Parties and background
This Data Processing Agreement (DPA) is between:
- Creative Education Limited, a company registered in England and Wales with company number 04662664, whose registered office is at 49 Station Road, Polegate, East Sussex, BN26 6EA (Creative Education, we, us); and
- the school, college, academy trust, local authority or other organisation that has an organisation membership with Creative Education (the Organisation, you).
Background:
- A. Creative Education provides an online learning platform at learn.creativeeducation.co.uk, and the related apps, through which the Organisation gives its staff (and, where it chooses, parents) access to training courses, assigns courses and keeps records of training completed (the Services).
- B. In providing the Services, Creative Education processes personal data on the Organisation’s behalf.
- C. This DPA sets out the terms of that processing, as required by Article 28 of the UK GDPR.
- D. This DPA forms part of the Creative Education terms of service (the Terms) and applies automatically to every organisation membership from the date the Organisation agrees to the Terms. An Organisation that wants a signed copy may sign the version at the end of this DPA; signing does not change its terms.
1. Definitions
1.1 In this DPA:
- Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any law that amends or replaces them, as they apply in the United Kingdom.
- UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.
- controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in Data Protection Law. The supervisory authority is the Information Commissioner’s Office (ICO).
- Organisation Data means the personal data Creative Education processes on the Organisation’s behalf, as described in clause 2.2 and Schedule 1.
- Personal Learning Record means a person’s own account and record of learning on the platform, as described in clause 2.3.
- Sub-processor means a third party Creative Education engages to process Organisation Data.
- Authorised User means a person the Organisation gives access to the Services, including staff, volunteers, governors and, where the Organisation chooses, parents.
- Restricted Transfer means a transfer of Organisation Data to a country outside the UK that is not covered by UK adequacy regulations.
1.2 Words not defined here have the meaning given in the Terms. If this DPA and the Terms conflict on the processing of personal data, this DPA wins.
1.3 “Including” means including without limitation.
2. Roles of the parties
2.1 Two kinds of record. The platform holds two different kinds of personal data about an Authorised User, and the parties have different roles for each.
2.2 Organisation Data: the Organisation is the controller and Creative Education is its processor. Organisation Data is the personal data the Organisation decides to collect and use through the Services, namely:
- (a) which Authorised Users belong to the Organisation, and their groups, roles and job titles as the Organisation records them;
- (b) the courses the Organisation assigns, to whom, and the dates by which they are due;
- (c) whether and when each Authorised User completed what the Organisation asked of them, while they belong to the Organisation;
- (d) records of training done elsewhere that the Organisation adds, with any evidence files it uploads; and
- (e) the reports and exports the Organisation produces from (a) to (d), including those it keeps as inspection or safeguarding evidence.
2.3 Personal Learning Records: Creative Education is an independent controller. Each Authorised User has their own account. The account, their completions and certificates, their reflections and notes, and anything they add themselves belong to their Personal Learning Record. Creative Education is the controller of it and processes it under its own privacy notice (learn.creativeeducation.co.uk/privacy). The record stays with the person if they leave the Organisation, and the Organisation then no longer sees it, except as clause 2.4 allows.
2.4 What the Organisation sees. The Organisation sees an Authorised User’s records only while that person belongs to it. It does not see what the person did for another organisation or on their own, except that where a completion elsewhere meets one of the Organisation’s own requirements, the Organisation sees the course and the date of completion.
2.5 Creative Education’s own business data. Creative Education is also controller of the personal data it uses to run its business with the Organisation: contact, billing and contract details for the Organisation’s named contacts, and records of support requests. That data is outside this DPA and is covered by Creative Education’s privacy notice.
2.6 The Organisation’s responsibilities as controller. The Organisation:
- (a) is responsible for having a lawful basis for the processing of Organisation Data it asks for, and for telling its Authorised Users about it (for example in its own privacy notice for staff);
- (b) must give only instructions that comply with Data Protection Law; and
- (c) must not upload special category data or personal data about pupils, except where the Services are designed for it. The platform does not ask for children’s names or dates of birth, and the free-text boxes tell users not to name pupils.
3. Processing on the Organisation’s instructions
3.1 Creative Education will process Organisation Data only on the Organisation’s documented instructions, unless the law of the UK requires otherwise. In that case Creative Education will tell the Organisation before processing, unless the law forbids it.
