Data processing agreement
1. Parties
Controller: the school named in the signature block (the "School").
Processor: The Tree Fella NE Ltd, company number 11632007, 16 Prince of Wales Close, South Shields, NE34 6QT, ICO registration number ZA845692 ("we").
2. What we process
| Subject matter | Providing The Learning Forest, free learning modules including Grow your times tables, a times tables practice app, free of charge. |
|---|---|
| Duration | While the School uses the app, then until deletion under section 8. |
| Nature and purpose | Storing pupils' practice and progress, logging pupils and staff in, and showing teachers their pupils' progress. |
| Data subjects | Pupils; school staff who hold teacher accounts. |
| Personal data | As listed in What we store: staff email addresses; pupil first names, nicknames or initials; usernames; hashed credentials; picture passwords; class names; answers and progress; settings; optional reminder subscriptions; failed login records including IP addresses. |
| Special category data | None. The School should not enter any. |
3. Our obligations
- We process the personal data only on the School's documented instructions. Using the app as designed, and teachers' actions in it, are those instructions. If we think an instruction breaks data protection law, we will tell the School.
- Everyone who can access the data is bound by confidentiality.
- We keep the security measures in section 5 in place.
- We use the sub-processors in section 6 only, and follow section 6 before adding or changing one.
- We help the School respond to requests from data subjects (to see, correct or delete data), taking into account what the app lets the School do itself.
- We help the School meet its duties on security, breach notification and data protection impact assessments, by providing the information in this pack and answering reasonable questions.
- At the end of the service we delete the data under section 8.
- We give the School the information it reasonably needs to show compliance with Article 28, and allow and contribute to reasonable audits, normally by written questions.
4. The School's obligations
- The School has a lawful basis for the processing and tells parents about it (a privacy notice is provided).
- Staff enter only first names, nicknames or initials for pupils, and no special category data.
- Staff keep their passwords and pupils' login cards safe, and set up only school-controlled devices as class devices.
- Staff delete pupils and classes when they no longer need them.
5. Security
- Encryption in transit (HTTPS) for all traffic.
- Passwords, recovery codes, QR keys and login tokens stored only as hashes; passwords and recovery codes with salted PBKDF2.
- Rate limits on all login methods; picture logins restricted to class devices set up by a teacher.
- HttpOnly session cookies, cross-site request checks and a strict content security policy.
- Each teacher account can only access its own classes and pupils.
- No analytics, advertising or third-party scripts.
- Access to the production database is limited to Simon Forster (Director), with two-factor authentication on the hosting account.
6. Sub-processors
The School gives general authorisation for these sub-processors:
- Cloudflare, Inc.: hosting, database (location: Western Europe). International transfers are covered by Cloudflare's data processing addendum, including the UK International Data Transfer Addendum.
- Apple, Google and Mozilla push services: only when a family turns on reminders at home; they receive an empty message.
We will give at least 30 days' notice on this page and by email to teacher accounts before adding or replacing a sub-processor. The School may object, and may stop using the app and have its data deleted.
7. Personal data breaches
We will tell the School without undue delay, and within 48 hours of becoming aware of a breach affecting its data, with what we know: what happened, the data and people affected, likely consequences and what we have done. We will update the School as we learn more.
8. Deletion at the end
Teachers can delete pupils, classes and their own accounts in the app at any time, with immediate effect. When the School stops using the app, it can do that itself, or ask us at learn@thetreefella.co.uk to delete its teacher accounts and everything on them; we will do so within 30 days and confirm in writing. Pupils who haven't played for 12 months are deleted automatically, and teacher accounts unused for 12 months once they have no pupils left. Backups are overwritten within 30 days. We keep no copies unless the law requires it.
9. Liability and law
The service is free. To the extent the law allows, our total liability under this agreement is limited to the fees the School has paid us (none). Nothing in this agreement limits liability that can't be limited by law, or either party's obligations under data protection law. This agreement is governed by the law of England and Wales.