Data Processing Agreement

For schools and organisations · Version 2.0 · Last updated: 9 September 2026

1. Definitions and interpretation

In this DPA:

• Data Protection Legislation means the UK GDPR (Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and any statutory guidance or code of practice issued by the Information Commissioner that applies to the processing, each as amended or replaced.
• Customer Personal Data means personal data that SYE processes on behalf of the Customer in providing the service, as described in Annex 1.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor means a third party engaged by SYE to process Customer Personal Data on SYE's behalf.
• Controller, processor, personal data, special category data, data subject and processing have the meanings given in the UK GDPR.

References to a clause or annex are to a clause or annex of this DPA. The annexes form part of it.

Order of precedence

Where there is a conflict, the following order applies, highest first:

1. the Standard Contractual Clauses and UK International Data Transfer Addendum entered into under clause 16;
2. this DPA;
3. the Terms of Service;
4. any other document forming part of the agreement between the parties.

This DPA prevails over the Terms of Service on any matter concerning the processing of personal data, and nothing in the Terms limits or varies it.

Acceptance

This DPA is accepted in the product, by a person who confirms at the time that they are authorised to accept it on the Customer's behalf. Acceptance is required before a school account can be created, and again whenever a new version is issued. SYE records, and will produce to the Customer on request, the version accepted, the name and role the accepting person gave, and the date and time.

Where a school account was created before this mechanism existed, this DPA also takes effect on the Customer's continued use of the service to provide accounts to its pupils, until the Customer's administrator completes that acceptance.

A countersigned copy is available on request to support@smashyourexams.com and, once countersigned, is the operative version between the parties.

2. Parties and roles

This DPA is between Smash Your Exams Education Ltd ("SYE", "we"), a company registered in England & Wales (company no. 15461413) with its registered office at 42 Hampstead Close, Blyth, NE24 3XE, ICO registration no. ZB758252, and the Customer (the school or organisation accepting this DPA).

Data	Customer	SYE
Pupil personal data, and data about the Customer's staff arising from their use of the service (classes, assignments, feedback they write, audit entries)	Controller	Processor
Billing and subscription data, account administration, correspondence with SYE support, and security telemetry (sign-in records, rate-limiting, fraud and abuse prevention)	—	Independent controller. Our Privacy Policy applies.
Data of an individual or teacher who signs up directly rather than through a school	—	Controller. Our Privacy Policy applies.

For Customer Personal Data, SYE processes only on the Customer's documented instructions. Neither party is a joint controller with the other.

3. Subject-matter, duration, nature and purpose

• Subject-matter & purpose: providing the SYE Code learning platform — accounts, classes, assignments, saving pupils' code and progress, marking, written feedback from the Customer's teachers to named pupils, AI-assisted help, and the safeguarding detection described in clause 10 — to the Customer's pupils.
• Duration: for the term of the Customer's licence and until data is returned or deleted under clause 13.
• Nature of processing: collection, storage, organisation, retrieval, use, automated analysis as described in clause 10, and erasure, as set out in Annex 1.

4. Customer instructions

SYE processes Customer Personal Data only on the Customer's documented instructions (including this DPA, the Terms, and configuration choices made in the product), unless required to do otherwise by law — in which case we will inform the Customer first unless the law forbids it. We will tell the Customer if, in our opinion, an instruction breaches Data Protection Legislation.

5. The Customer's obligations

The Customer warrants and undertakes that:

• it is the controller of the Customer Personal Data, and the person accepting this DPA is authorised to do so on its behalf;
• it has a lawful basis under Article 6 (and, where applicable, a condition under Article 9) for the processing it instructs, and its instructions comply with Data Protection Legislation;
• it has provided the privacy information required by Articles 13 and 14 to its pupils and, where appropriate, to those with parental responsibility for them, covering the processing described in this DPA including the AI features and safeguarding detection in clause 10;
• it has named a safeguarding contact in the product before enabling the AI tutor, and will keep that contact current — the AI tutor is blocked for a school with no safeguarding contact named (clause 10);
• it is responsible for what its staff and pupils enter into free-text fields, including code, AI tutor messages and teacher feedback notes, and will instruct them not to record special category data there;
• it will keep account credentials secure, remove staff access promptly when someone leaves, and is responsible for acts and omissions of its authorised users; and
• it will nominate a data protection contact for notices under clause 19 and keep it current.

