Data processing agreement

This is the standard data processing agreement for ANAX Schools. It forms part of the Terms of service and applies when the Customer signs an Order Form that refers to them. It is drafted clause by clause against UK GDPR Article 28(3)(a)–(h), and every annex fact below is taken from the system as built. A Customer that needs a signed copy for its records can ask for one (subject line DOCUMENTS, see contact).

Parties

• Controller ("the Customer"): the school, academy trust or college named in the Order Form.
• Processor ("ANAX"): College of Human and Business Efficiency Ltd (company number 13201707), 1-2 Rhodium Point, Hawkinge Business Park, Spindle Close, Hawkinge, Folkestone, Kent CT18 7TQ.

1. Scope and roles

1.1 This Agreement applies to personal data that ANAX processes on behalf of the Customer in providing ANAX Schools: any personal data contained in the Customer's submitted answers and drafts, and any personal data contained in the governance records the Customer keeps on the Register — its register entries, decisions, decision notes, actions, action notes and review records (together "Customer Content"). Annex A describes the processing.

1.2 For the contact details of the people ANAX deals with, the sign-in accounts, memberships and invitations that give people access to the Customer's organisation, hosting and security logs, contractual records, aggregate statistics and the public Decision Passport register, ANAX is an independent controller and the Privacy Notice applies. ANAX determines the assessment method and the pack; the Customer determines whether to submit, what it submits, what it records and who it authorises. If this allocation changes, ANAX will tell the Customer and update this Agreement under the change provisions of the Terms of service.

1.3 The Customer is responsible for the lawfulness of any personal data it includes in Customer Content. The service is designed so that no personal data is needed: people are identified by role only, no pupil data is requested, and every free-text field says so.

2. Documented instructions (Art 28(3)(a))

2.1 ANAX processes Customer Content only on the Customer's documented instructions, which are: (i) to store the Customer's drafts, submissions and Register records; (ii) to run the assessment against the published pack named in Annex A; (iii) to hold the result for human review and release it to the Customer; (iv) to record the Decision Passport; (v) to show the Customer's Register records to the people the Customer has authorised, in the roles it gave them, and to derive from those records the current state, counts and the governance summary the Customer downloads; (vi) to return or delete Customer Content under clause 8; (vii) any further written instruction (email suffices) within the scope of the Services, including an instruction to delete or correct personal data entered by mistake.

2.2 ANAX will inform the Customer immediately if, in its opinion, an instruction infringes UK data protection law, and may suspend that instruction until resolved.

2.3 Where UK law requires ANAX to process Customer Content otherwise, ANAX will inform the Customer before processing unless the law prohibits that on important grounds of public interest.

3. Confidentiality (Art 28(3)(b))

Persons authorised by ANAX to process Customer Content (today: the operator only) are bound by contractual or statutory duties of confidentiality.

4. Security (Art 28(3)(c), Art 32)

ANAX implements the technical and organisational measures in Annex B and keeps them under review. Material reductions in those measures are notified to the Customer in advance.

5. Sub-processors (Art 28(3)(d), 28(2), 28(4))

5.1 The Customer gives general written authorisation to the sub-processors listed in Annex C. The Customer may instead request specific authorisation in the Order Form.

5.2 ANAX will give at least 30 days' notice of any intended addition or replacement by updating the published register and emailing the Customer's contact. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected Services without penalty.

5.3 ANAX imposes data-protection obligations on each sub-processor that offer an equivalent level of protection to this Agreement and remains fully liable to the Customer for the sub-processor's performance. Annex C states plainly any sub-processor whose data processing terms are not yet in place for ANAX's account, and ANAX will tell the Customer when that changes.

6. Data subject rights (Art 28(3)(e))

ANAX assists the Customer, by appropriate measures and taking into account the nature of the processing, in responding to requests from individuals, and will forward any such request it receives to the Customer within 5 working days without responding to it (except to acknowledge receipt).

7. Assistance with Articles 32–36 (Art 28(3)(f))

7.1 ANAX assists the Customer with security, personal data breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to ANAX.

7.2 ANAX provides its security, data-protection and continuity summaries to support the Customer's own assessment.

7.3 Personal data breach. ANAX notifies the Customer without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting Customer Content, with the nature of the breach, the data concerned, the likely consequences, the measures taken and what the Customer should do, and supplements the notice as further information becomes available, so that the Customer can meet its own 72-hour obligation under Article 33.

