Data Processing Agreement

Schools, trusts, local authorities, federations and other customer organisations normally act as controller for the personal data they upload or generate in EduInsight. EduInsight acts as processor when providing the platform and related support services, except where it acts as controller for its own account, billing, security and service administration records.

The processing covers account administration, staff and group management, observations, learning walks, feedback workflows, templates, reports, PDF exports, billing administration, support and security operations.

EduInsight processes customer personal data only on documented customer instructions, including instructions given through platform configuration and authorised user actions.

EduInsight maintains appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.

EduInsight ensures personnel with access to customer data are subject to confidentiality obligations and only access data where necessary for their role.

EduInsight will assist customers, taking into account the nature of processing, with reasonable requests relating to data subject rights, security, deletion, return of data and compliance evidence.

EduInsight may use subprocessors for hosting, database services, file storage, authentication, directory integrations, email delivery, payment processing, analytics necessary for service operation and support tooling.

Subprocessors must support the delivery, security or administration of the service and must be subject to appropriate contractual safeguards.

Where international transfers are relevant, EduInsight uses appropriate safeguards such as adequacy arrangements or approved contractual mechanisms.

At the end of service, customers may request export, deletion or return of customer data, subject to legal, security, backup and accounting retention requirements.

Backup deletion may follow the normal backup lifecycle rather than immediate physical deletion from every backup copy.

DPA questions can be sent to privacy@eduinsightobserve.com.