HallAxis | School Data Processing Agreement

1. Parties, roles and precedence

HallAxis Ltd (Company No. 17469819), International House, 51 Borough High Street, London SE1 1NB, United Kingdom (HallAxis), is processor of personal data supplied or generated by the school, academy trust or exam centre identified in the applicable onboarding or service agreement (School), acting as controller.

The School determines the purposes and essential means of examination and workforce planning. HallAxis separately acts as controller for its own business administration, legal compliance, billing if enabled, and necessary account/security records, as described in its Privacy Notice.

This DPA supplements the service agreement. In the event of conflict regarding processing of School-controlled personal data, this DPA prevails to the extent required by applicable data-protection law. It takes effect only upon documented agreement by authorised representatives.

2. Instructions and processing

HallAxis shall process School Data only on documented instructions, including this DPA, Schedule A, configured workflows, authorised user actions and written support instructions, except where law requires otherwise; where legally permitted it shall inform the School before such processing.

HallAxis shall promptly inform the School if, in its opinion, an instruction infringes applicable data-protection law. HallAxis shall not sell School Data or use it for unrelated advertising. The School retains responsibility for final staffing decisions and approved rotas.

3. Confidentiality and access

Persons authorised to process School Data must be subject to appropriate confidentiality obligations. Access is limited to authorised school users and necessary HallAxis personnel. Privileged technical access for support, maintenance or security must be justified, controlled and subject to appropriate oversight.

4. Security

HallAxis shall implement appropriate technical and organisational measures in accordance with UK GDPR Article 32, including the controls in Schedule B, and review them as risks or services change. The School shall manage its own authorised users, account credentials, lawful uploads and permissions.

5. Subprocessors

The School grants general written authorisation, effective upon execution of this DPA, for HallAxis to use the subprocessors identified in Schedule C and its maintained register. HallAxis shall impose Article 28-equivalent obligations where required and remain responsible for subprocessor performance.

HallAxis shall notify the School of intended additions or replacements in advance, ordinarily at least 30 calendar days where practicable, and allow 15 calendar days for a reasoned data-protection objection. Urgent changes may require shorter notice with an explanation. HallAxis shall assess objections in good faith and consider safeguards or alternatives; where no reasonable lawful solution exists, the School may terminate affected services without an additional early-termination charge, subject to accrued charges.

6. International transfers

HallAxis shall not make a restricted transfer of School Data without an applicable lawful mechanism and any required supplementary safeguards. Supabase project hosting has been identified in Frankfurt, Germany; Vercel and other suppliers may involve international processing. HallAxis does not promise UK-only hosting.

7. Data subjects and compliance assistance

HallAxis shall assist the School, taking account of the nature of processing and information available, with data-subject rights requests, security and breach obligations, DPIAs and prior consultation where applicable. Requests about School Data shall ordinarily be referred to the School.

8. Breach notification and incident response

HallAxis shall notify the School without undue delay after becoming aware of a personal-data breach affecting School Data and provide available information concerning nature, likely consequences, affected data and mitigation, with follow-up updates as needed. The School determines its own regulatory and individual notifications.

9. Audit and information

HallAxis shall make available information reasonably necessary to demonstrate compliance with Article 28 and allow for and contribute to audits or inspections by the School or mandated auditor, subject to reasonable arrangements protecting confidentiality, other customers and service security without excluding statutory audit rights.

10. Return and deletion of School Data

At the end of the Services, HallAxis shall, at the School’s choice, securely return or delete personal data processed on its behalf, unless applicable law requires continued retention.

HallAxis shall confirm completion of the requested action and identify any information that must be retained for legal or regulatory purposes.

Where data remains temporarily within protected backup systems, it shall be safeguarded against routine use and removed in accordance with the applicable backup retention cycle. Any restored data shall remain subject to the School’s deletion instructions.

11. Liability, law and notices

Liability is subject to applicable law and the parties’ valid service agreement. Nothing excludes liability that cannot lawfully be excluded. This DPA is governed by the laws of England and Wales without prejudice to mandatory data-protection law. Contact: support@hallaxis.co.uk.

Schedule A — Processing description

Subject matter: Hosted examination workforce planning and operational communications.

Duration: Service/trial term plus instructed return/deletion and lawful retention periods.

Nature and purpose: Timetable and room imports; candidate aggregate counts; staffing demand, staff availability and capabilities; allocation, outputs, secure availability and rota emails; support and audit.

Data subjects: Authorised school users, invigilators and staff providing Access Arrangement support; student identity is not required for core processing.

Personal data: Work names/identifiers and contact details; staff availability, roles and shifts; school-user roles, account, authentication and audit records; room and paper/unit information.

Data minimisation: No need for student names, candidate identifiers, medical information, staff NI numbers, home addresses or banking data in core workflows.

Special-category data: Not required or intended; inadvertent uploads require assessment and appropriate restriction or removal.

Controller instructions: This DPA, service configuration, authorised actions and lawful documented written instructions.

Schedule B — Technical and organisational measures

Organisation-scoped authentication, memberships, role permissions, row-level security and server-side enforcement; platform-administrator controls for Gatekeeper functions.

TLS for transport, server-side secrets, restricted technical access, relevant audit/security records and tokenised individual availability links.

Schedule C — Subprocessors and transfer evidence

Supabase — Database/authentication; Frankfurt EU project. Supabase supplier DPA and applicable transfer safeguards.

Vercel — Application hosting/delivery; international processing possible. Vercel supplier DPA and applicable transfer safeguards.

IONOS — Mail Basic operational email/SMTP; EU/EEA supplier-attested. IONOS supplier DPA and applicable transfer safeguards.

GitHub — Private development/source code; development-only, not intended for School Data.

Schedule D — School details and execution

School/controller legal name and address: [complete]

School authorised representative, role and privacy/incident contact: [complete]

HallAxis authorised representative: [complete]

Service/order reference and effective date: [complete]

School end-of-service return/deletion instruction and delivery route: [record when applicable]