Nexier School Data Processing Agreement
1. Parties instructions and applicability
This DPA applies only where the customer/controller identified in an executed ENT-02 instructs SMARTEDTECH SL as processor for Nexier School. For the operator's own account, billing, security or statutory purposes it may instead be a controller. Independent providers/institutions remain responsible for their own processing. Annex A must identify subject matter, duration, nature, purpose, data categories, data subjects, controller instructions and permitted locations before processing starts. No blank annex authorizes unrestricted processing.
2. Documented purpose and confidentiality
The processor acts only on documented instructions, including transfers, unless binding law requires otherwise; it informs the controller of that requirement where legally permitted. It promptly flags an instruction it reasonably considers unlawful. Only personnel needing access are authorized, trained and bound by confidentiality. No advertising, onward sale, unrelated model training, cross-platform enrichment or private data publication follows from this DPA.
3. Security and authorized access
Use risk-appropriate measures under Article 32 documented in Annex B: tenant isolation/RLS, least privilege and MFA for privileged access, encryption and key management where actually implemented, secrets masking, patch/vulnerability handling, tested restore and recovery, scoped integrations, upload controls, incident escalation and proof integrity. These are contractual requirements to be evidenced, not a certification that every measure has already passed. Explain and correct material deviations before production processing. No private content is written into immutable consent logs; use minimized references and lawful retention.
4. Subprocessors and transfers
Annex C identifies every actual subprocessor, purpose, location, data access and approval basis. Under general written authorization notify intended additions/replacements and allow a reasonable agreed objection process; resolve or stop the affected processing if lawful safeguards cannot be agreed. Impose equivalent processing duties and remain responsible as required by Article 28. Restricted transfers require the actual valid instrument and assessment in DAT-02. A vendor logo or API setting is not an executed DPA or transfer safeguard.
5. Rights and incidents
Assist the controller with data-subject requests using proportionate authentication and scoped search/export/correction/deletion. Do not independently decide the response unless authorized or required by law. Notify the controller of a personal-data breach without undue delay after awareness, with available facts, categories/approximate numbers, likely effects, mitigation and contact. Supply staged updates and preserve relevant evidence; do not wait for a perfect report. The controller's 72-hour supervisory notification duty is distinct from processor notification and does not automatically attach to every security alert. Parties coordinate affected-person notifications without blocking statutory deadlines.
6. Assessments audit and authorities
Provide information reasonably necessary for Article 28 compliance, relevant security evidence, assistance with DPIAs and prior consultation, and proportionate audits/inspections subject to confidentiality, security and others' rights. Limit access to relevant data; never demand raw secrets or unrelated tenants' records. Statutory regulator access is preserved. Do not refuse essential audit cooperation merely because a certificate is unavailable.
7. End of service and retention
At the controller's choice return or delete personal data and existing copies at end of the instructed service, unless binding law requires particular retention. Agree actual export format, timing, backup expiry and deletion verification in Annex D. Restrict any legally held records to the specific purpose and duration. The append-only proof requirement does not authorize retaining identifiable content forever; minimize or cryptographically separate payloads consistent with approved law and technical design.
8. Execution annexes
Annex A uses the service/subject/purpose fields in ENT-02; Annex B is the evidence-backed TOMs list; Annex C is the actual recipients/location/change-notice register; Annex D states retention/export/deletion and incident contacts. They remain missing facts until completed from the tenant/service configuration. Sign by the actual controller and processor. Statutory processing obligations and mandatory rights take precedence over inconsistent commercial terms.
Platform-specific terms
Data roles
1. Platform data. The Operator is the controller of personal data processed to operate the platform: account, identity verification, acceptance records, payments, security, support, communications and analytics.
2. Provider supply data. Where a provider supplies services to a customer through the platform, the provider is an independent controller of the data it needs for that supply (booking, order, clinical, educational or professional records), and the Operator is a controller of the platform-level record of the transaction. Each party complies with its own obligations; neither acts for the other.
3. Processor services. Where the Operator processes personal data on behalf of a business customer under the customer's instructions (for example an enterprise tenant's employee data), the Data Processing Agreement (DAT-01) applies and governs; it is signed as part of the order.
4. Sharing between SET platforms. Personal data is not shared with any other platform operated by the Operator or its group unless you enable the specific destination in your settings. Enabling one destination does not enable others, and you may disable it at any time.
5. International transfers. Personal data is stored in the European Economic Area (or, for wellbridge.uk, the United Kingdom). Where a processor outside those areas is used, the transfer is covered by Standard Contractual Clauses or the UK Addendum/IDTA, listed in the subprocessor annex.
---