Data Processing Agreement

Last updated: [DATE]

This Data Processing Agreement forms part of the agreement between your school (the Data Controller) and CurriculumHub (the Data Processor) whenever we process personal data on your behalf. Schools and Trusts requiring a signed copy for procurement should contact us at hello@curriculumhub.co.uk.

1. Roles

The school decides what staff data is entered into CurriculumHub and why (Data Controller). CurriculumHub processes that data only to provide the service, on the school's instructions (Data Processor).

2. Subject matter, duration, and nature of processing

Subject matter: provision of a curriculum planning and organisation platform.
Duration: for as long as the subscription is active, plus any agreed retention period after termination.
Nature and purpose: storing and displaying curriculum data entered by school staff; authenticating logins; enabling account administration.

3. Categories of data subjects and personal data

Data subjects: school staff members invited as CurriculumHub users. No pupils are data subjects under this agreement — CurriculumHub does not process, store, or have any function for pupil data.

Categories of personal data: staff name, staff email address, login credentials (hashed, never stored in plain text). No special category data is knowingly processed.

4. Instructions

CurriculumHub only processes personal data in accordance with the school's documented instructions, deemed to be: providing the CurriculumHub service as described in the subscription agreement.

5. Confidentiality

Anyone with access to school data is subject to confidentiality obligations.

6. Security measures

Row Level Security at the database level, so one school's data cannot be accessed by another
Authentication via Supabase Auth with industry-standard password hashing
Data hosted in London, UK (AWS region eu-west-2)
Access to production data restricted to the platform operator

7. Sub-processors

Sub-processor	Purpose	Location
Supabase	Database hosting, authentication	eu-west-2 (London, UK)
Vercel	Application hosting	[confirm region]

Schools will be notified of any intended change to sub-processors, with the opportunity to object on reasonable data protection grounds.

8. Data retention and deletion

On termination, CurriculumHub will provide an export of the school's data and/or delete all school data within 30 days, unless retention is required by law.

9. Assistance and breach notification

CurriculumHub provides reasonable assistance with data subject rights requests. In the event of a personal data breach affecting school data, we will notify the school without undue delay and within 72 hours of becoming aware of it.

10. International transfers

Personal data is stored in the UK and is not transferred internationally. Should this change, schools will be notified and appropriate safeguards put in place first.

11. Audit

Schools may request reasonable evidence of compliance with this DPA. On-site audits are not offered given the scale of the service, but we will respond to reasonable written questions.

12. Liability

Liability under this DPA is subject to the limitations set out in our Terms of Service.