Data Processing Agreement

Version 1.0 — August 2025

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller: The school or educational institution named in the Order Form or subscription ("School"), acting as the data controller in respect of student and staff personal data.
• Data Processor: CSZone ("CSZone", "we", "us"), the operator of CSZone.co.uk, acting as a data processor on behalf of the School.

This DPA supplements and forms part of the CSZone Terms of Service (cszone.co.uk/terms). In the event of any conflict between this DPA and the Terms of Service regarding data protection matters, this DPA shall take precedence.

2. Definitions

In this DPA, the following terms have the meanings given below, consistent with UK GDPR and the Data Protection Act 2018:

• "Personal Data" — any information relating to an identified or identifiable natural person.
• "Processing" — any operation or set of operations performed on Personal Data.
• "UK GDPR" — the General Data Protection Regulation as it forms part of domestic law in the United Kingdom pursuant to the European Union (Withdrawal) Act 2018.
• "Sub-processor" — any third-party data processor engaged by CSZone to process Personal Data on the School's behalf.
• "Supervisory Authority" — the Information Commissioner's Office (ICO) in the United Kingdom.

3. Subject matter and duration

CSZone processes Personal Data on behalf of the School for the purpose of delivering the CSZone platform — including student lesson progress tracking, mock paper attempts and scores, teacher class management, and related administrative functions.

This DPA comes into effect when the School first registers students or teachers with CSZone and remains in force for the duration of the School's active subscription. Upon termination, the provisions of Clause 9 (Return and deletion) apply.

4. Nature and purpose of processing

CSZone processes Personal Data on the School's documented instructions (including those in the Terms of Service and this DPA) for the following purposes:

• Authenticating students and teachers and maintaining their accounts
• Recording and displaying lesson completion progress to the student and their teacher
• Storing mock paper attempt data and scores for teacher review
• Enabling teachers to manage class membership and view class progress
• Sending transactional emails (account setup, password reset) on the School's behalf
• Providing platform support and resolving technical issues

CSZone will not process Personal Data for any purpose beyond those described above without prior written instruction from the School, except where required by law.

5. Types of personal data processed

• Student full name
• Student email address
• Lesson progress data (which lessons have been marked complete)
• Mock paper attempt records and scores
• Class membership (which teacher the student is assigned to)
• Teacher full name and email address
• Teacher-authored class notes (where used)

CSZone does not process special category data, sensitive personal data, or payment card data for students. Subscription billing for the School is handled by Stripe and governed by their terms separately.

6. Categories of data subjects

• Students enrolled under the School's licence (typically aged 14–18)
• Teachers and school staff with a CSZone teacher account

7. Obligations of CSZone as processor

CSZone shall:

• Process Personal Data only on the documented instructions of the School, except where required by applicable law
• Ensure that all personnel authorised to process Personal Data are subject to binding confidentiality obligations
• Implement appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access (see Clause 10)
• Not engage any new Sub-processor without prior written notification to the School and an opportunity for the School to object
• Assist the School in meeting its obligations regarding data subject rights requests (access, rectification, erasure, restriction, portability) by providing the necessary technical means
• Assist the School in meeting its obligations under Articles 32–36 of UK GDPR (security, breach notification, DPIAs, prior consultation)
• Notify the School without undue delay (and in any event within 72 hours of becoming aware) of any Personal Data breach affecting School data
• Make available to the School all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the School or an auditor mandated by the School
• Delete or return all Personal Data to the School at the end of the provision of services, in accordance with Clause 9

8. Sub-processors

The School provides general authorisation for CSZone to engage the following Sub-processors, each of which is bound by data protection obligations equivalent to this DPA:

• Supabase Inc. — database, authentication, and file storage. Data stored on EU-based servers (Frankfurt). Supabase Privacy Policy
• Netlify Inc. — website hosting and serverless function execution. DPA available at netlify.com
• Anthropic PBC — AI-assisted mock paper marking. Student answers are transmitted for processing but are not stored, used for model training, or retained beyond the immediate request. Data is transferred to the US under Anthropic's standard contractual clauses. Anthropic Privacy Policy
• Google LLC (Google Fonts) — font delivery via CDN. No student Personal Data is transmitted to Google through font loading.
• Google LLC (Google Analytics 4) — anonymised usage analytics to understand how visitors use the platform. Analytics cookies are only set after a user has explicitly accepted via the cookie consent banner; Google Analytics is blocked by default on first visit and when consent is declined. Data collected includes page views, session duration, and general device/browser type — it does not include student answers, progress data, or identifiable personal information beyond approximate IP geolocation (anonymised by Google). Data is transferred to the United States under Google's standard contractual clauses. Google Privacy Policy · Google Ads Data Processing Terms

CSZone will notify the School of any intended changes to this list (additions or replacements) with at least 14 days' notice, giving the School the opportunity to object. If the School objects and no reasonable alternative can be agreed, either party may terminate the subscription with written notice.

9. Return and deletion of data

Upon expiry or termination of the School's subscription, or upon written request by the School at any time, CSZone will:

• Permanently delete all Personal Data associated with the School's students and teachers from CSZone systems within 30 days
• Confirm deletion in writing upon request
• Retain anonymised, non-attributable aggregate statistics (e.g. total lessons completed across the platform) which cannot be used to identify individuals

Where deletion is requested before subscription expiry, affected student accounts will immediately lose access to the platform.

10. Security measures

CSZone implements the following technical and organisational measures:

• Encryption in transit: all data is transmitted over HTTPS/TLS. HTTP connections are redirected to HTTPS.
• Encryption at rest: database and authentication data is encrypted at rest by Supabase.
• Access control: role-based access control (student, teacher, school admin, platform admin) is enforced server-side. Students cannot access other students' data.
• Authentication: secure authentication is provided by Supabase Auth including hashed password storage and email verification.
• Server-side secrets: API keys (Supabase service key, Anthropic key, Stripe key) are held server-side in Netlify environment variables and are never exposed to client browsers.
• Security headers: HTTP security headers (X-Frame-Options, X-Content-Type-Options, HSTS, Content-Security-Policy, Permissions-Policy) are applied to all responses.
• Incident response: in the event of a suspected breach, CSZone will notify affected schools within 72 hours of becoming aware.

11. Data transfers outside the UK

Most data is stored within the EU (Supabase, Frankfurt). Where data is transferred to the United States (Netlify CDN, Anthropic for AI marking, Google Analytics), appropriate transfer safeguards are in place:

• Netlify maintains a Data Processing Addendum incorporating standard contractual clauses
• Anthropic processes mock paper answers under US-UK standard contractual clauses; data is not retained beyond the immediate API request
• Google Analytics (Google LLC) processes anonymised usage data under Google's standard contractual clauses. Analytics cookies are only set with explicit user consent; no student Personal Data as defined in this DPA is transmitted to Google Analytics

12. Liability and indemnity

Each party shall be liable to the other for any damage suffered as a result of that party's failure to comply with its obligations under this DPA. CSZone's total liability under this DPA (whether in contract, tort, or otherwise) shall not exceed the amounts paid by the School in the 12 months preceding the event giving rise to the claim.

13. Governing law

This DPA is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Amendments

CSZone may amend this DPA to reflect changes in applicable law or sub-processor arrangements. Schools will be notified of material changes with at least 30 days' notice. Continued use of the platform after this period constitutes acceptance of the updated DPA.