Data Processing Agreement

AgentChamp Data Processing Agreement (DPA)

Version 1.0 - effective 25 August 2026

This is the agreement a school accepts at registration. It governs everything AgentChamp does with the school's pupil and staff data.

Parties

• Processor: AgentChamp Ltd, registered in England and Wales (company number 17176256), registered office 1434 London Road, Leigh-on-Sea, Essex, England, SS9 2UL, ICO registration ZC230270 ("AgentChamp")
• Controller: the school accepting this agreement at registration (the "School")

This agreement is incorporated by reference into the AgentChamp Terms of Service and governs all processing of School Data. "Applicable Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003, and any other UK data protection law that applies.

Subject matter and duration

AgentChamp processes personal data of the School's pupils and staff ("School Data") for the sole purpose of delivering the AgentChamp reading programme, as directed by the School - from acceptance of this agreement until the School's subscription ends, plus the retention periods set out in the Privacy Policy and Annex A.

The School's obligations

The School warrants and agrees that it:

• Has a valid lawful basis, and where its basis requires it, the necessary parental consents, for every pupil it enrols on AgentChamp
• Where it records the additional-reading-support marker for a pupil (Annex A), holds a valid Article 9 condition for that special-category data - normally Article 9(2)(g) with the substantial-public-interest condition for statutory and educational purposes in Schedule 1, Part 2 of the Data Protection Act 2018
• Has conducted (or will conduct) a Data Protection Impact Assessment for its use of AgentChamp where one is required. AgentChamp publishes a DPIA Support Pack giving the supplier-side information a School needs to complete one
• Will enrol only the pupil data the reading programme needs, and keep it accurate
• Will distribute pupil login details only to the correct pupil or their parent/guardian
• Will promptly tell AgentChamp when consent for a pupil is withdrawn, or when a pupil leaves, so the pupil's data enters the deletion schedule
• May instruct AgentChamp to export, correct, or delete any pupil's data at any time, using the tools provided in the platform or by written request

AgentChamp's obligations

AgentChamp shall:

• Process School Data only on the School's documented instructions, unless required by law to do otherwise - in which case AgentChamp informs the School unless the law forbids it
• Notify the School immediately if it considers an instruction from the School to infringe Applicable Data Protection Legislation
• Ensure everyone authorised to process School Data is bound by confidentiality
• Implement the technical and organisational measures in Annex B
• Engage sub-processors only as set out below
• Assist the School in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection), including through the in-platform export and deletion tools
• Assist the School with its obligations under Articles 32–36 of the UK GDPR (security, breach notification, DPIAs), taking into account the nature of the processing and the information available to AgentChamp
• Notify the School's nominated contact of every personal data breach affecting School Data, without undue delay and in any event within 48 hours of becoming aware of it. This applies to *all* personal data breaches, not only those AgentChamp judges significant - assessing severity is the School's decision as controller, and it cannot make it about a breach it has not been told of. The notification will contain the information required by Article 33(3) so far as it is available, and further detail will follow in phases as it emerges
• At the end of the service, delete or return all School Data at the School's choice, subject to the retention exceptions in Annex A
• Make available the information necessary to demonstrate compliance with Article 28, and allow audits as set out below
• Not use School Data to train, fine-tune or evaluate any artificial-intelligence model, and not use School Data for product development, market research, behavioural analytics, or any purpose other than delivering the reading programme to the School

Sub-processors

The School gives general authorisation for the sub-processors listed in the current Sub-Processor Inventory, published alongside the Privacy Policy.

For any new sub-processor, AgentChamp gives the School 30 days' notice before the integration goes live. If the School objects on reasonable data-protection grounds and no resolution is found within that period, the School may terminate the affected service without penalty and receive a pro-rata refund of the unused period.

Every sub-processor is bound by a written agreement imposing data-protection obligations no weaker than this one, and AgentChamp remains fully liable for its sub-processors' performance.

International transfers

School Data is stored in the United Kingdom - Google Cloud's London region, and Microsoft's UK South region for narration synthesis.

