Signature | [ ] | [ ] |
| Date | [ ] | [ ] |
Annex A: Sub-processors
As published in sub-processors.md at the date of signature: Supabase, Anthropic, Resend, Stripe and Netlify. Stripe and Netlify receive no survey responses or invitation data.
Annex B: Technical and organisational measures
A summary. The security overview has the detail, and marks what is planned rather than in place.
| Measure | Status |
|---|---|
| Database and storage hosted in the UK (Supabase, London region) | In place [check: production region] |
| Row Level Security on every table; responses and invitations have no access policies, so school users and the public cannot read them directly | In place |
| Single-use personal links, emailed only by the Processor and never shown to school users; only a SHA-256 hash of each token is stored; the token is kept out of web server logs; reminders issue a fresh link | In place |
| Responses store no token, user ID, IP address or device information, and only a day-level date; invitations do not record the day a link was used | In place |
| Invitation email addresses deleted as soon as the link is used, 30 days after the link was sent, or when the survey closes, whichever comes first; surveys close automatically at their closing time | In place |
| Minimum response and group sizes, small-cell suppression (fewer than 5), and secondary suppression applied before any result is shown; role results withheld if responses exceed the stated headcount | In place |
| Automatic redaction of free text before display, download or AI processing | In place |
| Leaders can remove a comment; removal deletes it from the stored report and the results download, cannot be undone, and the report says how many were removed | In place |
| Every survey checks comments for safeguarding concerns and cannot open without a named safeguarding lead. A flagged comment's original text is held in a safeguarding alert that only named safeguarding leads can read; owners see only that an alert is waiting. Alert emails contain no comment text. Flagged comments are kept out of reports, AI and downloads. Comment text is deleted 30 days after a lead reviews it; an unreviewed alert keeps its text | In place |
| Results download limited to aggregates; no row-level export to school users | In place |
| AI commentary is a per-survey setting, off by default for pupil surveys; AI narrative checked against the computed statistics; no training on responses | In place (no-training depends on supplier terms [check]) |
| Audit log of key account actions, readable by the account owner | In place |
| Encryption in transit (TLS) and at rest | In place via Supabase and Netlify [check] |
| Multi-factor authentication required for school accounts | Planned |
| Automatic deletion at the end of the retention period | Planned |
| Backups with documented retention and tested restore | Planned [check: Supabase plan backups] |
| Cyber Essentials certification | Planned before launch |