Data Processing Agreement

This DPA is between the School (the Controller) and PublicTech Solutions, operator of Student Wayfinder (the Processor). It applies whenever we process personal data on the School's behalf under a School Subscription. We remain an independent controller for our own business records, such as billing contacts and correspondence with school staff, as described in the Privacy Policy.

Terms such as personal data, processing, data subject, personal data breach and supervisory authority have the meanings given in the UK GDPR and the Data Protection Act 2018.

• Subject matter: provision of the Student Wayfinder careers discovery platform, including the personality test, careers results and the AI careers assistant.
• Duration: for the term of the School Subscription, plus the retention periods set out in clause 8.
• Nature and purpose: hosting, storage, access control, generating personality and careers results, delivering AI assistant responses, safeguarding moderation, support and service administration.
• Types of personal data: student name or identifier, school and year group, account email where provided, personality test answers and results, chat messages with the AI assistant, safeguarding incident records, and technical logs such as IP address and timestamps.
• Categories of data subjects: students (typically aged 11 to 18) and school staff users.
• Special category data: not required and not requested. Free-text chat may unintentionally contain sensitive information; the platform is designed to discourage this and safeguarding moderation applies.

• We process personal data only on the School's documented instructions, which include the Terms, this DPA and use of the platform's features, unless required otherwise by law (in which case we will inform the School unless legally prohibited).
• We will inform the School if, in our opinion, an instruction infringes UK data protection law.
• Personnel authorised to process personal data are bound by confidentiality obligations and access is limited to what is necessary for their role.
• We do not sell personal data and do not use student personal data to train third-party AI models.

Taking into account the state of the art, cost and the risks to data subjects, we implement appropriate technical and organisational measures, including:

• encryption of data in transit using TLS and encryption at rest by our hosting provider;
• row-level security so that a school's records are only accessible to that school's authorised users;
• role-based access control and multi-factor authentication for administrator accounts where supported by the underlying platform;
• audit logging of administrative and safeguarding actions;
• regular dependency vulnerability scanning and patching;
• backups with procedures intended to enable restoration of availability after an incident;
• safeguarding moderation of AI assistant input and output to block restricted content for under-18 users.

The School gives general authorisation for the sub-processors listed below. We remain liable for their performance. We will give the School at least 30 days' notice before adding or replacing a sub-processor, and the School may object on reasonable data protection grounds; if we cannot resolve the objection, the School may terminate the affected part of the subscription without penalty for the unused period.

• Lovable Cloud (application hosting, database, authentication and storage).
• Google Ireland Limited and Google LLC (AI model processing for the careers assistant).
• Stripe Payments Europe, Ltd. (payment processing — school billing contacts only, no student data).
• Resend (transactional email delivery — staff contacts and system notifications).

Personal data is primarily hosted in the UK or European Economic Area. Where a sub-processor processes personal data outside the UK, we rely on an Article 46 UK GDPR transfer mechanism, which may include the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

• Data subject rights: we will notify the School without undue delay if we receive a request from a student or parent, and provide reasonable assistance so the School can respond within statutory timescales. Schools can also export and delete records directly from the school dashboard.
• Personal data breach: we will notify the School without undue delay and in any event within 48 hours of becoming aware, with the information available to us, and provide reasonable assistance with the School's own notification duties.
• DPIAs and consultation: we will provide reasonable assistance with data protection impact assessments and prior consultation with the ICO, taking into account the information available to us.

On termination or expiry of the subscription, and at the School's choice, we will delete or return personal data processed on the School's behalf and delete existing copies within 30 days, unless UK law requires continued storage. Individual accounts deleted during the term follow our 30-day soft-delete and hard-delete cycle. Safeguarding incident records may be retained for longer where necessary to comply with legal obligations or to protect a child, and this is documented on request.

We maintain records of processing carried out on the School's behalf and will make available information reasonably necessary to demonstrate compliance with Article 28 UK GDPR. Audits are satisfied in the first instance by written responses and available documentation; on-site audits may be requested no more than once a year, on 30 days' notice, at the School's cost, and must not disrupt the service or the confidentiality of other customers.

Liability under this DPA is subject to the limitations and exclusions in the Terms. This DPA takes effect when the School's subscription starts, or on the date of signature if a countersigned copy is executed, and continues for as long as we process personal data on the School's behalf. It is governed by the laws of England and Wales.

Data protection enquiries, DPA requests and breach queries: support@studentwayfinder.org. Student Wayfinder is operated by PublicTech Solutions, registered with the UK Information Commissioner's Office (ICO) under registration number ZC207694.