6. SYE's own use of Customer Personal Data

SYE does not use Customer Personal Data for its own purposes. In particular we do not, and will not:

• use it to train, fine-tune or evaluate any machine learning model, our own or a third party's;
• use it for product development, benchmarking, research or analytics beyond what is necessary to provide, secure and support the service to the Customer;
• use it for marketing, or to contact the Customer's pupils for any purpose other than operating the service;
• sell it, or disclose it to any third party other than a sub-processor listed in Annex 3 acting on our instructions, or where required by law; or
• combine it with data from other customers other than as anonymous aggregate statistics.

Where SYE anonymises Customer Personal Data as an alternative to deletion under clause 13, it will do so irreversibly, such that no individual can be identified from the result by SYE or by anyone else using means reasonably likely to be used. Data that has been anonymised in that way ceases to be personal data and may be used for aggregate statistics about how the service is used. If it cannot be anonymised to that standard, it is deleted instead.

7. Confidentiality and personnel

We ensure that personnel authorised to process Customer Personal Data are bound by confidentiality (by contract or statutory duty), are trained on their data-protection obligations, and are granted access only to what their role requires. Personnel screening is described in Annex 2.

8. Security

We implement appropriate technical and organisational measures to protect Customer Personal Data, as described in Annex 2, taking into account the state of the art, the costs of implementation, and the risks to data subjects (UK GDPR Article 32). We will not materially reduce those measures during the term.

9. Sub-processors

The Customer gives general authorisation for SYE to engage the sub-processors listed in Annex 3. We impose data-protection obligations on each sub-processor equivalent to those in this DPA, and remain fully liable to the Customer for their acts and omissions.

We will give the Customer at least 30 days' written notice, to its nominated data protection contact, before adding or replacing a sub-processor. Within that 30 days the Customer may object on reasonable data-protection grounds, setting out the grounds in writing. If it does:

1. we will work with the Customer in good faith to make the feature available without the objected-to sub-processor, or to propose an alternative;
2. if we cannot do so within 30 days of the objection, the Customer may terminate the affected part of the service, or the whole licence if the affected part is material to it, on written notice and without penalty; and
3. on such a termination we will refund any pre-paid fees for the terminated part covering the period after termination, calculated pro rata.

Where a change is needed urgently to protect the security or availability of the service, we may make it immediately and notify the Customer as soon as possible afterwards; the objection right in this clause then applies from the date of that notice.

10. AI features, safeguarding detection and automated processing

10.1 What the AI features are

SYE Code uses OpenAI's API for five things: the AI tutor; "Explain this code"; explaining an error message; written feedback on a pupil's submitted work; and screening a message a pupil sends to the tutor (clause 10.5). The model used for the first four is OpenAI's gpt-4o-mini and for screening omni-moderation-latest.

10.2 What is sent, and what is not

What is sent to OpenAI is the challenge (its title, description and requirements), the code the pupil has written, any part of it they have highlighted, and the messages in the current tutor conversation. Where the AI tutor is used, the pupil's own typed message is sent twice: once to the tutor model to be answered, and once to OpenAI's separate moderation model as the second pass of the screen described in clause 10.5.

SYE attaches no identifier to any of it. We do not send the pupil's name, display name, username, email address, account identifier, class or school with any request, and we do not set OpenAI's optional end-user identifier field. A request carries the work, not the person who wrote it.

We cannot, however, prevent a pupil writing a name into free text — their own, or someone else's — in a message to the tutor or in a comment in their code, and such a message is sent as written. Pupils are asked not to. The Customer should cover this in what it tells its pupils about using the service.