No pupil's personal data is transferred outside the United Kingdom. The narrow flows that do leave the UK carry either no personal data at all or an adult staff member's contact details:

AgentChamp will not otherwise transfer School Data outside the UK without ensuring compliance with Applicable Data Protection Legislation, and will notify the School before any change to the table above.

Security incidents

Whichever party discovers a security incident affecting School Data informs the other without undue delay - and AgentChamp within the 48 hours set out above - shares what is needed for breach-reporting obligations, and cooperates on mitigation. The School remains responsible for notifying its supervisory authority and data subjects where required; AgentChamp provides the information the School needs to do so.

Deletion and return

• On the School's written request at any time, and at the end of the service, AgentChamp deletes or returns all School Data, including data held by sub-processors
• Deletion follows the platform's published two-stage schedule: accounts are deactivated immediately and permanently erased after a 90-day grace window, which exists so an accidental deletion can be reversed. The School may request in writing that the grace window be waived for a specific pupil or request, in which case erasure is carried out without it - for example where a School needs to evidence immediate erasure to a parent or the ICO
• Exceptions: the consent and erasure audit record (the evidence that consent existed and erasure happened) and reduced billing records are retained as required for legal compliance. Retained data is isolated and processed for no other purpose. The identifying elements of the audit record - IP address and browser identifier - are erased after 6 years

Audit

On 30 days' written notice, the School may audit AgentChamp's compliance with this agreement - at the School's cost, once per calendar year unless a breach has occurred, in which case an additional audit may be conducted at any time. AgentChamp will first offer its most recent security documentation, penetration-test summary and the information in the DPIA Support Pack, which satisfies routine audits. Audits must not unreasonably disrupt AgentChamp's business or compromise the confidentiality of other customers' data.

Liability and indemnity

Each party indemnifies the other for losses arising from its breach of this agreement, subject to prompt notification of any claim, no admission of liability without the other's agreement, and reasonable steps to mitigate.

Each party's total liability under this agreement is subject to the same aggregate cap as the Terms of Service - the total fees paid in the 12 months immediately before the event giving rise to the claim. The cap in this agreement and the cap in the Terms are not cumulative: together they are subject to one aggregate limit. Nothing here limits liability that cannot lawfully be limited, or either party's liability to a data subject or a supervisory authority under Applicable Data Protection Legislation.

Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Contact

All notices, breach reports, instructions and questions under this agreement go to privacy@agentchamp.co.uk, or in writing to AgentChamp Ltd, 1434 London Road, Leigh-on-Sea, Essex, England, SS9 2UL. The School's contact for notices is the registered administrator's email address unless the School nominates another in writing.

Acceptance

The School accepts this agreement when its administrator registers the school and ticks the DPA acceptance box. Acceptance is recorded permanently - who accepted, when, from where, and which version - in AgentChamp's consent audit record.

This is a written contract. UK GDPR Article 28(9) requires the contract to be in writing, "including in electronic form", and an acceptance recorded against a named administrator, a timestamp, an IP address and a specific document version satisfies that. In practice it is stronger evidence than a signature, because it identifies exactly which text was agreed rather than leaving the version to be inferred.

If your procurement requires a signed copy, we will provide one - ask at privacy@agentchamp.co.uk. Annex C is the signature page. Signing on paper does not change any term of this agreement; it records the same acceptance in the form your process needs.

Annex A - description of processing

Data subjects

• Pupils of the School
• The School's teaching and administrative staff

(Parents and guardians who link their own accounts to a pupil do so under AgentChamp's own Privacy Policy as controller; the School is shown who is linked to each of its pupils and can end any link.)

