Agreements · Send Signals

How Send Signals handles personal data on the school's behalf, as required by UK GDPR Article 28.

Send Signals Limited

Data Processing Agreement

UK GDPR Article 28 | Between Send Signals Limited and the subscribing school

PARTIES TO THIS AGREEMENT

The Processor	Send Signals Limited, a private limited company incorporated in England and Wales (company number 17147174), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ ("Send Signals")
The Controller	[School name], [school address] ("the School")
Effective date	[Date to be inserted on signing]

BACKGROUND

Send Signals Limited operates a web-based platform that enables schools to collect structured pupil check-in responses and manage pastoral and SEND support. The School has agreed to subscribe to the Send Signals platform and in doing so will share personal data with Send Signals Limited for processing on the School's behalf.

This Data Processing Agreement ("Agreement") sets out the terms on which Send Signals Limited will process personal data on behalf of the School, in accordance with UK GDPR Article 28 and the Data Protection Act 2018. This Agreement forms part of and should be read alongside the Send Signals subscription agreement between the parties.

1. DEFINITIONS

1.1 "Controller" means the School, as the entity that determines the purposes and means of processing personal data through the Send Signals platform.

1.2 "Processor" means Send Signals Limited, as the entity that processes personal data on behalf of the Controller.

1.3 "Personal Data", "Processing", "Data Subject", "Special Categories of Personal Data", and "Supervisory Authority" have the meanings given to them in UK GDPR.

1.4 "UK GDPR" means the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, as amended.

1.5 "Sub-processor" means any third party engaged by Send Signals Limited to process personal data in connection with the delivery of the platform.

1.6 "Services" means the Send Signals platform and any related support services provided by Send Signals Limited to the School.

2. SCOPE AND PURPOSE OF PROCESSING

2.1 Send Signals Limited shall process personal data only on documented instructions from the School, unless required to do so by UK law, in which case Send Signals Limited shall inform the School of that legal requirement before processing, unless prohibited from doing so.

2.2 The subject matter, nature, purpose, and duration of the processing, and the types of personal data and categories of data subjects, are set out in Schedule 1 to this Agreement.

2.3 Send Signals Limited shall process personal data only for the purposes of providing the Services and shall not process it for any other purpose, including for its own commercial benefit.

3. OBLIGATIONS OF SEND SIGNALS LIMITED

3.1 Send Signals Limited shall ensure that all persons authorised to process personal data on its behalf are subject to appropriate confidentiality obligations.

3.2 Send Signals Limited shall implement and maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are set out in Schedule 2 to this Agreement.

3.3 Send Signals Limited shall not engage any sub-processor without the prior written authorisation of the School, except as set out in Schedule 3 (Approved Sub-processors). Send Signals Limited shall notify the School of any intended changes to its sub-processors and give the School the opportunity to object.

3.4 Where Send Signals Limited engages a sub-processor, it shall do so by way of a written contract that imposes the same data protection obligations as are imposed on Send Signals Limited by this Agreement.

3.5 Send Signals Limited shall assist the School in meeting its obligations in respect of data subject rights requests, including requests for access, rectification, erasure, restriction, and portability, taking into account the nature of the processing and the information available to Send Signals Limited.

3.6 Send Signals Limited shall assist the School in ensuring compliance with its obligations relating to security, breach notification, data protection impact assessments, and prior consultation with the ICO, taking into account the nature of the processing and the information available to Send Signals Limited.

3.7 Send Signals Limited shall notify the School without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting personal data processed under this Agreement. The notification shall include: the nature of the breach, the categories and approximate number of data subjects and records concerned, the name and contact details of the Data Protection Contact, the likely consequences, and the measures taken or proposed to address the breach.

3.8 At the termination of this Agreement, Send Signals Limited shall offer the School an export of its personal data and shall then securely delete it, as set out in clause 6.3, unless UK law requires continued storage or a legal hold applies.

3.9 Send Signals Limited shall make available to the School all information necessary to demonstrate compliance with this Agreement and shall permit and contribute to audits or inspections conducted by the School or an auditor appointed by the School, provided that reasonable notice is given and the audit does not unreasonably disrupt the operations of Send Signals Limited.

