Data Processing Agreement

1. Definitions

• 'Controller': The school or academy trust that subscribes to Chapter Schools and determines the purposes and means of processing Student Data.
• 'Processor': Chapter Technologies Ltd, which processes personal data on behalf of the Controller.
• 'Personal Data': Any information relating to an identified or identifiable natural person as defined in UK GDPR Article 4.
• 'Student Data': Personal data relating to students uploaded to or generated within the Platform by the Controller.
• 'Sub-processor': Any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• 'Platform': The Chapter Schools web application and associated services.

2. Scope and nature of processing

2.1 Subject matter

The Processor shall process Personal Data as necessary to provide the Chapter Schools platform, including:

• Storing and displaying student records, career activity, and guidance notes
• Tracking Gatsby Benchmark evidence on behalf of the school
• Generating AI-assisted content (lesson plans, worksheets, summaries) using contextual data
• Sending communications to parents and staff on the Controller's instruction
• UCAS application tracking for sixth form students (where enabled)
• Providing reporting and analytics to authorised school staff

2.2 Categories of data subjects

• Students (including those under 18)
• School staff (careers leads, teachers, administrators)
• Parents and guardians

2.3 Categories of personal data

• Identifiers: names, email addresses, year group, date of birth
• Career exploration data: interests, goals, activities completed, employer encounters
• Educational records: guidance session notes, lesson participation, UCAS application data
• Communication data: email engagement, parent digest interactions
• Special category data: the Processor does not intentionally process special category data (as defined in UK GDPR Article 9). Controllers should not upload special category data to the Platform.

2.4 Duration

Processing continues for the duration of the subscription and for up to 90 days following termination, during which the Controller may export their data.

3. Controller obligations

The Controller warrants that:

• It has the appropriate lawful basis under UK GDPR to share Personal Data with the Processor
• It has provided appropriate privacy notices to data subjects (students, parents, staff)
• It will only upload data that is necessary and proportionate for the purposes of the Platform
• It will promptly notify the Processor of any changes to applicable data protection requirements that may affect processing
• It is responsible for ensuring safeguarding policies are in place regarding the Platform's use with students

4. Processor obligations

The Processor shall:

• Process Personal Data only on documented instructions from the Controller (these Terms and this DPA constitute such instructions)
• Ensure that persons authorised to process Personal Data are committed to confidentiality
• Implement appropriate technical and organisational security measures (see Section 6)
• Not engage Sub-processors without prior written consent (general consent is given for the Sub-processors listed in Section 5)
• Assist the Controller in responding to data subject rights requests within the statutory timeframe
• Notify the Controller of any Personal Data breach within 72 hours of becoming aware of it
• Delete or return all Personal Data upon termination of the subscription, at the Controller's choice
• Provide all information necessary to demonstrate compliance with this DPA and allow for audits (with reasonable notice)

5. Sub-processors

The Controller provides general written authorisation for the Processor to use the following Sub-processors:

• Supabase Inc. - Database hosting and authentication. Data stored in EU (Ireland). supabase.com/privacy
• Cloudflare Inc. - Application hosting and CDN. EU region deployment. cloudflare.com/privacy
• Anthropic PBC - AI text generation and analysis. No persistent storage of Personal Data; content is not used to train models under Anthropic's commercial API terms. anthropic.com/privacy
• OpenAI, L.L.C. - Audio transcription of guidance session dictation performed in the web application only. The Processor's iOS applications transcribe on the device and transmit no audio to this Sub-processor. No persistent storage of Personal Data; content is not used to train models under OpenAI's API terms. openai.com/policies
• Resend Inc. - Transactional email delivery. resend.com/legal/privacy-policy
• Mixpanel, Inc. - Product analytics for the web application, configured against Mixpanel's EU data residency endpoint. Not used in the mobile applications. Does not receive Student Data. mixpanel.com/legal/privacy-policy
• Apple Inc. - Distribution of the Chapter Schools mobile applications via the App Store. Receives no Student Data; provides the Processor with aggregated, anonymised download and crash statistics only. apple.com/legal/privacy

The Processor will notify the Controller of any intended changes to Sub-processors (additions or replacements) with at least 30 days' notice, giving the Controller the opportunity to object.

