Data Processing Agreement (DPA)

Data Processing Agreement (DPA)

Last reviewed 6 November 2026

Between CimotaTech Ltd (Data Processor) and the Contracting School / Multi-Academy Trust (Data Controller)

This Data Processing Agreement ("DPA") forms part of the Master Terms of Service and governs the processing of Personal Data by CimotaTech Ltd (operating the Handwriting Horizons platform) on behalf of the Customer (the School, Multi-Academy Trust, or Local Authority), in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Roles and Scope

  • Data Controller: The Customer remains the Data Controller for all pupil and staff Personal Data, including Special Category Data (SEND information), synced or processed through the Handwriting Horizons platform.
  • Data Processor: CimotaTech Ltd acts solely as a Data Processor, processing Personal Data strictly on the documented instructions of the Controller.
  • Subject Matter and Purpose: The processing is exclusively for the provision of the Handwriting Horizons educational software, including automated MIS synchronization via the Wonde API, Single Sign-On (SSO) authentication, and the generation of tailored pedagogical interventions based on pupil profiles and SEND requirements.

2. Processor Obligations

CimotaTech Ltd agrees and warrants that it shall:

  1. Process Strictly by Instruction: Process Personal Data only on documented instructions from the Controller, unless required to do so by UK law.
  2. Ensure Confidentiality: Ensure that all personnel authorized to process Personal Data have committed themselves to strict confidentiality and hold current, enhanced DBS checks.
  3. Assist with Data Subject Rights: Provide technical and organizational assistance to the Controller to fulfill obligations to respond to requests from data subjects (such as parents or staff) exercising their rights under UK GDPR (e.g., Subject Access Requests).
  4. Data Protection Impact Assessments (DPIA): Assist the Controller in ensuring compliance with obligations regarding DPIAs, specifically regarding the processing of Special Category Data, and prior consultations with the Information Commissioner’s Office (ICO).

3. Security of Processing

Given the processing of Special Category (SEND) data, CimotaTech Ltd implements robust technical and organizational measures to ensure a level of security appropriate to the elevated risk:

  • Data Sovereignty: All Personal Data is hosted exclusively within enterprise-grade UK data centers (Google Cloud London/Cardiff regions). Data will not be transferred outside the UK.
  • Encryption: All Personal Data, including SEND markers, is encrypted in transit (TLS 1.3) and at rest (AES-256).
  • Access Control: Authentication is handled entirely via Zitadel SSO integrations (Google Workspace, Microsoft Entra ID, Hwb). CimotaTech does not store user passwords. Internal engineering access to live databases is strictly governed by Role-Based Access Control (RBAC) and limited to authorized P1 support resolutions.

4. Sub-processing

The Controller grants CimotaTech Ltd general authorization to engage third-party Sub-processors to deliver the service.

  • Current Sub-processors: Google Cloud (Hosting/Infrastructure), Wonde (MIS API Integration), and Zitadel (Identity Management).
  • Notification of Changes: CimotaTech will notify the Controller of any intended changes concerning the addition or replacement of Sub-processors at least 30 days prior, giving the Controller the opportunity to object. All Sub-processors are bound by data protection obligations mirroring those in this DPA.

5. Personal Data Breach Notification

In the event of a confirmed Personal Data breach affecting the Controller’s data, CimotaTech Ltd shall:

  • Notify the Controller without undue delay, and in any event within 48 hours of becoming aware of the breach.
  • Provide the Controller with sufficient information to allow them to meet any obligations to report to the ICO or inform affected Data Subjects.
  • Take all reasonable commercial steps to mitigate the effects and minimize any damage resulting from the breach.

6. Data Return and Deletion

  • Automated Offboarding: Upon a pupil's removal from the Controller's MIS via the Wonde sync, their data (including all SEND markers and progression history) is automatically flagged for secure deletion from CimotaTech's active databases.
  • Contract Termination: Upon termination of the Master Terms of Service, CimotaTech Ltd shall, at the choice of the Controller, delete or return all Personal Data, and delete existing copies unless UK law requires the storage of the Personal Data.

Schedule 1: Details of Processing

  • Categories of Data Subjects: Primary school pupils (EYFS to KS2), teaching staff, and school IT administrators.
  • Types of Standard Personal Data Processed:
    • Pupil Data: First name, last name initial, Year Group, Class Name, UPN (strictly for MIS sync matching).
    • Staff Data: Name, school email address, assigned classes, SSO authentication tokens.
    • Pedagogical Data: Platform usage metrics, grapheme progression data, motor-skill acquisition metrics.
  • Special Category Data (SEND):
    • To tailor the biomechanical and visual interfaces of the platform to individual learner needs, the platform ingests specific Special Educational Needs and Disabilities (SEND) flags from the Customer's MIS via the Wonde API (e.g., indicators for dyspraxia, dyslexia, visual impairments, or specific motor-skill interventions).
    • Controller Obligation: The Controller warrants that they have established a valid condition under UK GDPR Article 9 (e.g., Substantial Public Interest - Statutory/Government Purposes) to authorize the Processor to ingest and process this Special Category Data for the purpose of tailored educational delivery.