Categories of data

*Pupils*

• First and last name; year group; class
• A generated username, and an internal email address that is not a real mailbox and cannot send or receive mail
• Login code and PIN
• Optional roster fields the School chooses to record: gender; the additional-reading-support marker
• Reading activity: stories opened and finished, pages read, time spent, reading speed, adventure-story choices, quiz answers and scores, dictionary lookups (with the sentence the word appeared in), points, streaks, achievements, avatar choices

*Staff*

• Name, email address, role, job title, class assignments
• Authentication and security logs, including IP address and browser identifier

Special-category data. The additional-reading-support marker is a yes/no field that can reveal that a pupil has a special educational need or disability, and AgentChamp treats it as Article 9 special-category data. No diagnosis, condition, EHCP detail or health record is collected. Its only use is to permit the reading-level placement to offer books below the usual floor for a pupil's year group. Where the School records it, the School holds the Article 9 condition.

Not collected. Pupil dates of birth, pupil contact details, pupil home addresses or postcodes, photographs, audio or video of pupils, device location, Unique Pupil Numbers, ethnicity, free school meal status, pupil premium status, or English-as-an-additional-language flags. There is no free-text input anywhere a pupil can reach, so pupils cannot enter personal data into the Service.

Processing operations

• Hosting and storage of accounts and reading records (UK region)
• Delivery of the reading programme: story presentation, narration audio, quizzes, vocabulary tools, rewards
• Computation of progress analytics for the School's staff and, where the School issues a link code, for a pupil's linked guardian
• Automated reading-level placement - a recommendation of book difficulty from reading history, always visible to and overridable by staff, affecting only which books are suggested
• Credential management (issuing, revealing to authorised class staff, resetting, printing login slips at the School's request)
• Security logging, abuse prevention, and maintenance of the consent audit record
• Automated retention and deletion on the published schedule

Permitted purpose: delivering the AgentChamp reading programme to the School - nothing else. AgentChamp does not use School Data for marketing, advertising, AI training, product development, or analytics tied to identifiable pupils.

Retention: as published in the Privacy Policy. In summary - pupil accounts deleted 365 days after the pupil leaves the roll or goes inactive; 90-day erasure grace period, waivable on request; consent audit record kept as evidence with its identifying elements erased after 6 years; logs 30 days; backups 30 days.

Annex B - technical and organisational measures

The measures below are the summary. The full statement, kept current as the platform changes, is published as Security Measures alongside this agreement.

• Encryption in transit (TLS) and at rest
• Passwords stored as one-way hashes; pupil login codes and PINs additionally held encrypted so authorised class staff can re-show them, with every reveal audit-logged to a named member of staff, and excluded from data exports
• Session tokens held in HttpOnly cookies; the short-lived request token is never written to disk
• Role-based access control scoped to school and class; pupils can access only their own data; no pupil can see another pupil's data
• Rate limiting and lockouts on authentication and code-entry endpoints; server-side session revocation
• An explicit allow-list of outbound services, so School Data cannot flow to unlisted destinations
• Append-only consent audit record, enforced by a database trigger rather than by convention
• No third-party resources load on any page a pupil can reach; no analytics, tracking or error-reporting service anywhere in the product
• Separated development, integration, and production environments; security review of changes; automated secret scanning in the build pipeline
• PII masking in operational logs

Annex C - signature page

Only needed where a School's procurement process requires a countersigned document. The tick-box acceptance at registration is the normal route and is legally sufficient on its own; this page records the same agreement in a different form and adds nothing to it.

Where both exist, the terms are identical and the earlier of the two dates is the date the agreement took effect.

Agreement: AgentChamp Data Processing Agreement, version 1.0 (effective 25 August 2026)

For the School (Controller)

School name: ______________________________________________

DfE URN: ______________________

Name: ______________________________________________

Position: ______________________________________________

Signature: ______________________________________________

Date: ______________________

For AgentChamp Ltd (Processor)

Company number 17176256 · ICO registration ZC230270 1434 London Road, Leigh-on-Sea, Essex, England, SS9 2UL

Name: ______________________________________________

Position: ______________________________________________

Signature: ______________________________________________

Date: ______________________

Version history

• 1.0 (25 August 2026) - first published agreement. Supersedes the 2026-04-14 and 2026-08-04 internal drafts, which were never cleared for publication and are retained unedited in archive/