Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between you (the Provider) and us, and sets out the terms on which we process personal data on your behalf under the UK GDPR (Article 28) and the Data Protection Act 2018.

1. Roles of the parties

In respect of the personal data you submit to or manage through the Service about your parents, carers, children and staff (“Provider Personal Data”), you are the Controller and we are the Processor. Each party will comply with its obligations under applicable data-protection law. This DPA does not apply to data for which we are the controller (for example your account and billing data), which is covered by our Privacy Policy.

2. Processing on your instructions

We will process Provider Personal Data only on your documented instructions — which include your use of the Service’s features and the settings you choose — and as necessary to provide and support the Service, unless we are required to process it by law (in which case we will inform you, unless the law prohibits it). If we believe an instruction breaches data-protection law, we will tell you. The subject matter, duration, nature, purpose, data types and data subjects are described in Schedule 1.

3. Our obligations as Processor

We will:

• process Provider Personal Data only as set out in clause 2;
• ensure that people authorised to process it are under an appropriate duty of confidentiality;
• implement the technical and organisational security measures in Schedule 2 (Article 32 UK GDPR);
• respect the conditions for engaging sub-processors (clause 6);
• assist you, taking into account the nature of the processing, in responding to data-subject requests (clause 7) and in meeting your obligations on security, breach notification and data-protection impact assessments;
• at your choice, delete or return Provider Personal Data at the end of the Service (clause 10); and
• make available the information reasonably needed to demonstrate compliance and allow for audits (clause 11).

4. Your obligations as Controller

You warrant that: you have a valid lawful basis (and any necessary consents, including for children’s and special-category data) for the Provider Personal Data; your instructions to us are lawful; and you have provided the required privacy information to your data subjects. You are responsible for the accuracy, quality and legality of Provider Personal Data and the means by which you acquired it.

5. Security

We will maintain appropriate technical and organisational measures to protect Provider Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, as described in Schedule 2. You are responsible for your own use of the Service, including keeping login credentials secure and configuring access for your staff appropriately.

6. Sub-processors

You give general authorisation for us to engage the sub-processors listed in Schedule 3 to help deliver the Service. We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance. We will give you reasonable notice of any intended addition or replacement of a sub-processor, and you may object on reasonable data-protection grounds.

7. Assisting with data-subject requests

The Service provides tools to help you access, correct, export and delete Provider Personal Data. Taking into account the nature of the processing, we will assist you by appropriate measures, so far as possible, to respond to requests from data subjects exercising their rights. If a data subject contacts us directly about Provider Personal Data, we will refer them to you.

8. Personal data breaches

We will notify you without undue delay after becoming aware of a personal-data breach affecting Provider Personal Data, and provide information reasonably available to help you meet your own notification obligations to the ICO and affected individuals.

9. International transfers

We will not transfer Provider Personal Data outside the UK/EEA except where an appropriate safeguard is in place (such as an adequacy decision or the ICO’s International Data Transfer Agreement / Standard Contractual Clauses), or where you instruct such a transfer.

10. Return & deletion

On termination of the Service, we will, at your choice, delete or return Provider Personal Data and delete existing copies within a reasonable period, unless the law requires us to retain it. Provider Personal Data may be available for export for a reasonable window before deletion.

11. Audit & information

We will make available information reasonably necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate — on reasonable prior notice, no more than once per year (unless required by a regulator or following a breach), during business hours, subject to confidentiality and without unreasonably disrupting our operations or compromising other customers’ security.

12. Liability

Each party’s liability under or in connection with this DPA is subject to the exclusions and the limitation of liability in the main Terms of Service, and this DPA is subject to those Terms.

13. Term

This DPA takes effect when you accept it (at sign-up or otherwise) and continues for as long as we process Provider Personal Data on your behalf.

Schedule 1 — Details of processing

• Subject matter: provision of the ActivityLane platform to the Provider.
• Duration: the term of the Provider’s account plus the deletion window in clause 10.
• Nature & purpose: hosting, storing, organising and processing personal data to operate bookings, registers, communications, finance, staff and related features.
• Types of personal data: contact details of parents/carers; children’s names, dates of birth and attendance; special-category data where the Provider chooses to record it (allergies, medical needs, SEND, safeguarding notes); staff records; booking and payment metadata (card data is handled by Stripe, not stored by us).
• Categories of data subjects: the Provider’s parents/carers, children, staff and contacts.

Schedule 2 — Technical & organisational security measures

• Encryption of data in transit (HTTPS/TLS) and at rest;
• Role-based, least-privilege access controls and logical tenant isolation between Providers;
• Secure authentication; passwords stored only as salted hashes;
• Hosting on reputable cloud infrastructure (Google Cloud / Firebase) holding recognised security certifications;
• Resilience measures built into our hosting infrastructure;
• Logging and monitoring to detect and respond to incidents;
• Confidentiality obligations and access-on-a-need basis for personnel;
• Breach-response procedures.

Schedule 3 — Authorised sub-processors

• Google Cloud / Firebase — hosting, database, authentication (UK/EU regions).
• Stripe — payment processing (PCI-DSS certified; card data handled by Stripe).
• Resend (email delivery) — transactional and (where consented) marketing email.
• Vercel — website hosting and delivery (UK/EU regions).
• Hetzner Online GmbH — application server hosting (EU data centre).
• HMRC — only if direct payment through HMRC is used for Tax-Free Childcare (not yet available).

Questions about this DPA? Contact Kaz James at info@activitylane.com.