Data Processing Agreement

1. Roles

You are the controller and we are the processor of the personal data you enter about your students and parents. You determine the purposes and means of processing; we process only on your documented instructions (which include your use of the Service's features).

2. Subject matter & details

• Subject matter: provision of the TutorDesk tutoring-management service.
• Duration: for as long as your account is active, then per the retention terms in our Privacy Policy.
• Nature & purpose: storing and processing student/parent data to schedule lessons, set and mark homework, invoice, communicate and report progress.
• Types of personal data: names, contact details (incl. email), year/grade, subjects, lesson/homework records, grades, invoices/payments, messages and uploaded files.
• Categories of data subjects: your students (who may be children) and their parents/guardians.

3. Our obligations

• Process personal data only on your instructions and for the purposes above.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see our Security page).
• Assist you, so far as possible, with data-subject requests and with your security, breach-notification and impact-assessment obligations.
• Notify you without undue delay on becoming aware of a personal-data breach affecting your data.
• Delete or return personal data at the end of the service, except where law requires retention.
• Make available information needed to demonstrate compliance and allow for reasonable audits.

4. Sub-processors

You authorise us to engage the sub-processors listed in our Privacy Policy (currently Supabase — UK hosting; Resend — email; Vercel — hosting; Stripe — payments). We impose equivalent data-protection obligations on them and remain responsible for their performance. We'll give notice of intended changes so you can object.

5. International transfers

Primary storage is in the UK. Where a sub-processor processes data outside the UK, we ensure an appropriate safeguard (e.g. UK adequacy or the International Data Transfer Agreement/Addendum) is in place.

6. Children's data & your responsibilities

You confirm you have a lawful basis and, where required, parental consent before entering a child's data, and that you will meet your own safeguarding and record-keeping duties. We provide tools (export, deletion, message logging, retention) to support you.

7. Deletion & return

You can export your data and delete it (per student or whole account) at any time from Settings. On account closure we erase your data in line with the Privacy Policy. You're responsible for exporting any records you must retain before deletion.

8. Contact

Data-protection queries: privacy@tutor-desk.com.