School Data Processing Agreement

The subscribing school, trust or education organisation (the "Controller") determines the purposes and means of processing school-controlled personal data. ReadRight Pro (the "Processor") processes that personal data on the Controller's behalf.

Processing is limited to providing and securing the contracted ReadRight Pro service, providing support, acting on documented Controller instructions, and meeting legal obligations. Processing continues for the duration of the subscription and any agreed wind-down period.

Data subjects are pupils and authorised school staff.

• Pupil identity and class information (such as name, class and year group)
• Reading assessment information, including texts used, timing and responses
• Temporary reading audio where required for transcription and analysis
• Derived assessment measures and assessment history
• Staff account information, including name, work email address and account role

Special-category and safeguarding information is not required for the standard service, and schools should not intentionally enter unrelated sensitive information.

ReadRight Pro will maintain appropriate confidentiality, access controls and technical and organisational safeguards appropriate to the risk, and will ensure that personnel with access to Controller Personal Data are subject to a duty of confidentiality.

ReadRight Pro will assist the Controller with appropriate data-subject requests, security obligations, breach responsibilities and data protection impact assessments where applicable.

ReadRight Pro will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller Personal Data, and will provide the information reasonably available to support the Controller's own obligations.

ReadRight Pro may use necessary sub-processors subject to appropriate contractual safeguards. A Sub-processor Register is available to Controllers on request from hello@readrightpro.com.

Where a restricted international transfer of Controller Personal Data is required, it must be made using an appropriate lawful UK transfer mechanism.

On termination of the service, or on the Controller's instruction, school-controlled personal data will be deleted or returned where technically available, subject to applicable law and to secure provider backup and deletion cycles.

Requests and queries under this agreement should be sent to hello@readrightpro.com. See also our Privacy Notice and Data Protection information.