10.3 Training and retention at OpenAI

SYE uses OpenAI's API, not its consumer products. Data submitted through the API is not used by OpenAI to train or improve its models. OpenAI retains API request data for up to 30 days for abuse monitoring and then deletes it, unless zero data retention is in force for the account. SYE has not applied for zero data retention, so the 30-day abuse-monitoring window applies. Within that window the data carries no identifier that could attribute it to a named pupil (clause 10.2).

10.4 Turning the AI off

The Customer may disable AI features, and that choice is contractual, not merely a product setting. There are three levels, and the most restrictive that applies to a pupil wins:

Level	Set by	Options	Effect
School	A school administrator	on / off / none	off removes the AI tutor; the code and error explainers remain. none removes every AI feature in clause 10.1. Either way the tutor is unavailable, so no message is screened and no safeguarding alert can arise — see the note below clause 10.5. Applies everywhere, including free practice.
Class	A teacher	on / hints_only / off	hints_only restricts the tutor to a nudge with no code.
Assignment	A teacher	inherit / hints_only / off	Overrides the class setting for that assignment.

A school that has never made a choice is set to none. AI features are off until an adult at the school turns them on. Nothing about a pupil is sent to OpenAI for a school at the none level.

Separately, and regardless of the above, the AI tutor is blocked for any school that has not named a safeguarding contact in the product. From 1 September 2026 this is enforced with no grace period.

10.5 Safeguarding detection

Messages a pupil sends to the AI tutor are screened before the tutor answers. Screening runs in two layers: a local phrase list held in SYE's own code, which works even if OpenAI is unavailable, and OpenAI's moderation endpoint, which can only add to the local result and never reduce it. Screening applies only to the AI tutor. Code, saved work and teacher feedback notes are not screened.

There are two outcomes:

• Urgent — a possible disclosure of self-harm, abuse, or a threat to another person. The message is not sent to the tutor model and the tutor does not answer it. The pupil is shown Childline, Samaritans and Shout. The school's named safeguarding contact is emailed immediately, and the pupil's class teachers and school administrators are emailed separately so they are not the last to know.
• Concern — offensive or abusive language. This appears in the teacher's list in the product as a behaviour note. It is not a safeguarding referral, is not emailed to the safeguarding contact, and is deliberately kept distinct from one.

No alert email contains the pupil's words. An email says which pupil, what category of concern was matched, and where to sign in to read it. The text the pupil wrote stays in the product, behind the Customer's own authenticated access.

A flag records the category, the severity, which detector matched, an excerpt of the pupil's message of up to 2,000 characters, the challenge, when the school was notified, and — once a member of the Customer's staff has reviewed it — who reviewed it, their note and the outcome. Retention is in Annex 4.

The Customer remains responsible for its own safeguarding duties, including under Keeping Children Safe in Education. SYE's detection is an alerting aid to the Customer and is not a safeguarding decision, a referral, or a substitute for the Customer's own procedures. It will not catch everything, and it will sometimes flag something innocuous.

10.6 Automated processing and marking

Whether a pupil's program passes is decided by a deterministic test runner, not by AI. The AI contributes three things alongside it: written feedback, an assessment of whether each stated requirement has been met, and a check on whether the code genuinely solves the task rather than printing hardcoded values.

All of these are advisory. They inform the Customer's teacher; they do not set a grade, determine progression, or produce any other decision with a legal or similarly significant effect on a pupil. A teacher can override the outcome recorded for a pupil in the product. SYE does not carry out automated decision-making within the meaning of Article 22 in providing the service.

The Customer should be aware that the "genuine code" check is an automated judgement about a child's work that a teacher may act on, and should treat it as a prompt to look, not as a finding.

11. Assistance to the Customer

• Data-subject rights: taking into account the nature of the processing, we assist the Customer by appropriate technical and organisational measures (including the product's data export and erasure tools) to respond to requests to exercise pupil rights. If a request reaches us directly we will not respond to it substantively, and will refer it to the Customer without undue delay.
• Security, breach notification and DPIAs: we assist the Customer in ensuring compliance with its obligations under Articles 32–36, including data protection impact assessments and prior consultation, taking into account the information available to us.

