Data Processing Agreement

// alevelmathrevision.com (Processor) ↔ School (Controller) · UK GDPR + EU GDPR aligned · v1.0 · Feb 2026

Print / Save as PDF Request a signed & countersigned copy Back to Schools page

How to use this DPA. Schools with a Data Protection Officer (DPO) can review this template as an initial position paper before contract. alevelmathrevision.com is happy to sign it as-is, or to accept the school's standard DPA if provided (subject to review). Where fields are marked [LIKE THIS], the school should complete them on execution.

1. Parties & role

This Data Processing Agreement ("DPA") is entered into between:

The Controller — [School legal name, address, ICO/DPA registration number], acting as data controller in relation to student and staff personal data processed via alevelmathrevision.com.
The Processor — Peter Bromfield trading as alevelmathrevision.com, registered address: [registered address], contact: pbromfield@alevelmathrevision.com, acting as data processor.

This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the Controller's licence to use the alevelmathrevision.com platform ("the Service").

2. Subject-matter and duration of processing

The Processor processes personal data solely to deliver the contracted Service for the duration of the school's licence period, plus a retention tail of 30 days after termination during which the Controller may request data export.

3. Nature and purpose of the processing

Authenticate students, teachers, and administrators.
Record and display each learner's own progress (streaks, revealed mark schemes, checklist ticks, Path-to-A* progress).
Enable teachers to view aggregate class progress and assign homework across UK 9MA0 and IAL boards.
Send transactional emails (weekly digests, homework notifications, receipts).
Detect abuse and enforce rate limits.

4. Categories of data subjects and personal data

Category of data subject	Categories of personal data
Students enrolled by the school	Name (if provided), school email address, class assignments, per-question attempts and scores, streaks, revealed-scheme records, Path-to-A* progress.
Teachers & administrators	Name, email, role, homework assignments authored, class-management events.
The school’s finance contacts (only when the school pays by invoice)	Name and email of the finance or accounts payable contact and of an optional copy-to recipient, with the school’s legal name, billing address, PO number and VAT number or GSTIN, if given. Kept as long as needed for accounting and tax records.

5. Sub-processors

The Controller authorises the Processor to engage the following sub-processors, each bound by contractual obligations at least equivalent to this DPA:

Sub-processor	Service	Region
Google LLC (Firebase / Cloud Functions / Firestore / Firebase Auth)	Application hosting, authentication, database, serverless functions	Cloud Functions: us-central1 (United States), a few in europe-west1 (Belgium). Firestore, Firebase Auth and Hosting: Google Cloud locations, which may include the United States.
Google LLC (Cloud Storage)	PDF and asset storage	Google Cloud locations, which may include the United States.
Stripe Payments Europe Limited	Card processing for licence purchases (GBP); issuing and emailing invoices when the school pays by invoice	Ireland / EU
Resend Inc.	Transactional email delivery (receipts, homework notifications)	United States (bound by SCCs — see Section 8)
Google LLC (Gemini API)	AI grading and content-generation. Payloads contain student submissions but no name/email; requests are non-retained per Google's terms.	United States (bound by SCCs — see Section 8)
Emergent (emergentagent.com)	Storage for uploaded files (photos of written work, class handouts, marked work)	To be confirmed by the Processor on request
Crisp (crisp.chat)	Live chat, loaded only when a user presses “Chat with us”; stores the messages and any email address the user gives	To be confirmed by the Processor on request
ipapi.co	Approximate location (country and city) of a visitor's internet connection, only after the visitor accepts analytics cookies; no coordinates or account ID are stored	To be confirmed by the Processor on request

The Processor will give the Controller at least 30 days' written notice of any change in sub-processors.

6. Obligations of the Processor

Process personal data only on documented instructions from the Controller.
Ensure that persons authorised to process the personal data are subject to appropriate confidentiality obligations.
Take all technical and organisational measures required under Article 32 UK/EU GDPR (see Section 7).
Assist the Controller with data-subject requests and DPIAs.
At the choice of the Controller, delete or return all personal data at the end of the Service.
Notify the Controller without undue delay after becoming aware of a personal data breach.

7. Technical and organisational measures (Article 32)

Encryption in transit — TLS 1.2+ on every endpoint; HSTS enforced.
Encryption at rest — Firestore documents and Cloud Storage objects are encrypted at rest using Google-managed keys.
Access control — Firestore Security Rules restrict reads and writes; owner/school-admin escalation is server-side.
Backups — daily Firestore automatic backups retained for 30 days.
Logging — admin access is logged with actor email and timestamp; retained for at least 12 months.
Rate limiting & abuse controls — per-user quotas on write endpoints.
Vulnerability management — dependencies audited on every build.

8. International transfers

Where personal data is transferred to a sub-processor outside the UK/EEA (including Google's Cloud Functions in us-central1 and other Google Cloud services located in the United States, Resend Inc. and Google Gemini API), transfers are safeguarded by the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum (IDTA).

9. Data subject rights

Access / portability — export in JSON on written request.
Rectification — direct edit via the student's own account or admin escalation.
Erasure — deletion within 30 days of instruction.
Restriction / objection — pause a student's access via the class-code interface.

10. Personal data breach

The Processor will notify the Controller of a personal data breach without undue delay and in any case within 48 hours of becoming aware.

11. Return or deletion at end of processing

At the Controller's written choice at the end of the licence, and no later than 30 days after termination, the Processor will either return all personal data (JSON) or delete all such personal data and certify deletion in writing.

12. Term, priority, and governing law

This DPA is governed by the law of England and Wales, with non-exclusive jurisdiction of the English courts.

13. Signatures

________________________________________

For the Controller

Name: [full name]
Title: [Head / DPO]
Date: [DD-MM-YYYY]

________________________________________

For the Processor

Name: Peter Bromfield
Title: Founder, alevelmathrevision.com
Date: on execution