Data Processing Agreement for UK, EU, Australia and rest of world

This Data Processing Agreement ("DPA") forms part of the Agreement between:

• Chalkie AI Ltd, a company registered in England and Wales (company no. 15812522), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Chalkie"); and
• the school, trust, district or other educational organisation on whose behalf the account holder uses the Service ("Customer").

Where this DPA is accepted through the Terms of Service or within the Service rather than signed, the Customer is the school, trust, district or other educational organisation on whose behalf the account holder uses the Service, and the account holder accepts this DPA on the Customer's behalf under clause 1.3 of the Terms of Service.

It governs the processing of personal data by Chalkie in connection with the Chalkie service (the "Service"). In this DPA, "Agreement" means Chalkie's Terms of Service together with any order form, quote or other contract under which the Customer uses the Service. Where the Agreement conflicts with this DPA on data protection, this DPA prevails.

1.1 Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" carry the meanings given in the UK GDPR and the Data Protection Act 2018 (together, "UK Data Protection Law"). Where the Customer is established in the European Economic Area, they carry the meanings given in Regulation (EU) 2016/679 (the "EU GDPR"). References to the "GDPR" in this DPA mean whichever of these applies to the Customer. This DPA also applies to Customers established outside the United Kingdom, the European Economic Area and the United States, including Australia. For Customers in Australia, Chalkie will process personal data in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Before disclosing personal data to any overseas recipient listed in Annex B, Chalkie will take reasonable steps to ensure that the recipient handles it consistently with the Australian Privacy Principles. Chalkie remains responsible for the acts and omissions of its sub-processors.

1.2 Roles.

• For personal data that the Customer or its users submit to, or generate through, the Service, the Customer is the controller and Chalkie is the processor.
• Where teachers register for and use Chalkie accounts directly, Chalkie acts as an independent controller of that teacher account data, as described in Chalkie's Privacy Policy.
• Live Activities participation. Students never create accounts, and there is no cross-lesson student profile. When answering is enabled, Chalkie processes that lesson's display names, participant IDs, responses, scores and timestamps on the Customer's instructions so the teacher can run the activity and review results. Display names are generated automatically as nicknames, but students can edit them, so a display name may contain a student's real name (see clause 4).

2.1 Chalkie processes personal data only to provide the Service, and only on the Customer's documented instructions (including as set out in this DPA and the agreement), unless required otherwise by law (in which case Chalkie will notify the Customer before processing, where legally permitted). Chalkie will inform the Customer without delay if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.

2.2 Chalkie will not process personal data for any other purpose, and specifically will not sell personal data, use it for advertising or marketing to data subjects on behalf of third parties, or use it for any other commercial purpose beyond delivering the Service. Chalkie does not use Customer personal data or Customer content to train AI models.

2.3 The subject matter, duration, nature and purpose of processing, and the types of data and categories of data subject, are described in Annex A.

3.1 Confidentiality and training. Chalkie ensures that persons authorised to process the personal data have committed themselves to confidentiality and receive data-protection and security training before being given access, refreshed annually. On request, Chalkie provides written attestation of training completion.

3.2 Least access. Access to personal data is restricted to personnel who need it to deliver or support the Service, protected by multi-factor authentication, and logged (administrative access to user records is recorded in an audit log). Access is revoked on the day a person leaves Chalkie.

3.3 Assistance. Taking into account the nature of processing and the information available to it, Chalkie assists the Customer (by appropriate technical and organisational measures) in fulfilling the Customer's obligations under Articles 32 to 36 of the GDPR: responding to data subject requests, securing processing, notifying breaches, and carrying out data protection impact assessments and prior consultations.

3.4 Information for schools. On request, Chalkie provides the information a school or education authority needs for its own records of processing, data protection impact assessments and supplier due diligence, including its Security Whitepaper, Subprocessor List, retention policy and public DPIA.

4.1 Students never create Chalkie accounts, emails, passwords or school logins, and Chalkie does not build a student profile across lessons. The Service has no facility for school rosters or class lists.

4.2 When a teacher enables answering in Live Activities, Chalkie processes that lesson's display names, participant records, responses, scores and timestamps on the Customer's instructions so the teacher can review results during and after the lesson. Each student who joins is given an automatically generated nickname as their display name. Students can edit this display name, and a teacher may ask students to enter their own name, so a display name may identify a student. Teachers can see each display name alongside that student's responses and scores. Those records stay so the teacher can review results during and after the lesson. Ending a session does not delete them, and there is no automatic deletion period. The teacher can delete a session's results in the Service. The Customer can also ask for return or deletion at any time under clause 7.2, and Chalkie deletes them on termination under clause 10.1. Deleted records may remain in encrypted database backups until those backups expire, within approximately 90 days. If a backup is restored, Chalkie re-applies any later deletion. Hosting and the real-time connection provider process the technical data needed to run the lesson.

