Data Processing Agreement (DPA)

Between: Data Controller: [Insert School Name] ("The School") Data Processor: AtTech 360 Tours ("The Provider")

This Agreement supplements the Terms and Conditions of Service and governs the processing of personal data by the Provider on behalf of the School under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Subject Matter and Duration of Processing

The Provider processes personal data to create, host, and maintain interactive 360-degree virtual tours. The processing will continue for the duration of the commercial agreement between the parties or until the School requests the permanent deletion of the Tour.

2. Nature and Purpose of the Processing

Nature: Collection (via photography/videography), structuring, storage (hosting), restriction (blurring), and erasure.
Purpose: To provide a publicly accessible or restricted-access virtual representation of the School's learning environment for prospective parents and students.

3. Types of Personal Data and Categories of Data Subjects

Data Subjects: Students, teaching staff, administrative staff, and any authorized visitors present during the shoot.
Personal Data: Visual likenesses (photographs and videos), voices (audio recordings), student names (if visible on displays/work), and interactive student work (iPad recordings).

4. Obligations and Rights of the Data Controller (The School)

4.1 The School alone determines the purpose and means of the processing of personal data. 4.2 The School guarantees that it has a valid legal basis (e.g., explicit consent under Article 6(1)(a) UK GDPR) for the processing of any personal data captured within the Tour. 4.3 The School is responsible for managing data subject rights (e.g., right to erasure/withdrawal of consent) and communicating these requests to the Provider.

5. Obligations of the Data Processor (The Provider)

5.1 Processing on Instructions: The Provider shall process personal data only on documented instructions from the School, unless required to do so by UK law. 5.2 Confidentiality: The Provider ensures that personnel authorized to process the personal data have committed themselves to confidentiality. 5.3 Security of Processing: The Provider shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encrypting data in transit using TLS 1.2+ / HTTPS.
Using SFTP (Port 22) for all raw asset transfers.
Hosting data exclusively on UK-based servers (Krystal Hosting Ltd) with NVMe SSD encryption.
Implementing access controls to ensure only authorized personnel can access the source files. 5.4 Sub-processors: The Provider utilizes Krystal Hosting Ltd as a sub-processor for cloud infrastructure. The Provider confirms that Krystal Hosting Ltd is contractually bound to the same stringent data protection standards. The Provider shall not engage any new sub-processors without prior specific or general written authorization of the School. 5.5 Data Subject Rights: The Provider shall assist the School by appropriate technical and organizational measures, insofar as possible, for the fulfilment of the School's obligation to respond to requests for exercising data subject rights (e.g., blurring a student retrospectively). 5.6 Personal Data Breaches: The Provider shall notify the School without undue delay (and in any event within 24 hours) after becoming aware of a personal data breach affecting the Tour. 5.7 Deletion: Upon termination of the service, or upon written request by the School, the Provider shall permanently delete all personal data and copies thereof, unless UK law requires storage of the personal data.

6. Audit Rights

The Provider shall make available to the School all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the School or another auditor mandated by the School.

Signed on behalf of The Provider:

Date: _________________

Signed on behalf of The School:

Date: _________________