Data processing agreement

This agreement is between the customer who has accepted TutorMaestry's Customer terms (the controller, "you") and TutorMaestry, of [CONFIRM: address], ICO registration [CONFIRM: ICO registration number] (the processor, "TutorMaestry", "we"). It forms part of the Customer terms and meets the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where it and the Customer terms differ about personal data, this agreement applies.

1. Subject matter and duration

1.1 TutorMaestry processes personal data on your behalf to provide the TutorMaestry service under the Customer terms.

1.2 This agreement lasts for as long as TutorMaestry processes personal data for you: from when you open your account until your data has been deleted under section 12.

2. Nature and purpose of the processing

Hosting, storing, organising, displaying, backing up, transmitting (for example, emails you send or approve) and deleting personal data, and generating documents and drafts from it (invoices, progress reports, and AI-assisted drafts where your plan includes AI and you use it), only so that you can run your tutoring business with TutorMaestry, and providing support when you ask for it.

3. Types of personal data

• Contact details of parents, carers and other payers: names, email addresses, phone numbers, postal addresses.
• Children's data: pupils' names, year groups or levels, subjects, lessons and attendance, session notes, curriculum objectives and progress, reports, check-ins and activity results.
• Financial information: invoices, amounts, payment records and references. Card and bank details are handled by the payment provider you connect, not stored by TutorMaestry.
• Calendar information from a calendar you connect.
• Family portal accounts: login email and a securely hashed password, and messages between families and you where your plan includes messaging.
• Possibly special category data: information about a pupil's health, disability or special educational needs, if you choose to record it (the Learning needs feature). Section 4 applies.
• Information about you and anyone you give an account to: names, emails, roles, and a record of significant actions.
• Anything else you choose to put into free-text fields or upload.

4. Children's data and special category data

4.1 Pupils are often children. You are responsible, as controller, for the lawful basis of processing their data, for telling their parents or carers how it is used, and for considering the ICO's Age Appropriate Design Code (the Children's Code) where a child uses the family portal or the activities.

4.2 Before you record a pupil's health or special educational needs information, you must have a lawful basis and an Article 9 condition for it, which for most tutors means the explicit, written consent of a parent or carer. TutorMaestry's Learning needs feature asks you to confirm consent before any such detail is recorded, and does not send it to the AI.

4.3 TutorMaestry is designed so that a family sees only its own data, the family portal is off until you switch it on and approve each login, and nothing is sent to a family without your action or a standing approval you set.

5. Categories of data subjects

Parents, carers and other payers; pupils (including children); you, your staff and anyone you give an account to; and anyone else whose details you choose to record (for example, an enquirer).

6. Your obligations as controller

You decide why and how personal data is processed, give TutorMaestry lawful instructions, have a lawful basis for the processing, give data subjects the information the law requires, and are responsible for the accuracy of what you put into TutorMaestry. Your use of the service as it is designed, and your configuration of it, are your documented instructions.

7. TutorMaestry's obligations as processor

TutorMaestry will:

1. process personal data only on your documented instructions, including about international transfers, unless the law requires otherwise (in which case we tell you first, unless the law forbids that), and tell you at once if we think an instruction breaks data protection law;
2. ensure that everyone authorised to process the personal data is bound by confidentiality, and that access is limited to what is needed to provide, support and secure the service;
3. take the technical and organisational security measures in the Annex (Article 32);
4. engage sub-processors only as set out in section 9;
5. help you, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights (section 10);
6. help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO (Articles 32 to 36), taking into account the information available to us;
7. delete or return personal data at the end of the service (section 12);
8. make available the information needed to show compliance with Article 28, and allow for and contribute to audits (section 13);
9. not sell personal data, use it for advertising, or combine it with other customers' data;
10. not use customer data to train AI models, and use AI providers only under terms that forbid them from training on it.

8. Confidentiality

TutorMaestry keeps customer data confidential. Today TutorMaestry is operated by a very small team; anyone who later gets access to customer data will be bound by written confidentiality and data protection obligations before they do. Access to a customer's live data happens only when needed to provide support you ask for, to fix a fault, or to keep the service secure, and is kept to the minimum.

9. Sub-processors

9.1 You give TutorMaestry general written authorisation to use the sub-processors listed on the public sub-processor list, reproduced below.

9.2 We will tell you at least 30 days before adding or replacing a sub-processor, by updating the list and showing a notice in the app (and by email where it is set up). You may object on reasonable data protection grounds within that time. If we cannot address your objection, you may end the Customer terms before the change takes effect, and we refund any fees paid for the time after that.

9.3 We impose on each sub-processor, by written contract, data protection obligations that give at least the protection of this agreement, and remain responsible to you for their performance.