4.3 Content sent to Chalkie's AI sub-processors to generate resources comprises only curriculum parameters and teacher-authored instructions. Student answers are marked against the activity's answer key using fixed rules; they are not sent to any AI provider for assessment, and no student data is used to train AI models.

4.4 Because display names may contain real names, Chalkie treats all stored display names, responses and scores as personal data of the students concerned, whether or not a student has changed their nickname. Chalkie does not request, and the Service is not designed to collect, special-category data from students. If such information is nonetheless submitted, Chalkie will assist the Customer with access, return or deletion.

4.5 The student-facing Live Activities pages carry no analytics, advertising, session-replay or tracking scripts, and set no tracking cookies on student devices.

4.6 The Customer may ask Chalkie, at hello@chalkie.ai, to switch off answering in Live Activities for its school accounts. While answering is switched off, students can still follow the teacher's lesson on their own devices, but no student responses, scores or display names are stored, and the processing described in clauses 4.2 to 4.4 does not take place.

4.7 Each Live Activities session is stored separately. A display name and participant ID apply to one session only, and the Service provides no means of linking a student's results across sessions. Any combining of results across sessions (for example, by a teacher exporting results and merging them outside the Service) happens outside Chalkie and under the Customer's control.

4.8 The Customer is responsible for giving students and parents any privacy information it is required to give about its use of Live Activities, and may rely on clause 4 and Annex A for that purpose.

5.1 Chalkie implements appropriate technical and organisational measures to protect personal data (GDPR Article 32), described in Chalkie's Security Whitepaper and including, at minimum:

• Encryption of personal data in transit (TLS) and at rest (managed PostgreSQL with LUKS full-volume AES encryption, and AES-256-encrypted backups).
• Role-based access controls with multi-factor authentication on administrative systems, and an audit log of administrative access to user records.
• Hosting on managed infrastructure in the European Union (see clause 9), with encrypted cross-region backups.
• Logging, monitoring and alerting to support detection of and response to incidents.
• Independent penetration testing at least annually.

5.2 Chalkie maintains a written data security and privacy programme aligned to the NIST Cybersecurity Framework, reviewed at least annually.

6.1 The Customer provides general authorisation for Chalkie to engage sub-processors to deliver the Service. The sub-processors that handle Live Activities data are listed in Annex B. The full list of current sub-processors, the data each receives and their locations is set out in Chalkie's Subprocessor List, published in the Privacy Policy.

6.2 Chalkie engages sub-processors only under a written contract imposing the same data protection obligations as those set out in this DPA, and remains liable for its sub-processors' performance.

6.3 When Chalkie adds or replaces a sub-processor that processes Customer personal data, Chalkie emails the Customer and updates the published Subprocessor List. The Customer may object on reasonable data-protection grounds. The parties will discuss the objection in good faith, and if it cannot be resolved the Customer may terminate the affected part of the Service.

7.1 Chalkie assists the Customer in responding to data subjects exercising their rights under Chapter III of the GDPR, without undue delay and in time for the Customer to meet its own legal deadlines. For teacher account data held by Chalkie as controller, teachers may exercise rights directly with Chalkie (access, rectification, erasure, restriction, portability, objection and marketing opt-out).

7.2 The teacher can delete a session's results in the Service. Other requests concerning Live Activities records (access, correction, return or deletion) are made by the Customer to hello@chalkie.ai. Chalkie fulfils them without undue delay and in time for the Customer to meet its own legal deadlines. Parents and students make such requests through the Customer, and Chalkie assists the Customer in responding to them.

8.1 Chalkie notifies the Customer without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting the Customer's personal data, so that the Customer can meet its own obligations under Articles 33 and 34 of the GDPR (including notification to the Information Commissioner's Office, or other competent supervisory authority, within 72 hours).

8.2 The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Chalkie cooperates with the Customer's own notification obligations and with the competent supervisory authority.

9.1 Personal data is hosted in the European Union (Amsterdam, Netherlands). Encrypted database backups of that data, including Live Activities records, are stored in the United Kingdom (London). Chalkie is established in the United Kingdom. Transfers from the United Kingdom to the EEA are covered by the UK's adequacy regulations for the EEA, and transfers from the EEA to the United Kingdom, including those backups, are covered by the European Commission's adequacy decision for the United Kingdom.

