Data Processing Agreement

Terms used in this DPA have the same meaning as in applicable data protection law, including the UK GDPR, EU GDPR and Swiss FADP where relevant. "Personal Data", "Controller", "Processor", "Processing", "Data Subject" and "Personal Data Breach" are used as defined in the applicable law.

"Provider" means Cross Sword Limited, trading as LearnStudio, which provides the ATL Portfolio service. "School Personal Data" means Personal Data processed by the Provider on behalf of the School through ATL Portfolio.

Within those documented purposes, processing may include:

• Enabling students to document and reflect on ATL evidence.
• Enabling authorised teachers to view School student evidence and provide assessment and feedback according to the School's workflow.
• Generating student, cohort, programme and School reports/analytics from the School's own data.
• Providing messaging, notifications, data-rights support and account administration.
• Operating, securing, supporting and maintaining the contracted Platform.
• Providing optional AI-assisted features requested by authorised users, subject to the documented safeguards and subprocessor arrangements.

• Identification data: name and school email address.
• Profile data: programme, year group, class, role.
• Educational content: ATL evidence, reflections, self-assessments, media uploads.
• Assessment data: proficiency levels, teacher feedback, reports.
• Technical/operational data associated with the School service: account identifiers, access/audit records and notification-routing information.
• School communications and support data: messages, notifications, data-rights request information and support/feedback content where used.
• AI-assisted feature inputs/outputs where an authorised user chooses to invoke an AI feature; reviewed prompts minimise direct identifiers, but user-entered free text may itself contain personal data.

• Students enrolled in the School's IB programmes.
• Teachers and coordinators employed by the School.
• School administrators, programme leaders and other authorised School staff.

Taking into account the state of the art and the risks, we implement appropriate technical and organisational measures, including:

• Encryption in transit (HTTPS / TLS) and provider-managed encryption at rest.
• Role-based access control and row-level security at the database layer.
• School data isolation — no cross-school access.
• Domain-based authentication and session token expiry.
• Access restricted to authorised operational roles and support purposes.
• Security review, maintenance and patching appropriate to the service and identified risk.

Personnel with access to personal data are bound by confidentiality obligations and only granted access where necessary for their role. Platform-level access is restricted to operational support and is never used to share data between Schools.

The School gives general written authorisation for the Provider to engage the subprocessors required to deliver the Platform, subject to the safeguards in this section. We engage the following categories of sub-processor to deliver the Platform:

A current subprocessor register is maintained from our direct providers and their disclosures and is available to Schools for due diligence. Where required by applicable law, we will provide notice of intended additions or replacements so the School has an opportunity to object on reasonable data-protection grounds.

We require subprocessors processing School Personal Data on our behalf to be bound by data-protection obligations that provide protection appropriate to the processing and, where Article 28 applies, obligations in substance equivalent to those required of us for the delegated processing. We remain responsible to the School for the performance of our subprocessors' data-protection obligations to the extent required by applicable law and the agreement.

The Platform is hosted on Base44-managed infrastructure and may rely on subprocessors operating in more than one jurisdiction. Where an international transfer requires safeguards, the relevant arrangements may rely on adequacy decisions or frameworks, Standard Contractual Clauses (SCCs), the UK Addendum/IDTA, and applicable Swiss adaptations or other recognised safeguards, as appropriate to the transfer.

• Active School data is retained for the duration of the subscription.
• Verified deletion requests are handled in accordance with School instructions and the documented retention schedule.
• Residual backup copies follow the applicable hosting-provider backup and recovery cycle.
• Billing records are retained as required by applicable financial regulation.

Taking into account the nature of the processing and information available to us, we assist the School with data-subject rights and with the School's obligations relating to security, breach assessment/notification, data-protection impact assessments and prior consultation where applicable (including Articles 32–36 GDPR). This includes:

• Subject Access Requests (Article 15) — we assist the School promptly with verified requests for relevant data.
• Rectification and erasure — we action verified requests from the School promptly.
• Data portability — we assist with export in available structured/portable formats appropriate to the relevant data.
• Security and breach obligations — we provide relevant information and assistance reasonably available to us; see section 12.
• DPIA and prior-consultation support — we provide reasonably available processing, security, subprocessor and transfer information needed for the School's assessment.

If a Personal Data Breach affecting School data is confirmed, we will:

• Notify the School without undue delay after becoming aware of a Personal Data Breach affecting School data.
• Provide the nature of the breach, the data affected, the likely consequences and the measures taken.
• Assist the School in meeting any obligation to notify the supervisory authority and affected data subjects.
• Document the breach and the remediation steps.

We will make available information reasonably necessary to demonstrate compliance with the processor obligations in this DPA and applicable data-protection law. The School may conduct, or mandate an independent auditor to conduct, an audit or inspection on reasonable notice where proportionate to the risk and not adequately addressed by current compliance information. Audits are subject to appropriate confidentiality, security, scheduling and non-disruption safeguards. We may satisfy routine assurance requests using current security/compliance documentation where that reasonably demonstrates the relevant control.

On termination of the subscription, at the School's choice and subject to applicable legal retention requirements, we will return and/or delete School Personal Data from active processing in accordance with the documented retention schedule and delete existing active copies under our control. Residual provider backup copies that cannot be selectively removed immediately are protected from ordinary operational use and age out under the applicable hosting-provider backup/recovery cycle. If a backup is restored for disaster recovery, prior valid deletion instructions must be reapplied before the restored data returns to ordinary processing, where technically applicable.