Data Processing Agreement
Version 2026-09-28 · Effective date: 28 September 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Scholarova Ltd (“Processor”, “Scholarova”) and the organisation that uses Scholarova to deliver education or training (“Controller”, “Organisation”) — for example a school, academy trust, tuition centre, college, or similar educational provider. It applies where Scholarova processes personal data on the Organisation’s documented instructions.
In case of any conflict or inconsistency with other terms included in the Agreement, this DPA will take precedence to the extent of such conflict or inconsistency.
This DPA does not apply to personal accounts that are not linked to an Organisation (for example some parent or individual learner accounts). For those uses, Scholarova is the controller as described in the Privacy Policy.
Related documents: Privacy Policy and sub-processors.
1. Roles
The Organisation is the controller of learner, parent, and staff personal data it submits to Scholarova. Scholarova is the processor. Where Scholarova determines purposes of its own account, billing, or security data, it is an independent controller as described in the Privacy Policy.
2. Subject matter and duration
Processing covers hosting the Service, authentication, class and course records, learning activity, assignments, and optional AI Coach features the Organisation enables. Processing lasts for the subscription and for the retention period in section 10.
3. Nature and purpose
Scholarova processes personal data only to provide the Service, on the Organisation’s instructions in these terms, the product settings (including AI Coach), and written directions from an organisation owner or admin (such as a school owner or school admin in the product), unless UK law requires otherwise. Scholarova will inform the Organisation of that legal requirement unless the law prohibits notice.
4. Types of personal data and data subjects
The categories of personal data Scholarova processes on the Organisation's instructions are listed in the personal data inventory (Privacy Policy section 2.0). We do not maintain a separate inventory in this DPA.
Data subjects are typically learners, teachers, organisation administrators, and parents linked to the Organisation.
How Scholarova applies the UK Age Appropriate Design Code to learners is described in the Children section of the Privacy Policy.
5. Processor obligations
Scholarova will:
- process personal data only on documented instructions;
- ensure people authorised to process it are under confidentiality obligations;
- implement appropriate technical and organisational security measures;
- respect the sub-processor terms in section 6;
- assist the Organisation with data-subject requests, security, and impact assessments, taking into account the nature of processing;
- notify the Organisation of personal data breaches as described in section 5.1;
- delete or return personal data at the end of the service, unless UK law requires storage;
- make available information needed to demonstrate compliance and allow reasonable audits.
Organisation and school admins can use in-product organisation data export for a named user or the whole organisation; individuals use Download my data in account settings — see the Privacy Policy subject access section.
5.1 Personal data breach notification
Scholarova will notify the Organisation by email only, without undue delay and within 48 hours of becoming aware of a personal data breach affecting Organisation personal data we process as processor, using contact details the Organisation has provided (including a data protection lead where recorded). The notification will describe, so far as available at that time, the nature of the breach; the categories and approximate volumes of personal data concerned; the likely consequences; and the measures taken or proposed to address the breach. Scholarova will provide further updates as appropriate.
6. Sub-processors
Scholarova will notify the Organisation at least 14 days in advance of introducing any new categories of personal data collection or material changes to data processing workflows. Notification will be provided via email to the Organisation’s registered administrative or data protection contact, or via an administrative platform notification.
7. International transfers
Where personal data is transferred outside the UK, Scholarova uses an approved safeguard, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy regulation.
8. AI Coach and other AI features
If the Organisation enables AI Coach or other AI-assisted features, processing follows the Privacy Policy personal data inventory and AI-assisted features sections (including children's defaults in section 9). The Organisation controls whether those features are on in product settings. Gateway routing, zero data retention, training restrictions, EU inference, Article 22, and retention are not restated here — see the Privacy Policy (sections 2.6, 6, and 9 as applicable).
Authorised sub-processors are listed at /subprocessors.
Onward sub-processors for AI inference (via Vercel AI Gateway) are on the same page, grouped by type of AI activity.
9. Organisation instructions via the product
An organisation owner or admin (for example a school owner or school admin) may invite the Organisation’s data protection lead to sign this DPA in the school card. The electronic signature records the signer’s name, role, and time, and is evidence that the Organisation has accepted this version.
10. Return and deletion
On written request at the end of the service, Scholarova will delete or return Organisation personal data within 90 days, except records Scholarova must keep for law, tax, or security. The full retention schedule (including leavers, security logs, backups, and cease trading) is in the Retention section of the Privacy Policy — we do not duplicate that schedule here.
11. Contact
Admin@scholarova.com
Scholarova Ltd, 13 West Street, Dunstable, LU6 1SL, United Kingdom. ICO registration ZC133337.