4. OBLIGATIONS OF THE SCHOOL

4.1 The School warrants that it has a valid lawful basis under UK GDPR for processing the personal data it shares with Send Signals Limited, and that it has provided all necessary information to data subjects (including pupils and their parents/carers) about the processing.

4.2 The School shall ensure that the personal data it provides to Send Signals Limited is accurate and up to date.

4.3 The School shall ensure that only authorised staff are given access to the Send Signals platform, and that login credentials are kept secure.

4.4 The School shall notify Send Signals Limited promptly if it becomes aware of any actual or suspected security incident relating to the platform or to any personal data processed under this Agreement.

4.5 The School shall be responsible for ensuring that its own use of the platform complies with UK GDPR and all applicable data protection legislation.

5. INTERNATIONAL TRANSFERS

5.1 Send Signals Limited shall not transfer personal data outside the United Kingdom or European Economic Area without the prior written consent of the School, except to the sub-processors listed in Schedule 3, which the School authorises by accepting this Agreement, or where such transfer is required by UK law.

5.2 The School's data is stored and processed in the United Kingdom by Supabase and Vercel. Where a sub-processor listed in Schedule 3 processes personal data outside the United Kingdom, Send Signals Limited shall ensure that the transfer is covered by UK adequacy regulations or by appropriate safeguards under UK GDPR, such as the International Data Transfer Addendum. Send Signals Limited will notify the School before any change to these locations takes effect.

6. TERM AND TERMINATION

6.1 This Agreement shall take effect on the date the School accepts it in the Send Signals platform and shall continue for the duration of the subscription agreement between the School and Send Signals Limited.

6.2 Either party may terminate this Agreement on written notice if the other party commits a material breach of this Agreement and, where the breach is remediable, fails to remedy it within 30 days of written notice to do so.

6.3 This Agreement terminates when the School's subscription ends, whether it is cancelled, lapses for non-payment or ends in any other way, and off-boarding then starts automatically that day. On that day Send Signals Limited shall email the School's billing contact and administrators to tell them that the subscription has ended and to offer the School an export of its personal data in a portable format. The School may ask for the export, which Send Signals Limited shall provide within 30 days of termination, or tell Send Signals Limited that it does not need it. Send Signals Limited shall securely delete all personal data belonging to the School within 30 days of termination, by a deliberate action that becomes possible from day 23 after termination, unless UK law requires continued storage or the data is under a legal hold, for example because of a legal claim; a legal hold pauses deletion until it is lifted.

7. LIABILITY

7.1 Each party's liability under this Agreement shall be subject to the limitations and exclusions set out in the subscription agreement between the parties.

7.2 Send Signals Limited shall not be liable for any processing carried out by the School in its capacity as data controller, or for any instructions given by the School that cause Send Signals Limited to breach UK GDPR.

8. GOVERNING LAW

8.1 This Agreement shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising under this Agreement shall be subject to the exclusive jurisdiction of the courts of England and Wales.

ACCEPTANCE

The School accepts this Agreement electronically in the Send Signals platform, together with the School Subscription and Data Agreement, through a person who confirms that they are authorised to agree it on the School's behalf. Send Signals Limited agrees to it on the date the School accepts it. A filled-in copy, with a record of who accepted it and when, is kept in the platform and sent by email to the person who accepted it.