12. Personal data breaches

We notify the Customer's nominated data protection contact without undue delay, and in any event within 24 hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data. A breach at a sub-processor that affects Customer Personal Data is a breach for the purposes of this clause.

The notification will include, so far as known at the time and updated as more becomes known:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address it and to mitigate its effects;
• a contact point for further information; and
• where known, when the breach occurred and when we became aware of it.

We will take reasonable steps to contain and remediate the breach, and will co-operate with the Customer in its own notifications to the Information Commissioner and to data subjects. The Customer, as controller, is responsible for deciding whether and how to make those notifications. Notification under this clause is not an admission of fault or liability.

13. Retention, return and deletion

On termination of the licence, and at the Customer's choice, we delete or return all Customer Personal Data and delete existing copies, unless retention is required by law. The product supports Customer-initiated export and erasure at any time. Absent a Customer instruction, data is deleted or anonymised within 6 months of the licence ending. The Customer may request an export, or immediate deletion, at any point in that period, and we will act on such a request within 30 days. A lapsed licence removes access to the service; it does not by itself delete data, so that a school that renews late, or that needs an export after the fact, does not find its pupils' work gone.

Backups. Deletion under this clause applies to live systems. Customer Personal Data may persist in encrypted, isolated backups after deletion. Those backups are not restored into production other than to recover from a failure, are subject to the same security measures, and age out on the ordinary backup cycle within 30 days of deletion. If a backup is restored, deletion is re-applied to the restored data.

In-service retention windows. Some data has a retention window that runs during the licence, not only at the end of it. Those windows are set out in Annex 4 and are enforced by an automated job that runs daily. That job selects on identifiers and dates only; it does not read, log or return the text of a message or a note.

Teacher feedback notes. The 24-month window in Annex 4 is SYE's default. It is a product constraint that the Customer should take into account before purchase: at 24 months a note is permanently deleted and cannot be recovered, whether or not it has been withdrawn. A Customer that needs a longer period for a specific record should export it, or contact us to agree a different window before that point. SYE will not delete a note under this window where the Customer has notified us in writing that it is required for a live complaint, appeal, SEN process or safeguarding matter.

Erasure of a pupil. Erasing a pupil through the product's erasure tool deletes the feedback notes about that pupil immediately and irreversibly. Because a teacher may have recorded something in a note that the Customer is required to keep, the Customer should export a pupil's notes before erasing them. Erasure is the Customer's instruction and SYE cannot reverse it.

14. Records and co-operation with the Information Commissioner

SYE maintains a written record of the categories of processing carried out on behalf of the Customer, as required by Article 30(2), and will make it available to the Customer on request. We co-operate, on request, with the Information Commissioner in the performance of its tasks, and will notify the Customer without undue delay if we receive a communication from the Commissioner that relates to the Customer's processing, unless we are prohibited from doing so.

15. Audit

We make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on the following terms:

• the Customer will first accept any current documentation, security summary or third-party certification we make available, where that reasonably answers its question;
• audits take place no more than once in any 12-month period, on at least 30 days' written notice, during normal business hours, and must not unreasonably disrupt the service;
• the auditor must not be a competitor of SYE and must be bound by confidentiality obligations no less protective than those in this DPA;
• the Customer bears its own costs and the auditor's; SYE bears its own costs for up to two working days of staff time per audit, and beyond that the Customer reimburses our reasonable costs at our then-current rates; and
• the frequency and notice limits do not apply where the audit follows a Personal Data Breach affecting the Customer, or is required by the Information Commissioner or by law, in which case SYE bears its own costs.

16. International transfers

Some sub-processors are located outside the UK. The transfer mechanism for each is stated in Annex 3. We will not transfer Customer Personal Data outside the UK except under a mechanism permitted by Chapter V of the UK GDPR.

