Data Processing Agreement

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the service agreement between:

Effective from: [DATE]

1. Definitions

In this DPA, "Personal Data", "Processing", "Data Subject", "Controller", and "Processor" have the meanings given in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope and Purpose

The Processor shall process Personal Data on behalf of the Controller solely for the purpose of providing the Markaloud transcription and feedback generation service, which includes:

• Receiving and storing audio recordings of verbal academic feedback
• Transcribing audio recordings into text using third-party speech-to-text services
• Transcribing viva voce audio recordings with speaker identification using third-party speech-to-text services
• Processing transcripts through AI language models to generate structured feedback
• Storing transcripts, generated feedback, and associated metadata
• Providing the Controller's authorised users with access to the above data

3. Types of Personal Data

The Processor may process the following categories of Personal Data:

• Audio recordings containing verbal feedback about identifiable students
• Student names (where provided by the Controller's users)
• Text transcripts derived from audio recordings
• AI-generated feedback text relating to identified students
• Teacher/staff names and email addresses for account management
• Assessment scores and rubric evaluations

4. Data Subjects

The categories of Data Subjects are:

• Students of the Controller whose work is being assessed
• Teaching staff and academic employees of the Controller who use the service

5. Processor Obligations

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, unless required to do so by law
• Ensure that persons authorised to process Personal Data have committed to confidentiality
• Implement appropriate technical and organisational security measures, including:
  • Encryption of data in transit (TLS 1.2 or above)
  • Disk-level encryption at rest on the underlying hosting infrastructure
  • Password hashing using bcrypt with per-user salts
  • Access controls and authentication for all users
  • Logical data segregation between organisations
  • Audit logging of data access and processing activities
  • Regular security updates and vulnerability monitoring
• Not engage another processor without prior written authorisation of the Controller (see Section 6)
• Assist the Controller in responding to Data Subject rights requests
• Delete or return all Personal Data at the end of the service period, at the Controller's choice
• Make available all information necessary to demonstrate compliance and allow for audits on reasonable notice

The Processor is registered with the Information Commissioner's Office (registration number C2001194).

6. Sub-Processors

The Controller hereby provides general written authorisation for the Processor to engage the following sub-processors:

The Processor shall inform the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object. Data Processing Agreements are in place with all sub-processors listed above. No sub-processor uses API data for model training.

7. International Transfers

Personal Data is transferred to sub-processors located outside the United Kingdom. These transfers are subject to appropriate safeguards under Chapter V of the UK GDPR, including:

• The International Data Transfer Addendum issued by the ICO to the EU Standard Contractual Clauses, in respect of transfers to United States sub-processors
• UK adequacy regulations in respect of transfers to sub-processors within the European Economic Area
• The EU-US Data Privacy Framework and its UK Extension, where the receiving sub-processor is certified under it
• Written Data Processing Agreements with each sub-processor
• Zero API-side retention where applicable (see Section 6)

8. Data Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data breach. The notification shall include:

• The nature of the breach, including categories and approximate number of Data Subjects affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact details of the Processor's data protection point of contact (admin@otherworld.dev)

9. Data Retention and Deletion

The Processor shall retain Personal Data only for as long as necessary to provide the service. Upon termination of the agreement, the Processor shall:

• Delete all Personal Data within 30 days of termination, unless retention is required by law
• Provide written confirmation of deletion upon request
• Offer data export in a structured, machine-readable format (JSON) prior to deletion

Personal Data held in encrypted backups is deleted in the ordinary course of backup rotation (maximum 90 days). Restoration of backup data for any purpose is prohibited during the retention period.

Individual users may delete their own data at any time through the application's account settings, which removes all associated submissions, audio files, transcripts, and feedback.

10. Duration and Termination

This DPA shall remain in effect for the duration of the service agreement between the parties. It shall automatically terminate upon expiry or termination of the service agreement, subject to the data deletion obligations in Section 9.

11. Governing Law

This DPA shall be governed by and construed in accordance with the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.