School Consent & Indemnity Declaration

Between: Data Controller: [Insert School Name] ("The School") Data Processor: AtTech 360 Tours ("The Provider")

This document serves as a formal declaration by the School regarding the lawful basis for processing personal data, specifically the visual likeness and voice of students, within the virtual tours created by the Provider.

1. Confirmation of Lawful Basis (Parental Consent)

1.1 The School confirms, warrants, and guarantees that it has obtained valid, legally binding, and explicit consent from the parent(s) or legal guardian(s) of every student whose face or identifiable characteristics are visible in any photographs or video footage used to construct the virtual tour.

1.2 The School acknowledges that under the UK GDPR, it acts as the Data Controller for the students' personal data, and it is the School’s sole responsibility to secure and retain these individual consent forms in its own records.

1.3 The School agrees that the Provider is not required to collect, review, or store copies of individual parental consent forms.

2. Indemnification

2.1 The School agrees to fully indemnify, defend, and hold harmless the Provider, its directors, employees, and agents from and against any claims, liabilities, damages, losses, fines (including ICO regulatory fines), and expenses (including legal fees) arising out of or in any way connected with the School’s failure to obtain proper consent for any student featured in the virtual tour.

3. Right to Erasure / Revocation of Consent

3.1 If a parent or legal guardian withdraws their consent at any point, the School must immediately notify the Provider in writing.

3.2 Upon receiving notification from the School, the Provider agrees to take prompt action (typically within 72 hours) to blur, obscure, or completely remove the student from the virtual tour, subject to technical feasibility.

4. Signatures

By signing below, the undersigned representative of the School confirms they have the authority to bind the School to the terms of this Declaration.

Signed on behalf of The School (Data Controller): ___________________________

Date: ___________________________

Print Name: ___________________________

Role/Position (e.g., Headteacher/DPO): ___________________________