7.4 Personal data entered by mistake. Where pupil data, safeguarding detail or other personal data that is not needed is entered into Customer Content, ANAX on becoming aware restricts access to the record, escalates internally, seeks the Customer's instruction, deletes or corrects as instructed and records the action. Text in a free-text field — including a decision note or an action's history, which the Customer cannot change itself — is removed by a governed redaction that only ANAX's operator can perform: the text is replaced with a fixed marker, nothing else in the record changes, and ANAX records which record and field were redacted, when, why and by which route, never the removed text. A redaction cannot be reversed. Where the text has reached a public Decision Passport, the Passport is withdrawn and the tool reassessed, because a Passport is not edited in place.

7.5 ANAX maintains a complaints route and acknowledges data protection complaints within 30 days.

7.6 Personal data breach — scope. Not every security incident is a personal data breach. ANAX documents every personal data breach affecting Customer Content and notifies the Customer under clause 7.3; whether the breach must be reported to the Information Commission or to individuals is the Customer's decision as controller, and ANAX gives it the information it needs to decide.

8. Deletion or return at the end of the Services (Art 28(3)(g))

8.1 At the end of the Services, at the Customer's choice, ANAX deletes or returns Customer Content and deletes existing copies, unless UK law requires storage.

8.2 Unless the Customer instructs otherwise, ANAX deletes submitted answers when the Passport they support ceases to be valid (12 months from issue) in accordance with the data retention page, and deletes the Customer's Register records, and the sign-in accounts that existed to reach them, at the end of the Agreement. Deletion is performed by the operator under a written procedure and confirmed in writing; it is not automatic. The Decision Passport itself is an attestation record held by ANAX as controller (clause 1.2) and is not Customer Content.

8.3 Return is by export: the governance summary the Customer can download at any time, and a JSON export of answers and Register records prepared by the operator on request. Deletion and redaction take effect in the live database at once; earlier copies persist in the database provider's daily backups until they rotate out (7 days on ANAX's current plan), and ANAX does not restore from a backup except to recover the service.

9. Information and audit (Art 28(3)(h))

9.1 ANAX makes available to the Customer all information necessary to demonstrate compliance with Article 28, including the security, data-protection and continuity summaries and the evidence index referenced there. ANAX holds no third-party certification or audit report and offers none in place of this information.

9.2 ANAX allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, on 30 days' written notice, no more than once in any 12 months unless required by a supervisory authority or following a personal data breach, during business hours, subject to reasonable confidentiality undertakings and at the Customer's cost unless the audit reveals a material breach of this Agreement.

10. International transfers

10.1 ANAX processes Customer Content in the United Kingdom, in Ireland (the database) and in the Netherlands (the assessment engine); Ireland and the Netherlands are covered by the UK's adequacy regulations. The Register's sign-in and notification emails are delivered by a provider that stores data in the European Union. ANAX does not undertake that all processing stays in one country or region: the database provider describes limited processing outside the selected region, and some sub-processors in Annex C process data in the United States. Where a sub-processor in Annex C processes Customer Content outside the UK other than under adequacy regulations, ANAX ensures appropriate safeguards (standard data protection clauses with the UK Addendum, or the UK Extension to the EU-US Data Privacy Framework) and has met the data protection test required by UK GDPR as amended by the Data (Use and Access) Act 2025.

10.2 ANAX will not transfer Customer Content to any other country without the Customer's prior written authorisation.

11. Liability

Liability under this Agreement is subject to the limitations in the Terms of service, save that nothing limits liability that cannot be limited by law.

12. Term

This Agreement lasts for as long as ANAX processes Customer Content and survives termination for so long as any Customer Content remains.

13. Precedence

If this Agreement conflicts with the Terms of service, this Agreement prevails for the processing of Customer Content.

Annex A — Description of the processing

Annex B — Technical and organisational measures (as deployed; the Register's measures as built and prepared)