SCHEDULE 1: DETAILS OF PROCESSING

Schedule 1: Details of Processing UK GDPR Article 28(3): required particulars

Subject matter	Provision of the Send Signals pupil check-in and pastoral support platform
Duration	For the duration of the subscription agreement between the parties
Nature of processing	Collection, storage, retrieval, display, and deletion of personal data through the Send Signals platform
Purpose of processing	To enable school staff to monitor pupil wellbeing and SEND needs and to identify pupils who may require pastoral support
Types of personal data	Pupil names, date of birth, unique pupil number, year group, form or class, classes and timetable; SEND status and need type, or diagnosis where the School records one; disadvantaged or vulnerability flags (PP, FSM, EAL, where enabled or imported by the School); attendance marks, where the School connects its MIS; RAG check-in ratings and pre-set messages; check-in timestamps; welfare alerts raised from check-ins and staff responses to them; short "well done" messages staff send a pupil from a fixed list; pupil sign-in details (a sign-in code, and an email address where the School uses one); device tokens used to deliver push notifications; staff names, job titles or employment details, and email addresses; login credentials (hashed); an audit log of actions taken by staff accounts; IP addresses and browser details recorded with sign-ins and some staff actions; usage data from check-in devices (fobs and tablets) linked to the pupil or room they are allocated to
Categories of data subjects	Pupils at the School aged 5 to 18; school staff with pastoral or SEND responsibility
Source of the data	Entered or uploaded by the School, or imported from the School's management information system through Wonde where the School connects it. Wonde acts for the School under its own agreement with the School and is not a sub-processor of Send Signals Limited.
Special category data	A pupil's SEND need type (for example autism or ADHD), or diagnosis where the School records one, may reveal information about their health, which is special category data under Article 9 UK GDPR. It is processed only on the School's instructions, for SEND support, and protected by the measures in Schedule 2.

Schedule 2: Technical and Organisational Security Measures

Send Signals Limited has implemented the following technical and organisational measures to ensure an appropriate level of security:

Technical measures:

All data in transit encrypted using TLS 1.2 or higher

All data at rest encrypted using AES-256 (via Supabase)

Row-level security preventing cross-school data access at the database level

Secure authentication required for all staff access; staff can sign in with their school Microsoft or Google account, so the School's own sign-in protections, such as multi-factor authentication, apply

Passwords stored in hashed form, never in plain text

No free-text input accepted from pupils; all responses selected from pre-defined options

Regular application of security patches and dependency updates

Organisational measures:

ICO registration maintained annually

Data Protection Impact Assessment completed and reviewed annually

Data Protection Contact appointed (Nicola Youngman)

Access to production data restricted to authorised personnel only, and key actions by staff accounts recorded in an audit log the School can view

Sub-processors bound by contractual data processing agreements

Personal data breach response procedure in place; the School is notified without undue delay and in any event within 48 hours (clause 3.7), so that it can meet its own duty to notify the ICO within 72 hours where required

Data retention policy enforced; during the subscription, check-in and message history is deleted automatically after the period the School chooses (3 years by default); when the subscription ends, off-boarding starts automatically, the School is offered an export of its data, and the School's data is deleted within 30 days unless a legal hold applies. Send Signals Limited keeps only the following for its own legal and accounting purposes: the School's name and contact details, for six years; billing records and invoices, for at least six years for tax purposes, and its copies of invoices are not deleted; and the record of the School's acceptance of these agreements (the School's name and the details the agreements were filled in with; the name, email address, role and job title of the person who accepted; the version accepted; and the date and time), for six years after the School's data is deleted, after which it is deleted. The IP address and browser recorded at acceptance are deleted when the School's data is deleted. No pupil data is kept in the acceptance record

Schedule 3: Approved Sub-processors

The School hereby provides general written authorisation for Send Signals Limited to engage the following sub-processors. Send Signals Limited will notify the School of any intended changes (additions or replacements) and provide a reasonable period for the School to object.

Sub-processor	Location	Purpose	Safeguards
Supabase	United Kingdom (London)	Database storage and authentication	Data processing agreement in place
Vercel	United Kingdom (London) for processing; global network for delivering pages	Application hosting and delivery	Data processing addendum in place; UK transfer safeguards for delivery outside the UK
Resend	European Union (Ireland)	Sending email, including alerts and sign-in emails	Data processing agreement in place; UK adequacy regulations
Stripe	United States and European Union	Billing; school contact details only, no pupil data	Data processing agreement in place; UK transfer safeguards
Google Firebase Cloud Messaging	United States	Delivering push notifications to devices	Data processing terms in place; UK transfer safeguards
Anthropic	United States	Support assistant that answers school staff's how-to questions; on by default, and the School can switch it off in Settings, Audit and governance, after which nothing is sent to Anthropic for the School; questions that appear to contain pupil details are refused, and no pupil data is sent	Data processing terms in place; UK transfer safeguards
Apple Push Notification service	United States	Delivering push notifications to iPhones and iPads	Data processing terms in place; UK transfer safeguards