Draft: to be checked (ideally by someone with data-protection expertise) and completed before pupils use the service. Not legal advice.

Data processing agreement (for schools)

This summary sets out how [Operator name, e.g. your name trading as your brand] ("we") processes pupil data on behalf of a school ("the school") that uses Code & Commerce Quizzes. A signed copy is available on request from [contact email].

Roles	The school is the controller; we are the processor (UK GDPR Article 28).
Purpose	Running quizzes set by the school's teachers and showing them the results.
Data subjects	Pupils in classes created by the school's teachers; the teachers themselves.
Pupil data	First name and last initial per class, and quiz answers with times. No emails, accounts, photos, dates of birth or special category data.
Instructions	We process pupil data only to provide the service as the school's teachers use it, and never for advertising or profiling.
Location	Stored in the United Kingdom. No transfers outside the UK/EU.
Security	Encrypted connections, hashed passwords, isolation of each teacher's data, rate limiting, restricted admin access, regular updates. Cyber Essentials certification is planned for summer 2027.
Sub-processors	Our hosting and email providers only; the school will be told before any change.
Breaches	We will tell the school without undue delay, and within 48 hours of becoming aware of a breach affecting its data.
Deletion	Teachers can delete pupils, classes or their account at any time; deletion is permanent. At the end of the service we delete the school's data within 30 days.
Assistance	We help the school answer data-subject requests; teachers can export their data from Settings.