1. Transport encryption on every hop (TLS at the hosting edge with HSTS; TLS to the database).
2. Content Security Policy default-src 'none', hash-pinned script on the assessment page and no script on the legal or Register pages, frame-ancestors 'none', form-action 'self'; X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy denying camera, microphone, geolocation, payment.
3. Least-privilege database access: the intake, the worker and the Register connect as a dedicated role with row-level security; no grants outside that schema (verified in production for the assessment tables on 11 October 2026; the Register's tables are prepared with the same model, and with no delete right on any of them and append-only grants on decisions, assessment attempts and action history).
4. Public verification exposed only through read-only views to the anonymous role; base tables and mutating functions closed (verified from outside on 11 October 2026).
5. Access to the assessment gated by engagement codes generated by a tested generator; rate limiting on validation (10 per address per 10 minutes per machine) and on writes (600 per address per 10 minutes per machine), shared by the Register's changes; proxy-trust depth verified against the live topology.
6. Access to the Register: sign-in by emailed link through the authentication provider, no password stored by ANAX; a server-signed, HttpOnly, same-site session cookie limited to 12 hours; every page and change authorised on the server against the person's membership and role before any Customer Content is read or written; invitations single-use, expiring, bound to one organisation and role, stored as a hash; changes submitted from another website refused. Tenant isolation tested: requests for another organisation's trust, school, entry or action are refused without disclosing existence.
7. Secrets held only in the hosting provider's secret store; images carry no secrets; source control holds no credentials.
8. Human review hold on every assessment run before release; every decision on the Register recorded by a person in an authorised role.
9. Immutable, signed pack supply: the image build refuses to start if the vendored pack's content hashes do not match the manifest.
10. Change control: ledgered migrations with verification scripts; releases by tag; rollback by image reference, recorded per deploy.
11. Logging: provider logs only; no application log line carries answers, codes, notes, tokens or email addresses.
12. History: Register records are never overwritten by the Service; a correction is a new record; action changes are kept as events. The one exception is the governed redaction of clause 7.4, which replaces mistaken free text with a fixed marker and records that it happened.
13. Tool records belong to one organisation: a tool name, provider or website entered by one Customer is never shown to or reused for another, enforced in the database as well as the application (prepared with the Register's schema; applied with it).
14. The redaction route is restricted to the database owner: the application role cannot run it, cannot rewrite decisions or action history, and cannot read the redaction record.

Not in place, stated so the Customer can judge: no independent penetration test; no ISO 27001, SOC 2 or Cyber Essentials certification; no automated retention purge (a written manual deletion procedure exists); no revocation of a signed-in session before it expires (12 hours at most); the multi-factor-authentication status of the operator's provider consoles has not yet been recorded; the Register's pages have had automated accessibility testing only, and manual assistive-technology testing is outstanding (see the accessibility statement).

Annex C — Authorised sub-processors

As published on the sub-processor page on the date of the Order Form:

• Fly.io: hosting, London and Amsterdam; corporate systems in the United States; processor terms not yet in place (the first signature of Fly.io's data processing agreement recorded a truncated company name and a corrected agreement is awaited).
• Supabase Pte. Ltd: database hosting on the Pro plan in the project's selected region, AWS eu-west-1 (Ireland), verified 11 October 2026, with daily backups kept for 7 days; Supabase's data processing addendum forms part of its terms and describes limited processing outside the selected region. When the Register is enabled, also the sign-in service (Supabase Auth) that holds the email addresses of the people who sign in.
• Brevo: delivery of the Register's sign-in emails and governance notification emails — invitations, reminders, decisions needed, weekly trust summaries (transactional service email only, from ANAX Schools <no-reply@auth.anaxstandard.ai>; a notification names the organisation, the AI tool and dates, and carries no assessment answers or results); Brevo's data processing agreement forms part of its terms of service; Brevo states that it hosts and stores data in the European Union (France, Germany and Belgium).
• Vercel Inc.: static hosting of the verification page and website, on the Pro plan, under Vercel's data processing addendum; request logs only, kept for one day.
• Google Workspace (Gmail): the operator's mail provider for contact@viccaone.com (correspondence only), under Google's Cloud Data Processing Addendum; acceptance of that addendum in ANAX's Admin console is not yet confirmed.

Google Fonts is disclosed but is not a processor. No model provider is a sub-processor: since 3 November 2026 the assessment engine calls no artificial-intelligence or large-language-model service.

Annex D — Contacts and procedures

Version history: 0.1 (11 October 2026) prepared; 0.1.1 (12 October 2026) annex facts corrected; 0.2 (12 October 2026) website candidate; 0.3 (26 October 2026) Customer Content extended to the Register's governance records, instructions (v)–(vii), the mistaken-entry procedure, end-of-contract deletion of Register records and accounts, Annex A/B/C/D updated to the Register as built; the controller/processor allocation marked for legal decision; counsel items unchanged. 0.4 (1 November 2026) facts reconciled: the governed redaction of mistaken free text (7.4) and breach scope (7.6); backups 7 days (8.3); transfers not confined to one region (10.1); Annex A types and categories of personal data stated as they occur; Annex B tool records per organisation and the owner-only redaction route; Annex C with Brevo, Supabase Pro, Vercel Pro, the Fly.io agreement status and the Google addendum status; counsel items unchanged. 1.0 (3 November 2026) — in force as the standard DPA under the Terms of service: the pilot order form references removed; Anthropic removed from Annex C (the engine is deterministic and calls no model service since 3 November 2026); an open sub-processor term is disclosed in Annex C (5.3). 1.1 (4 November 2026) — Brevo's described service widened to the Register's governance notification emails (Annex C, 10.1); nothing else changed.