Data Processing Agreement

"Controller" means the School identified in the subscription agreement, which determines the purposes and means of the processing of Personal Data.

"Processor" means Igloo Labs, which processes Personal Data on behalf of the Controller.

"Data Protection Laws" means the UK General Data Protection Regulation (UK GDPR) as retained by the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any successor legislation.

"Data Subject" means an identified or identifiable natural person whose Personal Data is processed under this Agreement, being teachers, school staff, and pupils as described in Appendix 1.

"Personal Data" means any information relating to a Data Subject as defined by the Data Protection Laws, processed by the Processor on behalf of the Controller under this Agreement.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

"Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

"Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

"Services" means the Spell & Grow for Schools service, including the teacher portal, mobile application school features, and associated infrastructure as described in the subscription agreement.

Teachers and school staff: Individuals employed by or engaged by the Controller who use the teacher portal to manage spelling lists and monitor pupil progress.

Pupils: Children aged 4 to 13 who are enrolled at the Controller's school and whose profiles have been linked to a school class by a parent or guardian.

5.1 The Processor shall process Personal Data for the duration of the subscription agreement between the Controller and the Processor.

5.2 Upon termination or expiry, the Processor shall handle Personal Data in accordance with Section 13 (Termination and Data Return/Deletion).

5.3 Pupil progress data from previous academic years shall be retained for 12 months following the end of the academic year in which it was created, after which it shall be automatically deleted unless the Controller requests earlier deletion.

7.1 The Processor shall implement and maintain appropriate technical and organisational security measures, including at a minimum:

1. Encryption of Personal Data in transit using TLS 1.2 or higher;
2. Encryption of Personal Data at rest using AES-256;
3. Access controls including role-based access, multi-factor authentication for infrastructure access, and principle of least privilege;
4. Regular security updates and vulnerability patching;
5. Row-level security policies ensuring data isolation between schools;
6. Regular backups with point-in-time recovery capability;
7. Logging and monitoring of access to Personal Data; and
8. Staff training on data protection and information security.

7.2 Full details of security measures are provided in Appendix 2.

9.1 The Processor shall notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a Personal Data Breach.

9.2 Such notification shall include, at a minimum:

1. A description of the nature of the breach, including categories and approximate number of Data Subjects and records concerned;
2. The name and contact details of the Processor's data protection contact;
3. A description of the likely consequences; and
4. A description of the measures taken or proposed to address the breach.

9.3 The Processor shall cooperate with the Controller in the investigation, mitigation, and remediation of each breach.

9.4 The Processor shall document all breaches and make such documentation available to the Controller upon request.

11.1 The Processor shall not transfer Personal Data outside the United Kingdom or the European Economic Area without the prior written consent of the Controller.

11.2 As at the date of this Agreement, all Personal Data is processed and stored within the United Kingdom (AWS eu-west-2, London).

11.3 Where a sub-processor processes data outside the UK/EEA (for example, ElevenLabs for audio generation), the Processor ensures that only non-personal data is transmitted — specifically, word and sentence text only, with no pupil or teacher data.

13.1 Upon termination or expiry of the subscription agreement, the Processor shall:

1. Cease all processing of Personal Data on behalf of the Controller;
2. Within 30 days, make available a complete export of all Personal Data in a structured, commonly used, and machine-readable format (CSV);
3. Following confirmation of receipt by the Controller, or after 30 days if no confirmation is received, securely delete all Personal Data from all systems including sub-processors; and
4. Provide written confirmation that all Personal Data has been deleted.

13.2 The Processor shall not be required to delete Personal Data where retention is required by applicable law, provided that the Processor informs the Controller and ensures confidentiality of the retained data.