AB Tutor Data Processing Agreement — Cloud Service

Last updated: 9 October 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between the subscribing organisation (the “School”, “you” — the data controller) and AB Tutor Limited (“AB Tutor”, “we” — the data processor), for use of the AB Tutor cloud service. A separate DPA applies to on-premise deployments, where the School hosts all data on its own infrastructure. It is written to satisfy Article 28 of the UK GDPR and EU GDPR and to help you complete your own risk assessments and Data Protection Impact Assessments.

In plain language: you decide what data goes into AB Tutor and why; we process it only on your instructions, keep it secure, tell you quickly if anything goes wrong, help you answer requests from parents and students, and delete everything when you leave.

1. Roles and scope

You are the controller of all personal data processed through your AB Tutor subscription, including data about students and staff. We are your processor. Where we process data about your admin contacts for billing and account management, we act as an independent controller under our Privacy Policy.

2. Subject matter, nature and purpose of processing

3. Categories of personal data

Data collected depends on which features you enable. Monitoring features are off unless turned on by the School.

* Only collected when the relevant feature is enabled by the School. The School is responsible for ensuring its own lawful basis, transparency to students and parents, and (where applicable) DPIA cover these features. Monitoring data may include special category data incidentally captured (e.g. a student typing about their health); we process it only as part of the enabled feature and never for our own purposes.

4. Our obligations as processor

We will:

1. process personal data only on your documented instructions (this DPA and your configuration of the service), unless required otherwise by law — in which case we will tell you unless legally prevented;
2. ensure all personnel with access are bound by confidentiality obligations;
3. implement the technical and organisational measures in section 7;
4. meet the sub-processor conditions in section 5;
5. assist you, taking into account the nature of the processing, in responding to data subject rights requests (section 8);
6. assist you with your security, breach notification, DPIA and prior-consultation obligations under Articles 32–36 UK GDPR;
7. delete or return personal data at the end of the subscription (section 9);
8. make available the information necessary to demonstrate compliance, and allow and contribute to audits (section 12).

5. Sub-processors

You provide general written authorisation for the sub-processors listed below. We will give you at least 30 days’ notice of any intended addition or replacement, giving you the opportunity to object.

Only Linode processes student service data. Our licensing system, business email and helpdesk exist to serve the School’s staff and administrators; students’ and parents’ personal data does not flow into them in normal operation. If your staff choose to include student personal data in a support ticket or email, see section 10.

Optional integrations (enabled by you, acting on your instructions): the service can sync rosters and authentication with Google (Google Workspace for Education) and Microsoft Entra ID. These operate under your own agreements with Google/Microsoft; enabling a sync is your instruction to us to exchange the relevant directory data with your tenant.

Each sub-processor is bound by a written contract imposing data protection obligations equivalent to this DPA, and we remain fully liable to you for their performance.

6. International transfers

Your service data is hosted in the Linode cluster corresponding to your location: UK and EU schools in the EU cluster; US schools in the US cluster; Australian schools in the Australia cluster. Data therefore generally stays in or near your own jurisdiction (UK-to-EU transfers are covered by the UK’s adequacy regulations for the EEA; Australian schools should note their data is hosted in Australia and the Privacy Act 1988 (Cth) applies to their own obligations). Limited personal data may be transferred outside the UK/EEA via the sub-processors above; for UK and EU schools, hosting (Linode EU), licensing (AWS Ireland) and support (Crisp, EU) all remain in the UK/EEA. Where any transfer does occur, we rely on the UK IDTA / UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified. We do not use marketing platforms for school service data.

7. Security measures

We maintain appropriate technical and organisational measures including: encryption of data in transit (TLS) and at rest; role-based access control and least-privilege access for our staff; logical separation of customer data; hardened cloud infrastructure; logging and monitoring; a written information security programme with at least annual risk assessment and review; background checks and data protection training for staff. AB Tutor Limited is certified to ISO/IEC 27001 and holds Cyber Essentials. Our certificates are available to schools on request. The cloud service runs on shared infrastructure; each school’s data is held in a separate database, logically isolated from every other school’s.

8. Data subject rights and complaints

Requests from students, parents or staff should be handled by you as controller — individuals should contact the School first. If we receive a request or a data protection complaint directly, we will pass it to you without undue delay and will not respond except on your instruction. We provide in-service tools and support (via support@abtutor.com) to help you locate, export, correct or delete an individual’s data within your statutory deadlines.

9. Retention, deletion and return

10. Personal data your staff send to support

Please do not include student personal data in support tickets, emails or chat messages. If your staff do so (for example a screenshot showing a pupil’s screen), we process it only to resolve that ticket, on your instruction, and delete it on closure. While held it sits in our helpdesk (Crisp, EU) or business email (Microsoft 365, UK) as listed in section 5.