3.2 The Organisation’s documented instructions are:
- (a) this DPA and the Terms;
- (b) the Organisation’s use and configuration of the Services, including what its administrators assign, add, change, export or delete; and
- (c) any further written instruction from the Organisation that Creative Education agrees to, which must be consistent with the Terms.
3.3 Creative Education will tell the Organisation promptly if, in its opinion, an instruction breaks Data Protection Law. It may then refuse to follow that instruction.
3.4 Creative Education will not sell Organisation Data, use it to advertise to anyone, or use it to train artificial intelligence models.
3.5 Creative Education may produce statistics from Organisation Data, such as the number of courses completed across the platform, provided that no Authorised User and no Organisation can be identified from them.
4. Confidentiality and Creative Education staff
4.1 Creative Education will make sure that everyone it authorises to process Organisation Data is bound by a duty of confidentiality, by contract or by law.
4.2 Only Creative Education’s own employees can see Organisation Data through the platform’s staff tools. They see it only as far as they need to provide, support and improve the Services. Every member of staff must use multi-factor authentication to sign in.
4.3 Creative Education staff can view the platform as a named Authorised User to answer a support request. While they do, the platform shows them what that user would see and refuses every change. Each such session is recorded, with who started it and when.
5. Security
5.1 Creative Education will take the technical and organisational measures required by Article 32 of the UK GDPR to keep Organisation Data secure, taking into account the state of the art, the cost, the nature of the processing and the risks to Authorised Users. The measures in place at the date of this DPA are in Schedule 2.
5.2 Creative Education may change those measures over time, provided the change does not reduce the overall level of protection.
5.3 The Organisation is responsible for the security of its own side of the Services: who it makes an administrator, keeping its list of Authorised Users up to date, and removing people who leave.
6. Sub-processors
6.1 The Organisation gives Creative Education general written authorisation to engage Sub-processors. The Sub-processors in use at the date of this DPA are listed in Schedule 3. The current list is published at www.creativeeducation.co.uk/trust/.
6.2 Creative Education will impose on each Sub-processor, by written contract, data protection obligations that give at least the same protection as this DPA, as Article 28(4) of the UK GDPR requires.
6.3 Creative Education will give at least 30 days’ notice before a new Sub-processor starts processing Organisation Data. It will email the Organisation’s administrators and update the published list.
6.4 The Organisation may object to a new Sub-processor on reasonable data protection grounds by writing to Creative Education within that 30 days. The parties will discuss the objection in good faith. If they cannot resolve it, the Organisation may end its organisation membership by written notice before the new Sub-processor starts. Creative Education will then refund the fees paid for the part of the membership year that remains, and section 6 of the Terms will not require any further fees.
6.5 Creative Education stays responsible to the Organisation for how each Sub-processor carries out its obligations.
6.6 In an emergency (for example, where a provider must be replaced to keep the Services secure or running), Creative Education may give notice under clause 6.3 as soon as it can, rather than 30 days in advance. The Organisation’s right to object under clause 6.4 still applies.
7. International transfers
7.1 Creative Education keeps the platform’s database in London and runs the platform’s servers in London. Some Sub-processors process Organisation Data in the European Economic Area or the United States, as Schedule 3 shows.
7.2 Creative Education will make a Restricted Transfer of Organisation Data only where one of the following applies:
- (a) the recipient is certified under the UK Extension to the EU–US Data Privacy Framework;
- (b) the transfer is covered by the ICO’s International Data Transfer Agreement, or by the International Data Transfer Addendum to the EU standard contractual clauses, together with a transfer risk assessment; or
- (c) another transfer mechanism permitted by Data Protection Law applies.
7.3 Transfers to the European Economic Area are covered by UK adequacy regulations and need no further safeguard.
8. Helping the Organisation meet its obligations
8.1 Requests from individuals. Taking into account the nature of the processing, Creative Education will help the Organisation respond to requests from Authorised Users exercising their rights under Chapter III of the UK GDPR. If Creative Education receives such a request about Organisation Data directly, it will pass it to the Organisation within five working days and will not answer it itself, except to say it has been passed on. Authorised Users can also download and delete their Personal Learning Record themselves, which Creative Education handles as controller.
8.2 Assessments and the ICO. Creative Education will give the Organisation the information it reasonably needs to carry out a data protection impact assessment of its use of the Services, and to consult the ICO where Article 36 of the UK GDPR requires. Creative Education’s own data protection impact assessment summary is available on request.
