School and Centre Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Terms of Service between the school, tuition centre or other organisation identified when accepting it (the Controller) and Fruition International Ltd, company number 15518353, which operates Fame Factor (the Processor). It applies only where the Controller decides why and how learner personal data is used and Fame Factor processes that data on its behalf. It starts when an authorised representative accepts it and continues while the Controller uses the service and until the relevant personal data is returned or deleted.

Fame Factor remains a separate controller for its own account administration, billing, security and direct support records, as explained in the adult Privacy Notice. This DPA does not displace that notice or any mandatory rights under UK data-protection law.

A representative accepting online confirms that they are authorised to bind the named organisation. Contact support@famefactor.co.uk if your organisation requires a countersigned copy.

Subject matter and purpose

Hosting accounts and delivering times-table activities, assignments, progress reporting, supervised access and related support for the Controller's learners.

People

Learners, teachers and staff assigned to the Controller's classes; parents or carers where linked to a learner account.

Information

Names or usernames, account identifiers, class and organisation links, assignments, answers, accuracy, response times, sessions, progress, rewards, leaderboard display information and support information supplied by the Controller.

Operations

Collection, recording, organisation, storage, retrieval, display to authorised users, analysis for learning progress, transmission to authorised service providers, correction, export, restriction and deletion.

Duration

For the service term and the deletion or return period in section 9, subject to lawful retention and any shorter documented instruction agreed with the Controller.

The Processor will process Controller learner data only on the Controller's documented instructions, including instructions about international transfers, unless UK law requires otherwise. This DPA, the Controller's configuration and authorised actions in the service, and written instructions agreed through support are documented instructions. If law requires different processing, the Processor will tell the Controller beforehand unless the law prohibits notice.

The Controller decides its lawful basis, gives learners and families appropriate privacy information, controls which staff may access accounts, and keeps its user and class details accurate. The Controller may send further lawful instructions to support@famefactor.co.uk. The Processor will promptly inform the Controller if, in its opinion, an instruction infringes applicable data-protection law.

The Processor will not use Controller learner data for targeted advertising or sell it.

The Processor will limit access to authorised people who need it to provide or secure the service and ensure they are bound by confidentiality. It will use appropriate technical and organisational measures under Article 32 UK GDPR, taking account of risk to children: role-based access, authentication, encrypted transport, controlled production access, logging, backups and procedures to identify and address security incidents.

The Controller is responsible for safeguarding its own credentials, selecting authorised users and promptly removing access when a person leaves. The Processor will make information reasonably needed to demonstrate its security measures available on request, subject to protecting other customers and system security.

The Controller gives general written authorisation for the Processor to use subprocessors needed to run Fame Factor. The current provider categories include self-hosted Supabase/PostgreSQL infrastructure on Hetzner, Cloudflare storage and delivery, and Resend email delivery; Stripe is used for adult billing and is generally outside this learner-data processing schedule. The Processor will keep an up-to-date subprocessor list available on request, identify each provider's role and relevant location, and give advance notice of an intended addition or replacement so the Controller has a reasonable opportunity to object on data-protection grounds.

The Processor will bind each subprocessor to data-protection obligations offering equivalent protection and remains responsible to the Controller for the subprocessor's performance. It will not transfer Controller learner data outside the UK without a lawful transfer basis and any required safeguards, and will provide information about those safeguards on request.

Email support@famefactor.co.uk to request the current subprocessor list or raise an objection.

Taking account of the processing and information available, the Processor will use appropriate technical and organisational measures to help the Controller answer requests to access, correct, erase, restrict or export learner data and to address objections. It will refer a direct learner or parent request concerning Controller data to the Controller where feasible, unless legally required to respond itself.

The Processor will reasonably assist the Controller with security obligations, personal-data-breach assessments and notifications, DPIAs and any required prior consultation with the ICO. The Controller remains responsible for decisions and notices it must make as controller.

The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller learner data. It will share the information reasonably available about the incident, likely consequences and measures taken, provide updates as facts emerge, and cooperate with the Controller's investigation and notification duties. The Controller will provide a monitored privacy or incident contact and promptly notify the Processor of relevant incidents on its side.

The Processor will make information necessary to demonstrate compliance with this DPA available to the Controller and allow and contribute to reasonable audits or inspections by the Controller or its appointed independent auditor. The parties will first seek to use existing reports and written responses where these provide adequate assurance. Any on-site or technical audit must be arranged on reasonable notice, protect other customers' data and security, and avoid unnecessary disruption. This does not remove audit rights required by law.

At the end of the service, the Processor will, at the Controller's choice, return or securely delete Controller learner data and delete existing copies, unless UK law requires retention. The Controller should send its return or deletion instruction to support@famefactor.co.uk before or promptly after ending the service. If no instruction is received, the Processor will follow the deletion timetable in the adult Privacy Notice, subject to any lawful exception.

Backup copies that cannot be individually removed immediately will be put beyond ordinary use and deleted on the next applicable backup-expiry cycle. The Processor will not restore deleted learner data to live use except when needed for security or disaster recovery, and will reapply the deletion instruction after a restore.

The Processor may update this DPA for a genuine legal, security or service change. It will give the Controller reasonable advance notice of a material change and ask an authorised representative to accept a replacement version where appropriate. Earlier acceptance records remain available for audit. If this DPA conflicts with the general Terms about processing Controller learner data, this DPA takes precedence for that processing. The Terms otherwise continue to apply. This DPA is governed by the law of England and Wales.