11. Service telemetry

The software reports feature-usage telemetry to us: counts of which product features are used, together with your licence key / school name so we can tell which installation a count came from. It contains no personal data about any individual — no names, no user identifiers, no device identifiers, no content, no IP-based identifiers. No IP address is retained at the telemetry endpoint (confirmed with engineering, September 2026). Telemetry can be disabled on request — contact support@abtutor.com. It is not student data and is not covered by this DPA’s processor obligations, but we disclose it here for transparency.

12. Audit

On request, we will provide the information reasonably necessary to demonstrate compliance with this DPA, including security documentation and sub-processor details. You (or your appointed auditor, not a competitor of ours) may audit our compliance on reasonable notice, no more than once per year unless required by a supervisory authority or following a personal data breach.

13. Personal data breach notification

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data, providing the information required by Article 33(3) UK GDPR as it becomes available and updating you as more becomes known. We will not notify your regulator or your data subjects on your behalf unless you instruct us to, the law requires it of us, or we are required to notify on our own behalf.

Investigation. We will cooperate fully with your investigation of the breach. We will make available the information, logs and personnel reasonably required to establish what happened, which data was affected and what the likely consequences are, and we will answer reasonable questions from you or your regulator.

Remediation. Responsibility for determining and implementing remedial and preventative measures for the service, and the timescale for doing so, rests with us, and we will tell you what we have done and when. We will consider in good faith any specific measure you ask for. Where a requested measure would degrade the security, availability or integrity of the service for other customers, conflict with obligations we owe them, or is not technically feasible, we may decline it — in which case we will say so, explain why, and set out what we are doing instead.

This section gives effect to Article 28(3)(f) UK GDPR: our obligation is to assist you, taking into account the nature of the processing and the information available to us.

14. Liability and general

Liability under this DPA is subject to the limitations in the AB Tutor Licence Agreement. This DPA is governed by the law governing the AB Tutor Licence Agreement.

15. Jurisdiction-specific terms

15.1 US schools

If you are a US school or district, COPPA and FERPA (and applicable state student privacy laws) apply to your use of the service.

FERPA. We accept the conditions that allow you to disclose education records to us under the “school official” exception (34 CFR § 99.31(a)(1)(i)(B)): we perform an institutional service you would otherwise use employees for; we act under your direct control with respect to the use and maintenance of education records; we use those records only for the purposes you authorise; and we do not re-disclose personal information from them without your authorisation or as required by law. FERPA’s obligations fall on you as the educational agency or institution, not on us directly. The exception is only available to you if your annual notification of FERPA rights identifies contractors of this kind as school officials with a legitimate educational interest — please confirm that it does.

COPPA. We do not seek verifiable parental consent directly. Consistent with the FTC’s published guidance on COPPA and schools, we rely on the School to authorise the collection of students’ personal information on parents’ behalf, solely for use in the educational context — see our Children’s Privacy Notice (COPPA) — Cloud Service. You should satisfy yourself that you have authority to give that authorisation and should make the notice available to parents. We note that this school-authorisation route rests on FTC guidance rather than on the text of the COPPA Rule: the FTC proposed codifying a school-authorisation exception in its 2025 amendments and elected not to adopt it, pending anticipated FERPA rulemaking. We will update these terms if the position changes.

Purpose limitation. We use student data only to provide the service — never for advertising, marketing, profiling, sale, or training AI models. This includes the limitation that matters to the school-authorisation route above: we do not use students’ personal information for any commercial purpose beyond delivering the service to you.

Where a state student-privacy law requires specific contractual terms — for example New York Education Law §2-d and its Parents’ Bill of Rights, or California AB 1584 — we agree those terms with the district as a supplement to this DPA. Those statutes impose duties on vendors directly and are not displaced by the FERPA position above.

15.2 Australian schools

Your data is hosted in our Australian cluster. Where the Privacy Act 1988 (Cth) applies to us, we comply with the Australian Privacy Principles directly in addition to this DPA, including APP 11 (security and destruction) through the retention schedule in section 9 of this DPA. Overseas disclosures (support via Crisp in the EU; licensing via AWS Ireland; service email via Microsoft 365) are made consistently with APP 8, with APP-equivalent obligations imposed on each sub-processor. If we become aware of an eligible data breach under the Notifiable Data Breaches scheme, we will notify you within 48 hours per section 13 of this DPA and cooperate on any required notifications to the OAIC and affected individuals. Government schools are also subject to their own state privacy legislation (for example the NSW Privacy and Personal Information Protection Act 1998 or the Victorian Privacy and Data Protection Act 2014), which binds the school rather than us. Any additional obligation flowing from that legislation — data locality commitments, prescribed security standards, audit rights, specific breach-notification terms or the like — applies to us only where we have expressly agreed to it in writing, in the applicable order form or a signed addendum to this DPA. We are willing to discuss reasonable state-specific terms; nothing in this DPA commits us in advance to requirements we have not seen.

15.3 EU schools

For EU schools, references to the UK GDPR in this DPA include the EU GDPR as applicable, and references to the ICO include your competent supervisory authority. We are appointing an EU representative under EU GDPR Art. 27; details will be added here once engaged.

Contact

All notices, questions, requests and complaints under this DPA: support@abtutor.com.