8.3 Cost. Help under this clause is free where it is reasonable. Creative Education may charge a reasonable fee, agreed in advance, for help that takes significantly more time than usual.
9. Personal data breaches
9.1 Creative Education will tell the Organisation without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Organisation Data.
9.2 The notice will be emailed to the Organisation’s administrators and to any data protection contact the Organisation has given Creative Education. As far as it is known at the time, it will describe:
- (a) the nature of the breach, including the categories and approximate number of Authorised Users and records concerned;
- (b) the name and contact details of Creative Education’s data protection lead;
- (c) the likely consequences of the breach; and
- (d) the measures taken or proposed to deal with it and reduce its effects.
Where not all of this is known, Creative Education will give it in stages as it becomes known.
9.3 Creative Education will take reasonable steps to contain and investigate the breach, and will cooperate with the Organisation so it can meet its own obligations to report to the ICO within 72 hours and to tell Authorised Users where required.
9.4 Telling the Organisation about a breach is not an admission of fault or liability.
10. When the contract ends
10.1 Export. At any time during the membership, and for 90 days after it ends, the Organisation’s administrators can export Organisation Data from the platform. Creative Education will also provide an export on written request during that period.
10.2 Keeping the record. The Organisation instructs Creative Education to keep Organisation Data for six years after the membership ends, so that the Organisation can show which training its staff completed. This is because schools and other settings may need that evidence under Keeping Children Safe in Education and in inspections. During those six years the data is kept securely and is not used for any other purpose. It is available to the Organisation on request, and to the Organisation again in full if it renews.
10.3 Deleting it sooner. The Organisation may instead ask in writing for Organisation Data to be deleted at any time after the membership ends. Creative Education will delete it, or make it anonymous, within 90 days of the request, and confirm in writing when it has. Creative Education will then delete it at the end of the six years in clause 10.2 if it has not done so earlier.
10.4 What deletion does not touch. Deleting Organisation Data does not delete Authorised Users’ Personal Learning Records, which belong to the users under clause 2.3. Nor does it touch data Creative Education must keep by law, such as invoices.
10.5 Backups. Copies of deleted data in backups are overwritten in the normal backup cycle, which is currently seven days, and are not restored except to recover from an incident.
11. Information and audits
11.1 Creative Education will make available to the Organisation the information reasonably needed to show that it meets Article 28 of the UK GDPR and this DPA. It will do this first through its published trust page, this DPA and its schedules, and written answers to a reasonable security questionnaire.
11.2 If that information is not enough to show compliance, or the ICO requires it, the Organisation (or an independent auditor it appoints who is bound by confidentiality) may audit Creative Education’s compliance with this DPA, on these terms:
- (a) no more than once in any 12 months, unless there has been a personal data breach affecting Organisation Data or the ICO requires it;
- (b) on at least 30 days’ written notice, with a proposed scope agreed in advance;
- (c) remotely, or during business hours in a way that does not unreasonably disrupt Creative Education’s business; and
- (d) at the Organisation’s cost.
11.3 An audit does not extend to the systems of Sub-processors. For those, Creative Education will provide the Sub-processor’s own audit reports or certifications where it is able to share them.
12. Liability and general terms
12.1 Each party’s liability under or in connection with this DPA is subject to the limits and exclusions of liability in the Terms (section 15). Nothing in this DPA limits either party’s liability where Data Protection Law does not allow it to be limited, or limits the rights of Authorised Users under Article 82 of the UK GDPR.
12.2 This DPA lasts for as long as Creative Education processes Organisation Data, including after the membership ends under clause 10.
12.3 If any provision of this DPA is found invalid, the rest stays in force.
12.4 Creative Education may update this DPA to reflect changes in Data Protection Law, in guidance from the ICO, or in the Services, provided the update does not reduce the protection of Organisation Data. It will give the Organisation at least 30 days’ notice of any material change.
12.5 This DPA and any dispute arising from it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
12.6 Creative Education’s data protection lead is Tom Hesmondhalgh, [email protected]. Creative Education is registered with the ICO under number Z2363705.