Sub-processor	Company	What for	Personal data	Where	When it is used	Transfer safeguard
Fly.io	Fly.io, Inc.	Hosting: runs the application and stores its database and uploaded files	All customer data held in the service	Paris, France (EU)	Always	Held in the EU (UK adequacy regulations). Any access from the US is covered by the provider's DPA with the UK Addendum to the EU Standard Contractual Clauses
Tigris	Tigris Data, Inc.	Off-site backups	Encrypted copies of the database and files. Encrypted before upload; the provider cannot read them	EU storage region	Always	UK Addendum to the EU Standard Contractual Clauses (the provider's DPA); the content is unreadable to the provider
Anthropic	Anthropic, PBC	The AI report writer and assistant	What a feature sends: for a report, a pupil's first name, curriculum objectives and levels and notes the tutor has allowed; for the assistant, what the tutor types. Not used to train AI models	United States	Only on plans with AI, when the tutor uses an AI feature	UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the provider's commercial DPA)
Google	Google LLC	Signing in with Google and calendar sync	The tutor's Google account email; calendar event titles, times and attendees	United States and global	Only if the tutor connects a Google account	UK Extension to the EU-US Data Privacy Framework, and the UK Addendum in Google's DPA
Stripe	Stripe Payments Europe, Ltd. and Stripe, Inc.	Taking subscription payments; card payments from families if the tutor connects Stripe	Billing name, email and payment details (card details go straight to Stripe, never to TutorMaestry); for family payments, the payer's name, email and amount	Ireland (EU) and United States	Paid plans; family payments only if the tutor connects Stripe	UK Extension to the EU-US Data Privacy Framework, and the UK Addendum in Stripe's DPA
GoCardless	GoCardless Ltd	Direct Debit payments from families	The payer's name, email and the amount; bank details are handled by GoCardless directly	United Kingdom	Only if the tutor connects GoCardless	None: processed in the UK
Email delivery	[CONFIRM: email delivery provider]	Sending the emails the tutor sends or approves, and account emails	Recipient address and the email's content	[CONFIRM: location]	When email is set up for the account	[CONFIRM: transfer mechanism, if outside the UK or EU]
Sentry	Functional Software, Inc. (Sentry)	Error monitoring	Technical error details. Configured to send no personal data: no request bodies, no form values, no names or emails, links carrying a secret scrubbed	Frankfurt, Germany (EU)	Always	Held in the EU (UK adequacy regulations); the provider's DPA includes the UK Addendum for any US access

10. Data subject rights

Most requests can be met by you directly in the app: a family's records can be seen, corrected, exported and erased by you. If a data subject contacts TutorMaestry directly, we pass the request to you without undue delay and do not answer it ourselves unless you ask us to. We help you with anything you cannot do in the app.

11. Personal data breaches

11.1 TutorMaestry will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data.

11.2 We give you what we know: what happened, the categories and approximate numbers of people and records affected, the likely consequences, and what we have done or propose to do, and follow it up as we learn more, so that you can decide whether to report it to the ICO within 72 hours and whether to tell the people affected.

11.3 We will not tell the ICO or the people affected about a breach of your data on your behalf without your agreement, unless the law requires it.

12. Deletion or return at the end

12.1 You can export your data at any time from the app. At the end of the service, ask us and we will help you export it.

12.2 After your account is closed, TutorMaestry deletes your instance and the personal data in it within 30 days. Encrypted backups expire on their own rolling cycle and are gone within 10 days after that, as the security overview describes. We confirm deletion in writing on request.

12.3 We keep nothing after that, except where the law requires us to keep something, in which case we keep only that, protected, and only for as long as required.

13. Audits and information

13.1 TutorMaestry makes available to you the information reasonably needed to show compliance with this agreement: this agreement, the security overview, the sub-processor list, and answers to reasonable written questions.

13.2 If that is not enough to show compliance, or the ICO requires it, you (or an independent auditor bound by confidentiality) may audit TutorMaestry's compliance once in any 12 months, on at least 30 days' written notice, at your cost, in a way that does not disrupt the service or reveal other customers' data.

14. International transfers

14.1 Customer data is hosted in the EU (Paris, France), which the UK recognises as giving adequate protection.

14.2 Some sub-processors are in, or may access data from, the United States (see the list above). TutorMaestry transfers personal data outside the UK only with appropriate safeguards under UK GDPR: the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, together with any transfer risk assessment required.

15. Liability

Each party's liability under this agreement is subject to the limits in the Customer terms (section 10), except where the law does not allow liability to be limited. Nothing in this agreement limits either party's direct responsibilities to data subjects or to the ICO under data protection law.

16. Changes and precedence

This agreement changes only as section 12 of the Customer terms describes, with at least 30 days' notice. It is governed by the law of England and Wales.

Annex: technical and organisational security measures

A summary; the security overview describes each in plain words.

• Separation: each customer has their own application instance, database, storage, backup bucket and credentials.
• Encryption in transit: HTTPS only, with HTTP Strict Transport Security; sign-in cookies are marked secure and cannot be read by page scripts.
• Encryption at rest: the hosting provider encrypts storage volumes; stored credentials for connected services (such as a calendar login) are additionally encrypted with a key kept outside the database.
• Encrypted off-site backups: daily when the service is used, encrypted before they leave the server to a key the server does not hold; kept 10 days.
• Access control: sign-in required for everything except deliberately public pages; roles where there are several staff; each family's portal login approved by you and limited to that family's own records; repeated failed sign-ins are slowed and locked out.
• Logging without personal data: no request bodies or form values in logs or error reports; links that carry a secret are scrubbed; a record of significant actions is kept for 12 months.
• Secure development: an automated check suite (including checks that every page needs a sign-in unless intended to be public, and that a family sees only its own data) runs before every release; dependencies are pinned.
• Incident response: breaches handled and notified as section 11 sets out.
• Data minimisation for AI: the report writer receives a pupil's first name, objectives and levels and notes you have allowed, not surnames, contact details or learning-needs information.