9.2 Where a sub-processor listed in the Subprocessor List processes personal data outside the United Kingdom or the EEA, the transfer is made under an appropriate transfer mechanism: for transfers from the UK, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; for transfers from the EEA, the EU Standard Contractual Clauses; or, where the receiving sub-processor is certified, the UK Extension to the EU-US Data Privacy Framework or the Data Privacy Framework itself. If the Standard Contractual Clauses or UK transfer terms conflict with this DPA, they prevail.

10.1 On termination or expiry of the agreement, Chalkie will, at the Customer's choice, return or delete the personal data it processes on the Customer's behalf, and delete production copies, within 30 days, unless retention is required by law. Encrypted backups remain until they expire, within approximately 90 days. On request, Chalkie certifies deletion in writing.

10.2 Deletion of teacher account data follows Chalkie's Data Retention & Destruction Policy: identifying fields are irreversibly de-identified and third-party records (billing, email marketing) are removed; de-identified aggregate statistics may be retained and contain no personal data. Copies in encrypted backups age out within approximately 90 days.

10.3 Live Activities records. Live Activities display names, participant records, responses, scores and timestamps are kept so that teachers can return to a lesson's results later. They are not deleted when the session ends, and there is no automatic deletion period. The teacher can delete a session's results in the Service. The Customer can also ask Chalkie to delete a lesson's records at any time under clause 7.2, and Chalkie deletes them on termination under clause 10.1. Deleted records may remain in encrypted database backups until those backups expire, within approximately 90 days; if a backup is ever restored, Chalkie re-applies any deletions made after that backup was taken.

11.1 Chalkie makes available all information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, including its Security Whitepaper, Subprocessor List, NIST CSF self-assessment and most recent penetration-test attestation.

11.2 Chalkie allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable prior notice and no more than once per year, except following a personal data breach affecting the Customer or where required by a supervisory authority. Where available, up-to-date third-party reports or certifications will be provided to minimise operational disruption.

12.1 Term. This DPA runs for the duration of the agreement and the processing.

12.2 Governing law. Where the Customer is established in the United Kingdom, this DPA is governed by the laws of England and Wales. Where the Customer is established in the European Economic Area, this DPA is governed by the laws of the EU member state in which the Customer is established. In each case this is without prejudice to the mandatory data-protection laws applicable to the Customer. Where the Customer is established outside the United Kingdom, the European Economic Area and the United States, this DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction. This does not affect any mandatory data protection law that applies to the Customer in the country where it is established.

12.3 Liability. Liability under this DPA is subject to the limitations in the underlying agreement, except where such limitation is not permitted by law.

12.4 Changes. Chalkie may update this DPA, provided the update does not reduce the protection given to Customer personal data. Chalkie emails the Customer when it updates this DPA, and when a change to the Service materially changes how Customer personal data is processed. If an update or change materially changes how Customer personal data is processed, the Customer may object and, if the objection cannot be resolved, may ask for the affected feature to be switched off for its accounts or terminate the affected part of the Service. Changes to sub-processors are handled under clause 6.3.

12.5 Survival. Chalkie's obligations under this DPA continue for as long as Chalkie or its sub-processors hold any Customer personal data, including after the Agreement ends.

12.6 Acceptance and signature. This DPA takes effect when the Customer, or an account holder acting on the Customer's behalf, accepts it electronically through the Terms of Service or within the Service, or when it is signed. It may be signed electronically and in counterparts, each of which is an original.

12.7 Entire agreement on data protection. From the date it is accepted, this DPA replaces any earlier version of the Chalkie Data Processing Agreement accepted by click-through or signed on Chalkie's standard terms. It does not replace an agreement on the Customer's or a consortium's own form, or any agreement containing terms the parties specifically negotiated; where such an agreement exists, it prevails over this DPA to the extent of any inconsistency.

12.8 Order of precedence. If there is a conflict between this DPA and the Terms of Service, this DPA prevails for the processing of personal data. If there is a conflict between this DPA and an agreement the Customer and Chalkie have separately signed, the signed agreement prevails.

For use where the DPA is signed rather than accepted electronically (clause 12.6). Agreed by the parties:

Chalkie — Name, title, date, signature.

Customer — Name, title, date, signature.

The sub-processors below handle Live Activities data. The full list of sub-processors for the Service is in Chalkie's Subprocessor List in the Privacy Policy.

No AI provider receives student data.