Schedule 1: Details of the processing
| Subject matter | Providing an online training platform through which the Organisation gives Authorised Users access to courses, assigns training, and keeps records of training completed |
|---|---|
| Duration | The membership, and afterwards as clause 10 sets out |
| Nature and purpose | Storing, organising, displaying, reporting on, exporting and deleting Organisation Data, so the Organisation can manage and evidence its staff training. Sending service emails and app notifications about assigned training (a notification never names the course) |
| Data subjects | The Organisation’s Authorised Users: staff, volunteers, governors, trainees and supply staff, and parents where the Organisation gives them access. The Organisation’s administrators |
| Categories of personal data | Name, work email address, job title and role, membership of the Organisation and its groups; courses assigned and their due dates; completions, dates and certificates; records of training done elsewhere and evidence files the Organisation uploads; sign-in history for the last 12 months (time, browser and kind of device, no IP address or location) |
| Special category data | None intended. Free-text fields tell users not to name pupils. Evidence files uploaded by the Organisation are the Organisation’s responsibility |
| Children’s data | None intended. Parents’ accounts do not record their children’s names or dates of birth |
| Frequency | Continuous, for the length of the membership |
Schedule 2: Technical and organisational measures
The measures in place at the date of this DPA.
Where data is held
- The platform’s database is hosted by Neon in London (AWS eu-west-2). The platform’s servers run on Vercel in London.
- Data is encrypted in transit (TLS) and at rest by the hosting providers.
- Live data is kept apart from test data. The test and staging systems use invented or anonymised data, and cannot reach the live database.
Who can see what
- Every request to read data is checked against who is asking. An administrator sees only the people and records of the organisations they administer, and of the organisations beneath them. This is enforced in the code that reads the database, and automated tests fail if a page reads the database any other way.
- Only Creative Education employees can use the staff tools. Each must sign in with multi-factor authentication.
- When a member of staff views the platform as a named user to give support, nothing can be changed, and the session is recorded.
- Changes made through the staff tools are recorded in an audit log, kept for six years.
Signing in
- Sign-in is provided by Clerk. The platform does not store passwords. Users can turn on two-step sign-in with an authenticator app.
- Sessions expire. Repeated attempts are rate-limited.
Resilience and recovery
- The database keeps seven days of history and can be restored to any point in that time. A snapshot is taken before any bulk change to live data.
- Errors are reported to Sentry (EU hosting) without names or email addresses.
Keeping only what is needed
- The platform does not ask for children’s names or dates of birth, and does not record IP addresses or locations in sign-in history.
- A nightly job deletes data at the end of its retention period, for example email and sign-in records after 12 months.
- Course videos are delivered through signed embeds limited to Creative Education’s own sites.
People and process
- Changes to the platform are reviewed and must pass automated tests, including accessibility and access-control tests, before they are released.
- Production systems are changed only by named people. Payment card details are handled by Stripe and never reach Creative Education’s systems.
Schedule 3: Sub-processors
The Sub-processors that process Organisation Data at the date of this DPA. Providers that receive no Organisation Data, such as those used only on the public website, are listed on the trust page and in the privacy notice instead.
| Sub-processor | What it does | Where | Transfer safeguard |
|---|---|---|---|
| Neon (Databricks) | The database | London | None needed |
| Vercel | Runs the platform | London (servers); US company | UK Addendum to the EU standard contractual clauses |
| Clerk | Sign-in: name, email address, sign-in method | US | UK Extension to the Data Privacy Framework |
| Resend | Sends service emails: address and message | US | UK Extension to the Data Privacy Framework, and the UK Addendum |
| Amazon Web Services (SES) | Sends broadcast emails: address, message and clicks | Stockholm | None needed |
| Amazon Web Services (S3) | Stores evidence files administrators upload, privately | Stockholm | Not needed (EEA) |
| HubSpot | Customer records, including training completions shared for account management | Frankfurt | None needed |
| PostHog | Anonymous product events after consent: a random ID, no name or email address | Frankfurt | None needed |
| Sentry | Error reports with no user attached | EU | None needed |
| Expo, with Apple and Google | App notifications: push token and the words, which never name a course | US | UK Extension to the Data Privacy Framework (Expo, Apple, Google) |
Signed copy
For organisations that want a signed copy. This DPA applies whether or not it is signed.
| Creative Education Limited | The Organisation | |
|---|---|---|
| Name of organisation | Creative Education Limited | |
| URN or company number | 04662664 | |
| Signed by | ||
| Name | Tom Hesmondhalgh | |
| Role | Director | |
| Date |