Where the mechanism is the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, SYE enters into them with the sub-processor and, where required, does so as the Customer's agent and on its behalf; the Customer authorises SYE to do so. Where a sub-processor is certified under the UK Extension to the EU–US Data Privacy Framework, that mechanism applies and is identified as such in Annex 3.

SYE carries out and documents a transfer risk assessment for each restricted transfer, and will make it available to the Customer on request. UK or EU data residency is not currently offered; a Customer that requires it should contact us before purchase.

17. Children's data

SYE Code is provided to schools for use by pupils, and is likely to be accessed by children. SYE has regard to the Information Commissioner's Age Appropriate Design Code in designing and operating the service. In particular: analytics are consent-gated and are not run for pupil accounts; pupils are not profiled for marketing; no nudge techniques are used to encourage a pupil to weaken their privacy settings; AI features are off for a school until an adult at the school turns them on; and the AI tutor is blocked entirely for a school with no safeguarding contact.

Where a school provides accounts to its pupils, SYE relies on the school to determine and evidence the lawful basis for the processing and to provide privacy information to pupils and parents (clause 5). SYE does not seek consent from a child, does not offer the service directly to children, and does not operate an age-verification step for pupils whose accounts are created by their school; the school confirms the ages of its pupils by the fact of enrolling them.

18. Liability

Each party's total aggregate liability arising out of or in connection with this DPA, including for any breach of Data Protection Legislation, is subject to the limitation of liability in clause 10 of the Terms of Service, and does not exceed the amount paid by the Customer for the service in the 12 months before the claim. That single cap applies across this DPA and the Terms taken together, and is not increased by there being more than one claim.

Nothing in this DPA limits or excludes either party's liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be limited.

Each party is responsible for any administrative fine imposed on it by the Information Commissioner to the extent the fine arises from its own breach of Data Protection Legislation or of this DPA. Neither party is liable for a fine imposed on the other to the extent it arises from that other party's own acts or omissions.

Subject to the cap above, SYE indemnifies the Customer against losses arising from SYE's breach of this DPA, and the Customer indemnifies SYE against losses arising from the Customer's breach of clause 5, including where its instructions to SYE were unlawful or where it had no lawful basis for the processing it instructed.

19. Term, variation, notices and governing law

Term. This DPA takes effect on acceptance (clause 1) and continues for as long as SYE processes Customer Personal Data. Clauses 6, 12, 13, 14, 15, 18 and this clause survive its termination.

Variation. SYE may amend this DPA on 30 days' written notice to the Customer's nominated data protection contact. No amendment will materially reduce the protection given to Customer Personal Data. If an amendment does materially and adversely affect the Customer, the Customer may object in writing within those 30 days, and if the parties cannot agree within a further 30 days the Customer may terminate the licence without penalty and receive a pro-rata refund of pre-paid fees. Every version of this DPA is kept at a stable, versioned address; the version in force when the Customer accepted it remains available on request.

Notices. Notices under this DPA are given in writing to:

• SYE: support@smashyourexams.com, marked for the attention of the data protection contact;
• the Customer: the data protection contact it has nominated under clause 5, or failing that the administrator contact on its account.

Governing law. This DPA and any dispute arising out of it, including non-contractual disputes, are governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