The Processor shall impose data protection obligations on each Sub-processor equivalent to those in this DPA.

6. Security measures

The Processor implements the following technical and organisational measures:

Technical measures

• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256
• Row-level security (RLS) policies ensuring users can only access their school's data
• Role-based access control with least-privilege principles
• Short-lived JWT authentication tokens (1-hour access tokens)
• HMAC signature verification for webhook integrations
• Regular dependency security audits

Organisational measures

• Access to production data limited to authorised Chapter Technologies Ltd staff
• Staff with data access are subject to confidentiality obligations
• Incident response procedures for Personal Data breaches
• Regular review of security practices

7. International transfers

Personal Data is primarily processed within the UK and EU (Supabase EU region, Cloudflare EU region, Mixpanel EU endpoint). Where data is transferred to processors outside the UK/EEA (including Anthropic and OpenAI in the United States), the Processor ensures appropriate safeguards are in place via UK International Data Transfer Agreements (IDTAs) or equivalent mechanisms.

Student Data and AI processing

The Processor does not transmit student names to any AI Sub-processor. Where a feature needs to write about a specific student, the name is replaced with an opaque placeholder before the request leaves the Processor's systems, and the real name is substituted back into the response after it returns. Students are otherwise referenced only by an opaque identifier and year group, and models are instructed never to infer or invent a name, or to infer gender or pronouns.

Two categories of content are the exception, because the Personal Data is contained within material supplied by school staff rather than in a field the Processor constructs:

• Dictation and handwritten note capture - audio recordings and images supplied by the adviser, which may contain any Personal Data the adviser has spoken or written. In the iOS applications, dictation is transcribed on the device using Apple's on-device speech recognition and no audio is transferred to any Sub-processor. In the web application, where no on-device equivalent exists, audio is transferred to OpenAI for transcription. Images are transferred to Anthropic for text extraction on both platforms.
• Free text written by staff or students - an existing reference draft, a personal statement, or session notes may mention a student by name in prose. The Processor does not attempt to scrub names from free text, because doing so reliably enough to avoid corrupting the document is not achievable.

In every case the transfer is initiated by a deliberate action of a member of school staff, the content is used solely to generate the response returned to that user, no Sub-processor retains it beyond the limited abuse-monitoring periods in its API terms, and no Sub-processor uses it to train models. The Processor keeps this position under review and will narrow it further wherever a feature can be re-engineered to work without identifiable data.

8. Data subject rights assistance

The Processor shall provide the Controller with reasonable assistance in fulfilling data subject rights requests (access, rectification, erasure, restriction, portability, objection). Where a data subject contacts the Processor directly, the Processor will redirect them to the Controller within 5 business days.

9. Data breach notification

In the event of a Personal Data breach involving Controller data, the Processor will:

• Notify the Controller without undue delay and within 72 hours of becoming aware
• Provide details of the nature of the breach, categories and approximate number of data subjects affected, and the data records concerned
• Describe the likely consequences and measures taken or proposed to address the breach

10. Termination and data deletion

Upon termination of the subscription, the Controller may export all data via the Platform's export tools within 30 days of termination. Following this period, all Personal Data will be securely deleted from the Processor's systems and Sub-processors within 60 days, except where the Processor is required to retain data by law (e.g., financial records).

Upon request, the Processor will provide written confirmation of deletion.

11. Governing law

This DPA is governed by the laws of England and Wales and shall be interpreted in accordance with UK GDPR and the Data Protection Act 2018.

12. Contact and signed copies

Schools wishing to receive a countersigned copy of this DPA for their records should contact us at:
Email: hello@chapterschools.com
Subject line: DPA Request - [School Name]

By subscribing to the Chapter Schools platform, the Controller accepts and agrees to the terms of this DPA as incorporated into the Terms of Service.