Data processing agreement
This agreement applies where FirstDay processes personal data on behalf of a school or group of schools. It forms part of our terms of service and is accepted together with them. Where it conflicts with the terms on how personal data is handled, this agreement takes precedence.
This page is a template awaiting legal review. It describes how FirstDay works today, but it is not yet our final wording. Details marked “to be confirmed” are still being finalised.
Contents13 sections
01Parties and roles
This agreement is between legal name of the company to be confirmed, registered at registered address to be confirmed (the “Processor”, “FirstDay”, “we”), and the school or organisation that accepts it (the “Controller”, “the school”, “you”). It takes effect on effective date to be confirmed, or when the school first accepts it, if later.
For personal data in the platform, the school is the controller and FirstDay is its processor. “UK GDPR” and “EU GDPR” together are “the GDPR”. Terms such as “personal data”, “processing”, “data subject” and “personal data breach” have their GDPR meaning.
02What we process, and why
We process personal data only to provide the platform and its modules to the school, for as long as the school uses them. The details are:
| Item | Detail |
|---|---|
| Subject matter | Providing the FirstDay platform and the modules the school has switched on. |
| Duration | The term of the agreement, and the exit period described below. |
| Nature and purpose | Storing, organising, displaying, sending and deleting the school's records, so the school can run admissions, enrolment, attendance, communication with families, invoicing and the other functions it chooses to use. |
| Data subjects | Prospective and enrolled pupils; their parents, guardians and other contacts; school staff and users; visitors. |
| Types of personal data | Whatever the school records. Typically: names, contact details, addresses, dates of birth, admissions and enrolment records, attendance, assessment and class data, invoices and payment status, messages and uploaded documents, and staff account and working-time details. |
| Special category data | Only if the school records it, for example in the wellbeing, special educational needs or health-related modules. The school decides whether to record it and is responsible for having a lawful basis and an Article 9 condition. |
03Instructions
We process personal data only on the school's documented instructions. This agreement, the terms, and the school's use and configuration of the platform are those instructions. Anything further must be agreed in writing.
We tell the school without undue delay if we think an instruction would infringe the GDPR, and we may pause carrying it out until the school confirms or changes it. If the law requires us to process data in a way the school has not instructed, we tell the school first unless the law forbids it.
The school confirms that its instructions, and its own collection and use of the data, comply with the GDPR and other law that applies to it.
04Confidentiality
Everyone we authorise to process the school's personal data is bound by a duty of confidentiality, and has access only to the extent they need it to provide the platform and support.
05Security
We apply technical and organisational measures appropriate to the risk, as Article 32 GDPR requires. They are described on our security page and include keeping each school's data separate from every other school's, role-based access controlled by the school, an audit log of changes, private file storage opened only through short-lived links, and encryption in transit. Encryption at rest: encryption at rest to be confirmed. Backups: backup and recovery arrangements to be confirmed.
We may update these measures over time, but not in a way that reduces the overall level of protection.
06Sub-processors
The school gives us general authorisation to engage sub-processors. At the date of this agreement they are:
| Sub-processor | What it does for the platform |
|---|---|
| Vercel Inc. | Application hosting; protection of public forms against automated submissions. |
| Neon, Inc. | Database hosting. |
| Cloudflare, Inc. | File storage. |
| Resend | Delivery of email sent by the platform. |
| Trigger.dev | Running scheduled and queued tasks. |
| Stripe | Subscription billing and, where a school enables it, collection of tuition payments. |
| Functional Software, Inc. trading as Sentry | Error monitoring. |
| Anthropic, PBC | Optional AI-assisted features. |
| Expo | Push notifications to the staff mobile app. |
| OpenStreetMap Foundation (Nominatim) | Address and postcode lookup for map and transport features, where used. |
| Optional sign-in with a Google account. |
Notice before a new sub-processor is engaged, or an existing one replaced: notice before a new sub-processor is engaged to be confirmed. The school may object on reasonable data protection grounds; if we cannot resolve the objection, the school may end the affected service without penalty.
We engage each sub-processor under a written contract that imposes the same data protection obligations as this agreement, and we remain responsible to the school for their performance. Sub-processor list status: confirmed sub-processor list to be confirmed.
07International transfers
We transfer personal data outside the United Kingdom and the European Economic Area only on the school's instructions or where this agreement allows, and only with a lawful transfer mechanism in place, such as an adequacy decision, the European Commission's standard contractual clauses or the UK International Data Transfer Addendum. Hosting locations and safeguards: hosting locations and transfer safeguards to be confirmed.
08Helping the school with data subjects' rights
Taking into account the nature of the processing, we help the school respond to requests from data subjects to exercise their GDPR rights, mainly through the tools in the platform for finding, correcting, exporting and deleting records. If a data subject writes to us directly about the school's data, we pass the request to the school and do not respond to it ourselves unless told to.
09Personal data breaches
We notify the school of a personal data breach affecting its data without undue delay after becoming aware of it. Our commitment: breach notification commitment to be confirmed. The notice says what we know about the nature of the breach, the data and data subjects concerned, the likely consequences, and what we are doing about it, and we add detail as we learn it.
The school decides whether to notify its supervisory authority and the data subjects, and we help it do so.
10Other assistance
We help the school meet its obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority (Articles 32 to 36 GDPR), taking into account the information we hold. Reasonable assistance is part of the service; where it needs significant effort beyond it, we agree the cost with the school first.
11Return and deletion
When the agreement ends, the school chooses whether we return its personal data or delete it, and we then delete the remaining copies unless the law requires us to keep them. What happens in practice: data return and deletion on exit to be confirmed.
12Information and audits
We give the school the information it reasonably needs to check that we comply with this agreement, and we allow and contribute to audits, including inspections, by the school or an auditor it appoints. Audits are on reasonable notice, during working hours, limited to what concerns the school's data, and must not expose other schools' data or compromise our security. We may meet an audit request first by sharing relevant independent reports or certifications we hold.
13Liability, law and changes
Each party's liability under this agreement is subject to the limits in the terms: limitation of liability to be confirmed. Nothing here limits a data subject's rights against either party, or liability that cannot lawfully be limited.
Governing law and courts: governing law and jurisdiction to be confirmed.
We may update this agreement when the law changes or the way we process data does, by publishing the new version here and asking the school to accept it again. Questions about it are welcome at privacy contact email address to be confirmed. Data protection officer: data protection officer details to be confirmed.
This is a template awaiting legal review. Clauses that need counsel's wording, in particular liability and governing law, are drawn from the terms and may change.