Data Processing Agreement

1. Roles and Definitions

Data Controller: The tuition centre subscribing to CentreFlow. The controller determines the purposes and means of processing personal data relating to their students, parents, and staff.

Data Processor: CentreFlow. We process personal data solely on the documented instructions of the controller and in accordance with this agreement.

Personal Data: Any information relating to an identified or identifiable natural person, as defined under UK GDPR.

2. Scope of Processing

CentreFlow processes the following categories of personal data on behalf of the controller:

• Student names, dates of birth, and contact details
• Parent and guardian names, email addresses, and telephone numbers
• Attendance records and session history
• Payment references and billing status
• Staff names, roles, and compliance records
• Communication logs and onboarding notes
• Digital form submissions and e-signature records

Processing activities include: storage, retrieval, structuring, display, export, and deletion.

3. Processor Obligations

CentreFlow commits to:

• Process personal data only on documented instructions from the controller
• Ensure that all staff with access to personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist the controller in responding to data subject rights requests
• Assist the controller in meeting GDPR obligations regarding security, breach notification, DPIAs, and prior consultation
• Delete or return all personal data at the end of the service relationship, at the controller's choice
• Make available all information necessary to demonstrate compliance and cooperate with audits

4. Controller Obligations

The tuition centre (controller) is responsible for:

• Ensuring they have a lawful basis to collect and process personal data
• Providing accurate and complete privacy notices to students and parents
• Obtaining any necessary consents prior to entering data into CentreFlow
• Ensuring only authorised staff are granted access to the platform
• Complying with all applicable data protection legislation

5. Security Measures

CentreFlow implements appropriate technical and organisational measures including:

• Encrypted data transmission (HTTPS/TLS)
• Hashed and salted password storage (bcrypt)
• Role-based access control limiting staff access to relevant data
• Centre-level data isolation ensuring cross-centre data access is prevented
• Audit logging of significant user actions
• Regular backups and recovery testing

6. Subprocessors

CentreFlow uses a limited number of trusted subprocessors to deliver the platform. We maintain a current list on our Subprocessors page. We will notify controllers of any intended changes to subprocessors with at least 14 days' notice, providing an opportunity to object.

7. Data Breach Notification

In the event of a personal data breach affecting data processed on behalf of the controller, CentreFlow will:

• Notify the affected controller without undue delay, and in any event within 72 hours of becoming aware of the breach
• Provide sufficient detail to allow the controller to meet their own ICO notification obligations where required
• Cooperate fully with the controller's breach investigation and remediation

8. Retention and Deletion

Upon termination of a subscription, CentreFlow will retain data for a 90-day grace period to allow for reactivation or data export. After this period, personal data will be securely deleted unless we are legally required to retain it for longer. Controllers may request earlier deletion by contacting privacy@centreflow.co.uk.

9. International Transfers

Where personal data is transferred outside the UK or EEA, CentreFlow ensures appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the ICO.

10. Governing Law

This DPA is governed by the laws of England and Wales and supplements the CentreFlow Terms and Conditions.