Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the subscribing school (the "School", the controller) and [LEGAL ENTITY NAME] ("Plus Up", the processor). It applies to all personal data the School and its users enter into the Service ("School Data"). Terms such as personal data, controller, processor, data subject and sensitive data have the meanings given in Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates (the "PDPL").

1. Roles and scope

1. The School determines the purposes and means of processing School Data and is the controller. Plus Up processes School Data on the School's behalf and is the processor.
2. This DPA takes precedence over the Terms of Service for anything concerning the protection of personal data.

2. Details of the processing

• Subject matter: operation of the Plus Up school platform for the School.
• Duration: the subscription term plus the retention period in section 8.
• Nature and purpose: storage, organisation, retrieval, display, transmission to authorised users, backup, export and deletion of School Data so that the School can run timetables, attendance, assessment, behaviour and wellbeing records, lesson planning, cover for absent teachers, communication with families, and the records its regulator requires.
• Data subjects: learners (including children), their parents, guardians and other family contacts, teaching and administrative staff, and other people the School records (for example visitors named in a meeting).
• Categories of data: identity and contact details; learners' date of birth, gender, nationality and category; academic records (timetables, attendance, marks, term grades, submitted work); behaviour and wellbeing records; messages and meeting records; staff absences recorded for cover; files uploaded by users; account and audit records; technical logs. Sensitive data: religion of learners (the religion of parents and other family contacts is not collected), medical status, conditions and instructions, special-educational-needs category, and behaviour records.

3. Processor obligations

Plus Up will:

1. Process School Data only on the School's documented instructions. The Terms of Service, this DPA, and the actions the School's authorised users take inside the Service are the School's instructions. Plus Up will inform the School if it believes an instruction infringes the PDPL.
2. Ensure that everyone it authorises to process School Data is bound by confidentiality and trained in data protection.
3. Implement and maintain the technical and organisational measures in Annex B.
4. Not transfer School Data outside the United Arab Emirates and not change the hosting location without the School's prior written agreement and the safeguards the PDPL requires.
5. Engage subprocessors only as set out in section 5.
6. Assist the School, taking into account the nature of the processing, in responding to data subject requests (section 6) and in meeting its obligations on security, breach notification and data protection impact assessments.
7. Notify the School of a personal data breach affecting School Data without undue delay and no later than 72 hours after becoming aware of it, giving the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; and update the School as the investigation progresses.
8. Delete or return School Data at the end of the services as set out in section 8.
9. Make available the information needed to demonstrate compliance with this DPA, and allow and contribute to audits as set out in section 7.
10. Keep a record of the processing activities it carries out on the School's behalf.

4. Controller obligations

The School will: have a lawful basis for the School Data it enters and obtain any consent required from guardians, learners and staff; keep School Data accurate and up to date; give only lawful instructions; manage its users' accounts and roles, record learners and staff who leave, confirm or refuse parents' requests to be linked to learners and remove links that should end, and require its users to keep credentials secure; respond to data subjects; and notify its regulator and data subjects of breaches where the PDPL or the regulator requires.

5. Subprocessors

1. The School authorises the subprocessors listed in Annex C.
2. Plus Up will give the School at least 30 days' written notice before adding or replacing a subprocessor. The School may object in writing on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the School may terminate the affected services and receive a pro-rata refund of prepaid fees.
3. Plus Up imposes data protection obligations on each subprocessor that are no less protective than those in this DPA and remains responsible for their performance.

6. Data subject requests

1. The Service lets the School answer most requests itself: its office and leadership can download a learner's whole record as a file (access and portability) and school-wide lists as spreadsheets, correct records, remove family contacts, and record that a learner has left so that their sign-in stops.
2. A deletion the School cannot carry out itself (for example a learner's complete record) is carried out by Plus Up on the School's written request within 30 days.
3. If a data subject contacts Plus Up directly about School Data, Plus Up will refer the request to the School within 5 working days and will not respond substantively unless the School instructs it to or the law requires it.

7. Audits

Once per year, on at least 30 days' written notice, the School may audit Plus Up's compliance with this DPA, either by reviewing the written security documentation and the results of independent assessments Plus Up makes available, or, where those are insufficient, by an on-site or remote audit conducted by the School or an independent auditor bound by confidentiality, during business hours, without unreasonable disruption, and at the School's cost. An additional audit may follow a confirmed personal data breach.

8. Return and deletion

When the subscription or free trial ends, the School has 90 days to download School Data with the Service's export features or to request a full export (a ZIP file with every record as CSV files), which Plus Up provides within 30 days of the request. Unless the School renews within that period, Plus Up deletes School Data automatically from its live systems at the end of it, including the School's stored files and its audit log, and every remaining copy leaves backups within a further 35 days, unless UAE law requires Plus Up to keep specific records, in which case they are kept only for that purpose and that period.

9. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except that nothing limits liability that cannot be limited under the PDPL.

10. Term

This DPA applies as long as Plus Up processes School Data.

Annex A: Processing on the School's instructions

The School instructs Plus Up to process School Data to provide the features of the Service the School chooses to use, to back it up, to secure it, to support the School's users, and to export or delete it on request. No other purpose is authorised.

Annex B: Technical and organisational measures

• Hosting in Microsoft Azure data centres in the United Arab Emirates: UAE North (Dubai) for the service, the database and file storage, with geo-redundant copies of the database backups and of stored files kept in UAE Central (Abu Dhabi). The database and the virus-scanning service accept connections only from the service's private network.
• Automated daily database backups retained for 14 days and stored geo-redundantly; previous versions of uploaded files retained for 20 days and deleted files recoverable for a further 14 days, so every copy of deleted data is gone within 35 days. Restoring from backup is rehearsed before launch and then every three months, and the result recorded.
• Encryption in transit with TLS and HTTP Strict Transport Security; encryption at rest for the database and file storage; additional field-level encryption for learners' religion, medical details, office notes, behaviour descriptions, meeting notes, messages and family contacts' phone numbers and emails, with keys held in a managed key vault and rotated.
• Logical isolation of every school's data enforced by the database itself (row-level security), so that no query can read another school's rows.
• Role-based access control with eight school roles; a learner's private details open only to the school's leadership and office, the learner's own teachers and their heads of department; least privilege for Plus Up personnel; all administrative access logged.
• Passwords hashed with Argon2id; sign-in throttling and account lockout; two-step verification available to all users and mandatory for Plus Up's platform owners; sessions revocable.
• Every uploaded file validated by type and scanned for malware before it is made available.
• Audit log of significant actions inside each school, including every opening of a learner's private details and every data export, retained for the subscription term and deleted with the School's data.
• Content Security Policy and other browser protections against injection attacks; dependency vulnerability monitoring; security review of every release.
• Documented incident-response and breach-notification procedure.
• Further detail in the Security and Compliance Overview.

Annex C: Subprocessors

• Microsoft Corporation and its affiliates (Microsoft Azure) — cloud hosting, database, file storage and backups — United Arab Emirates (UAE North, Dubai; backups in UAE Central, Abu Dhabi) — all School Data.
• Stripe Payments Europe, Ltd. / Stripe, Inc. — only if the School chooses to pay by card: card payment processing for the School's subscription — payment data of the School's billing contact only; no learner or staff data.

Contact for this DPA: privacy@plusup.net.