Annex 1 — Details of the processing

Item	Detail
Categories of data subjects	The Customer's pupils; the Customer's staff who administer accounts, teach classes or write feedback.
Categories of personal data — pupils	Display name; per-school username; password hash (where the school provisions the account); email address (where the pupil signs in with their school Google or Microsoft account — see the note below); class and assignment membership; learning progress and completion; the code the pupil writes and saves; work shared through a share link.
Categories of personal data — staff	Name, email address, role in the school and in each class; the safeguarding contact's name and email; content of feedback notes and flag reviews they write.
AI tutor conversations	Where the Customer has enabled the AI tutor: the messages a pupil sends to it and the replies, held with the pupil's account, the school and the challenge. Kept so a teacher can see what a class is using the tutor for and so a flagged message has its surrounding context. Retention in Annex 4.
Safeguarding flags	Where a screened message matches (clause 10.5): the category and severity, which detector matched, an excerpt of the pupil's message of up to 2,000 characters, the challenge, when the school was notified, and the reviewing member of staff, their note and the outcome. Retention in Annex 4.
Teacher feedback notes	Written feedback from one of the Customer's teachers to a named pupil, attached to an exercise, a lesson or a challenge: the text the teacher writes (up to 2,000 characters), who wrote it, which pupil it is about, the class, the school, the times it was written, edited and withdrawn, whether the pupil has opened it, and optionally a line number and that line of the pupil's code. Writing a note also sends the pupil an in-app alert; the alert names the teacher and the lesson and contains none of the note text, so the text exists in this table alone. Readable only by the pupil the note is about and by teachers who are members of that pupil's class — see Annex 2.
Technical and security data	Session tokens with hashed IP addresses; sign-in attempts and rate-limiting counters; an audit log of significant actions (who did what, to which pupil, and when, deliberately without the text of any note or message).
Support correspondence	Messages sent to SYE support by the Customer's staff, and any feedback submitted through the product. SYE is an independent controller for this (clause 2).
Special category data	None is required by the service, and none is sought. However, three fields accept free text written by or about a child — the code editor, the AI tutor, and teacher feedback notes — and text entered there may in practice contain special category data. The Customer must instruct its staff not to record safeguarding, medical, SEN or other special category information in feedback notes (clause 5). SYE does not review, moderate or filter what a teacher writes. Safeguarding flags are treated as special category data. A flag records an automated assessment that a child's message may concern self-harm, abuse or a threat, together with an excerpt of what they wrote. The Customer processes it under Article 9(2) — in a UK school ordinarily (b) or (g) read with Schedule 1 of the Data Protection Act 2018 — and should record it in its ROPA and cover it in its DPIA accordingly.
Frequency	Continuous, for the duration of the licence.
Processing operations	Account provisioning; storing and displaying progress and code; deterministic marking against a test table; AI-assisted feedback, hints, code explanation and error explanation; automated screening of AI tutor messages and safeguarding alerting; recording and displaying written feedback from a teacher to a pupil; automated retention pruning; and erasure and export on request.

Annex 2 — Technical and organisational measures

Access control

• Role-based permissions throughout: pupil, teacher, school administrator.
• Passwords stored only as scrypt hashes. School-provisioned pupil accounts hold no email address.
• Session tokens with hashed IP addresses; login-attempt rate limiting, budgeted so that one pupil's failed sign-ins cannot lock out others sharing their school's IP address.
• Teacher feedback notes are scoped to the class: a note can be read, written, corrected or withdrawn only by teachers who are members of the class the note was written in, and read by the pupil it is about. Membership of the school alone gives no access, and no other pupil or school can reach it. There is one exception, so that the Customer never loses the ability to correct or withdraw its own record: if the class a note was written in is deleted, the note survives (so that it can still be produced under clause 11) but no teacher can then be a member of it, and the Customer's school administrators may list and withdraw those notes and those alone.
• SYE staff access to production systems is limited to those who need it for support and operations. Multi-factor authentication is enforced on SYE staff access to the production database and to the hosting console.
• Personnel screening: SYE is a two-director company and both directors hold an enhanced DBS check, held in their capacity as practising teachers and tutors. No other personnel have access to pupil data. Any future member of staff with such access will be DBS-checked before being granted it.

Encryption

• Encryption in transit: HTTPS/TLS for all connections to the service and to every sub-processor.
• Encryption at rest: application and database hosting are provided by Neon and Vercel, both of which encrypt stored data at rest as standard. SYE does not operate its own servers or storage.

Logging and audit

• An audit log of significant actions, recording who did what, to which pupil, and when. Writing, correcting and withdrawing a feedback note each add an entry, deliberately without the text of the note.
• Withdrawal of a note hides it rather than deleting it: the pupil and the teachers stop seeing it (the alert the pupil was sent is deleted with it), the record that it existed and was withdrawn is retained until the note is deleted at the 24-month point under Annex 4, and SYE can produce that record to the Customer on request.
• The audit log is retained for the duration of the licence and is deleted or returned with the Customer's other data under clause 13.

