Data processing agreement

How it binds

It forms an integral part of the terms of use. From the moment a school activates its subscription, this applies too.

If the school prefers a signed copy for its files, we will send one on request. The content is the same.

If we have signed a separate processing agreement with the school, that one prevails in whatever it governs differently.

Roles

The school is the data controller. It decides which data is recorded, for what purpose, who sees it and how long it stays.

STEPROLE LIMITED is the processor. We act only within the limits of the school's instructions, as set out in this text and in the settings the school itself makes inside the application.

Where we use other providers, they are sub-processors and are bound by the same obligations.

Subject matter, nature, purpose and duration

The subject matter is the provision of the school management platform. That is the sole purpose — no processing for purposes of our own.

The nature of the processing is the collection through the school's public forms (enrolment, appointments) and through the re-enrolment a guardian asks for, and the storage, organisation, retrieval, display, sending of notifications and deletion of data, by automated means.

The processing lasts as long as the subscription, and for the transition period that follows its termination.

During the subscription, applications from the public form and re-enrolments that were not approved are deleted automatically 180 days after they last changed, and the visitor details of an appointment 180 days after the appointment. You may ask for a different period, from 30 days to two years.

Whom it concerns and what data

Categories of data subjects: students, often minors; guardians; teachers; administrative staff and the school's owner; those who send the school's public enrolment or appointment form, and the children they send it for; the people named as collecting a child.

Categories of student data: identification and contact details, date of birth, class enrolments, attendance and absences, grades and assessments, homework, participation notes, teacher comments, fee records, files uploaded to the application (course materials, graded papers, homework submissions). Where the health record is turned on: allergies, medical notes, medical certificate expiry, people who collect the child (name, relationship, phone) and answers about photos and video.

Categories of guardian and staff data: identification and contact details, role and permissions, notification preferences, sign-in details and action history.

Categories of data from the public forms: identification and contact details of the applicant and of up to two guardians, the child's details that the school's form asks for, the subjects or classes requested, preferred times, how they found the school, a note and the language of the page, and the answers to the questions the school itself adds to the form; for re-enrolment, the subjects or classes, times, note and those answers, for a child who is already a student; for appointments, name, email, phone and message.

Health details are special-category data (Article 9 of the Regulation). We process them only in the fields the application provides for them, and only while the health record is turned on for the school. The school secures their lawful basis; the public enrolment form does not accept them without the explicit consent of the applicant. No other special-category data is envisaged, and the school undertakes not to record it, nor to ask for it in its own enrolment form questions.

Your instructions, and what we do if they are unlawful

We process data only on your documented instructions. This text, the terms of use and the settings you make inside the application are those instructions.

If the law obliges us to process data beyond your instructions, we will inform you before doing so — unless that same law forbids us to.

If we consider that an instruction from you infringes the Regulation or another data protection provision, we will say so and will not carry it out until it is clarified.

We do not transfer data outside the European Economic Area. If that ever becomes necessary, we will seek your agreement first and it will rest on an approved legal basis.

Confidentiality

Anyone on our side with the technical ability to see your data is bound in writing by a duty of confidentiality, which survives the end of their engagement with us.

That ability is granted only to those who need it to run or maintain the service, and only to the extent they need it.

We disclose your data to no one else, unless the law requires it. In such a case we inform you, where we are permitted to.

Security

We take the technical and organisational measures required by Article 32, based on the risk — and the risk here is elevated, because the data concerns minors.

Encryption of traffic to the browser and to the database. Encrypted storage of the service's secrets. Passwords held only as an irreversible fingerprint.

Strict separation of data by school, enforced by the server on every request. Identity and permission checks before every access.

An action log recording every change to data, with the user and the moment it happened.

Regular backups, tested for restoration, with a limited lifetime.

The measures are reviewed and may change, provided the level of security is not lowered.

Sub-processors

You give us your general authorisation to use sub-processors for hosting, the database, file storage, sending email and logging technical errors.

All are inside the European Union and are bound by a contract imposing on them the same data protection obligations we undertake here.

Towards you we remain fully responsible for their acts and omissions, as if they were our own.

If we wish to add or replace a sub-processor, we notify you in good time and before the change. You may object on reasoned grounds; if no solution is found, you may terminate the subscription and receive back the proportionate prepaid amount.

The current list of sub-processors is given to you whenever you ask for it.

Requests from the people the data concerns

If a guardian, student or employee approaches us about data that falls under your processing, we do not answer: we refer them to you and inform you without delay.

We assist you by appropriate technical means to respond to requests for access, rectification, erasure, restriction, portability and objection.

The application gives you the tools to answer most cases yourself — a copy of the data, correction, deletion. Where they are not enough, we do it at your request.

Security incidents

We notify you without undue delay from the moment we become aware of an incident affecting your data.

The notification includes what we know: what happened, which categories of data and approximately how many people it concerns, the likely consequences, and the measures we took or recommend.

If we do not know everything at once, we send what we know first and complete it later. We do not wait for the full picture before talking to you.

Notifying the supervisory authority and the people affected is your responsibility as controller. We support you with every piece of information you need, within the deadlines set by law.

Impact assessment and consultation

If you need to carry out a data protection impact assessment, we give you the information we hold about how the service works and the security measures in place.

The same applies if you need to consult the supervisory authority beforehand.

Demonstrating compliance, and audits

We give you all the information you need to demonstrate that we meet the obligations in this text.

You may carry out an audit, yourself or through an auditor who is not a competitor of ours. The audit takes place on reasonable notice, on working days, and without interrupting the service or touching other schools' data.

One audit a year is free of charge. For further audits, or for one requiring substantial preparation, a reasonable cost may be agreed — unless the audit follows a security incident for which we were at fault.

Return and deletion

At the end of the relationship we give you a copy of your data in a machine-readable format.

After the transition period we delete it permanently from the active systems. The backups containing it expire in turn and are not restored selectively.

We retain only what the law expressly obliges us to keep — tax records, for example — and only for as long as it requires.

If you ask, we confirm in writing that the deletion has been carried out.

Liability

The allocation of liability between controller and processor is the one set by the Regulation, and no term here or in the terms of use limits it.

The rights of students, guardians and staff against either of us remain intact, whatever we agree between ourselves.

Changes to this text

If something material changes, we tell you by email at least one month before it takes effect, and you may terminate if you do not agree.

The date at the top shows when this text last changed.