Data Processing Agreement

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the service agreement between:

Effective from: [DATE]

1. Definitions

In this DPA, "Personal Data", "Processing", "Data Subject", "Controller", and "Processor" have the meanings given in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope and Purpose

The Processor shall process Personal Data on behalf of the Controller solely for the purpose of providing the Markaloud transcription and feedback generation service, which includes:

• Receiving and storing audio recordings of verbal academic feedback
• Transcribing audio recordings into text using third-party speech-to-text services
• Transcribing viva voce audio recordings with speaker identification using third-party speech-to-text services
• Processing transcripts through AI language models to draft written feedback, with suggested marks against the rubric, for the Controller's users to review and edit
• Storing transcripts, generated feedback, and associated metadata
• Providing the Controller's authorised users with access to the above data

3. Types of Personal Data

The Processor may process the following categories of Personal Data:

• Audio recordings containing verbal feedback about identifiable students
• Student names (where provided by the Controller's users)
• Text transcripts derived from audio recordings
• AI-generated feedback text relating to identified students
• Passages of student work that the Controller's users highlight while annotating it
• Teacher/staff names and email addresses for account management
• Assessment scores and rubric evaluations

4. Data Subjects

The categories of Data Subjects are:

• Students of the Controller whose work is being assessed
• Teaching staff and academic employees of the Controller who use the service

5. Processor Obligations

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, unless required to do so by law
• Ensure that persons authorised to process Personal Data have committed to confidentiality
• Implement appropriate technical and organisational security measures, including:
  • Encryption of data in transit (TLS 1.2 or above)
  • Encryption of backups (age public-key encryption) before they leave the server
  • Password hashing using bcrypt with per-user salts
  • Access controls and authentication for all users
  • Logical data segregation between organisations
  • An activity log of sign-ups, account and plan changes, transcriptions, feedback generation, account data exports and deletions (opening feedback or playing recordings isn't logged)
  • Regular security updates and vulnerability monitoring
• Not engage another processor without prior written authorisation of the Controller (see Section 6)
• Assist the Controller in responding to Data Subject rights requests
• Delete or return all Personal Data at the end of the service period, at the Controller's choice
• Make available all information necessary to demonstrate compliance and allow for audits on reasonable notice

The Processor is registered with the Information Commissioner's Office (registration number ZC216212).

6. Sub-Processors

The Controller hereby provides general written authorisation for the Processor to engage the following sub-processors:

The Processor shall inform the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object. Data Processing Agreements are in place with all sub-processors listed above, and none of them may use the data to train AI models.

Error monitoring (GlitchTip) and the off-site backups are self-hosted by Otherworld Dev in the UK, so no third party is involved. Error reports carry account and record identifiers, never what a submission says, and are kept for 90 days. Backups are encrypted before they leave the server, and the off-site copies are kept for up to 60 days (database) and 120 days (recordings).

7. International Transfers

Personal Data is transferred to sub-processors located outside the United Kingdom. These transfers are subject to appropriate safeguards under Chapter V of the UK GDPR, including:

• The International Data Transfer Addendum issued by the ICO to the EU Standard Contractual Clauses, in respect of transfers to United States sub-processors
• UK adequacy regulations in respect of transfers to sub-processors within the European Economic Area
• The EU-US Data Privacy Framework and its UK Extension, where the receiving sub-processor is certified under it
• Written Data Processing Agreements with each sub-processor
• Short, fixed API-side retention windows with no model training (see Section 6)

8. Data Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data breach. The notification shall include:

• The nature of the breach, including categories and approximate number of Data Subjects affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact details of the Processor's data protection point of contact (privacy@markaloud.cloud)

9. Data Retention and Deletion

The Processor shall retain Personal Data only for as long as necessary to provide the service. Upon termination of the agreement, the Processor shall:

• Delete all Personal Data within 30 days of termination, unless retention is required by law
• Provide written confirmation of deletion upon request
• Offer data export in a structured, machine-readable format (JSON) prior to deletion

During the agreement, audio recordings are deleted automatically once they are older than the retention period set for the Controller's organisation, which can be from 90 days to 6 years (1 year unless the Controller changes it). Transcripts, feedback and marks are kept until the Controller's users delete them, or until termination.

Personal Data held in encrypted backups is deleted in the ordinary course of backup rotation. Database backups are kept for 14 days on the hosting server and 60 days off-site, and audio backups for 35 days on the hosting server and 120 days off-site, so nothing is held in a backup for more than 120 days. Restoration of backup data for any purpose is prohibited during the retention period.

Individual users may delete their own data at any time through the application's account settings, which removes all associated submissions, audio files, transcripts, and feedback, and anonymises their activity log. Activity logs are otherwise anonymised after 12 months: the action and its time are kept, nothing that identifies a person.

10. Duration and Termination

This DPA shall remain in effect for the duration of the service agreement between the parties. It shall automatically terminate upon expiry or termination of the service agreement, subject to the data deletion obligations in Section 9.

11. Governing Law

This DPA shall be governed by and construed in accordance with the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.