Data minimisation

• No identifier is sent to OpenAI (clause 10.2).
• No safeguarding alert email contains the pupil's words (clause 10.5).
• The retention pruning job selects on identifiers and dates only and never reads or logs the text it deletes.
• Analytics are consent-gated and are not run for pupil accounts; pupils are not profiled.
• Customer-initiated data export and erasure are available in the product at any time.

Testing, resilience and assurance

• Dependencies are patched on the supported release lines of the hosting platform and framework, and security updates applied promptly.
• An automated test suite runs on every change before deployment.
• Backups: all Customer Personal Data is held in a Neon Postgres database, which provides continuous point-in-time recovery to any moment within its history retention window, which is up to 30 days. Vercel hosts the application only and stores no Customer Personal Data. Recovery is a restore of the whole database to a chosen point in time; SYE does not offer restoration of an individual pupil's record from a backup.
• Security review and testing: an internal security review of the whole application was carried out in July 2026, covering authentication, session handling, tenant separation and access control, payment integrity, and abuse and cost controls. Its findings have been actioned. No independent external penetration test has been carried out to date. SYE will commission one before, or as a condition of, any contract with a Customer that requires it, and will share the summary report with the Customer under confidentiality.
• Certifications: SYE does not currently hold Cyber Essentials, Cyber Essentials Plus or ISO 27001.
• Insurance: SYE does not currently hold cyber liability or professional indemnity insurance.

Annex 3 — Authorised sub-processors

Sub-processor	Purpose	Location	Transfer mechanism
Neon Inc.	Database hosting (account, learning, feedback, tutor and safeguarding data)	United States; EU region available	EU SCCs + UK IDTA
Vercel Inc.	Application hosting, serverless functions and content delivery	United States; global edge network	EU SCCs + UK IDTA
OpenAI, L.L.C.	AI tutor, code and error explanation, written feedback, and moderation screening. Receives the challenge, the pupil's code and the tutor conversation. Receives no identifier (clause 10.2).	United States	EU SCCs + UK IDTA
Google LLC	Google sign-in, where a school's pupils or staff join using a Google account. Receives the sign-in request; returns the account's email address and display name.	United States	UK Extension to the EU–US Data Privacy Framework
Microsoft Corporation	Microsoft sign-in, where a school's pupils or staff join using a Microsoft 365 account. Receives the sign-in request; returns the account's email address and display name.	United States; EU Data Boundary for eligible services	UK Extension to the EU–US Data Privacy Framework
Stripe, Inc. / Stripe Payments Europe, Ltd.	Payment and subscription billing for school account holders. No pupil data.	Ireland and United States	EU SCCs + UK IDTA
Resend (Plus Five Five, Inc.)	Transactional email to the Customer's staff, including safeguarding alerts. An alert carries the pupil's name and the category of concern, and never the pupil's words (clause 10.5).	United States	EU SCCs + UK IDTA

Optional, consent-gated analytics (Google Analytics, PostHog) do not run for pupil accounts and do not process Customer Personal Data. They are not sub-processors for the purposes of this DPA.

Annex 4 — Retention schedule

These windows run during the licence and are enforced by an automated job that runs once a day. They apply in addition to deletion on termination under clause 13.

Data	Window	Measured from
AI tutor conversations	90 days	When the message was sent
Safeguarding flags that the Customer's staff have reviewed and closed	365 days	When it was reviewed
Safeguarding flags not yet reviewed	Retained until reviewed, then as above	—
Teacher feedback notes, including withdrawn ones	24 months (default — see clause 13)	When the note was written
Pupil code, progress, accounts, audit log	Duration of the licence	Deleted or returned under clause 13

Questions about this DPA, or to request a signed copy: support@smashyourexams.com.