Schools Data Processing Agreement

Last reviewed 9th November 2026

This Data Processing Agreement ("DPA") forms part of the agreement under which Jolly Learning provides Jolly Classroom to the School (the "Service Agreement").

It is entered into between:

Jolly Learning Ltd
77 Hornbeam Road
Buckhurst Hill
Essex
IG9 6JX
United Kingdom

("Jolly Learning", "Processor", "we", "us")

and

the school, academy trust, local authority or other educational organisation that has subscribed to or is authorised to use Jolly Classroom

("School", "Controller")

together, the "Parties".

1. Purpose and Status of this DPA

1.1 This DPA sets out the terms on which Jolly Learning processes Personal Data on behalf of the School in connection with Jolly Classroom.

1.2 It is intended to meet the requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR") and, where applicable, equivalent requirements under the EU General Data Protection Regulation ("EU GDPR").

1.3 This DPA forms part of the Service Agreement between the School and Jolly Learning. If there is a conflict between this DPA and the Service Agreement in relation to the processing of Personal Data, this DPA will take precedence to the extent of that conflict.

1.4 The School acts as Controller in relation to Personal Data it places into, synchronises with, or otherwise processes through Jolly Classroom.

1.5 Jolly Learning acts as Processor when processing that Personal Data on the School's behalf.

1.6 Jolly Learning acts as an independent Controller where it determines the purposes and means of processing Personal Data relating to School business contacts, authorised adult users and the School’s account for its own customer relationship management, billing, fraud prevention, legal compliance and licence enforcement purposes.

Such processing will be limited to the contact, account, billing and technical usage information necessary for those purposes. Jolly Learning will comply with its obligations as Controller under Applicable Data Protection Law and explain the relevant processing, lawful bases, retention periods and individual rights in the Jolly Learning Privacy Notice.

Processing undertaken on behalf of the School to provide and secure Jolly Classroom, including security monitoring carried out in accordance with the School’s documented instructions, remains subject to this DPA. This clause does not authorise Jolly Learning to use Pupil Data for its independent business purposes, including independent licence enforcement.

2. Definitions

For the purposes of this DPA:

Applicable Data Protection Law means the UK GDPR, Data Protection Act 2018 and, where applicable, the EU GDPR and any other data protection legislation that applies to the processing covered by this DPA.

Controller, Processor, Data Subject, Personal Data, Processing, Special Category Data, Personal Data Breach and Supervisory Authority have the meanings given to them under Applicable Data Protection Law.

School Data means Personal Data processed by Jolly Learning on behalf of the School through Jolly Classroom, including related administration and support through Jolly Connect as described in clause 3.6.

School teaching and learner data means Personal data supplied by or on behalf of the school, or generated through use of Jolly Classroom for the school’s educational purposes. This includes pupil profiles and identifiers, classes and group memberships, learning and assessment records, teacher observations, home-practice records and associated relationships and metadata, where these features are used.

This includes pupil photos, observation files, tracking tags (including sensitive tags where used), school/class settings and school-linked parent/carer access, contact and pupil-link records for home practice.

Teacher and staff account data means Staff contact details, account identifiers, roles, permissions, class assignments and information about staff use of Jolly Classroom, processed to provide and administer the School’s service. Scope is the affected School relationship; data necessary for another active account remains subject to its own retention rules. Marketing consent does not extend retention of Classroom account and usage information.

Pupil Data means School Data relating to pupils or students.

Subprocessor means another Processor engaged by Jolly Learning to process School Data in connection with providing Jolly Classroom.

3. Scope and Duration

3.1 This DPA applies whenever Jolly Learning processes School Data on behalf of the School through Jolly Classroom.

3.2 The subject matter, nature and purpose of processing, categories of Personal Data, categories of Data Subjects and duration of processing are described in Schedule 1.

3.3 This DPA remains in force for as long as Jolly Learning processes School Data on behalf of the School.

3.4 Obligations that by their nature continue after termination, including confidentiality, security, deletion and audit obligations, will continue for as long as Jolly Learning retains School Data.

3.5 This DPA applies to school-linked parent/carer access to the extent Jolly Learning processes Personal Data on behalf of the School. It does not govern processing for independently purchased parent/carer accounts outside that School relationship, which shall be addressed by the applicable service terms and Privacy Notice. Homework results created through a School link, and the link details held on the pupil record, are School Data. The independently held parent account, its purchases and non-linked profiles fall outside that School relationship.

3.6 Jolly Connect is an administration tool used to support Schools that purchase Jolly Classroom through a distributor or receive support from a trainer. Where Jolly Learning processes School Data through Jolly Connect on the School’s behalf, that processing is covered by this DPA.

An identified distributor or trainer may access and manage the School’s information through Jolly Connect only where the School has authorised that relationship and the relevant administrative or support activities. Jolly Learning shall keep a record of that authorisation and restrict access to the Schools, information and functions necessary for those activities.

Such access shall be limited to relevant School details, staff names and business contact details, account roles, and subscription or licence information. It shall not include pupil profiles, assessment results, learning records or school-linked parent/carer information. Purchasing through a distributor or working with a trainer does not, by itself, authorise access to Pupil Data.

The School may instruct Jolly Learning to change or withdraw a distributor’s or trainer’s access. Jolly Learning shall act on that instruction without undue delay and restrict or remove the relevant access. Any processing by Jolly Learning for its own purposes remains governed by clause 1.6 and the Privacy Policy.

4. Documented Instructions

4.1 Jolly Learning will process School Data only:

a. on the documented instructions of the School;

b. as necessary to provide, maintain, secure and support Jolly Classroom in accordance with the Service Agreement; or

c. where required to do so by applicable UK, EU or Member State law.

4.2 The School's documented instructions include:

a. the terms of the Service Agreement and this DPA;

b. the School's configuration and use of Jolly Classroom;

c. instructions provided through authorised School administrators;

d. instructions relating to integrations enabled by the School, including Wonde; and

e. other written instructions agreed between the Parties.

4.3 If Jolly Learning is required by law to process School Data other than on the School's instructions, Jolly Learning will inform the School of that legal requirement before processing unless the law prohibits such notification.

4.4 If Jolly Learning reasonably believes that an instruction from the School infringes Applicable Data Protection Law, Jolly Learning will inform the School without undue delay and may suspend the affected processing until the Parties have clarified the instruction.

5. Responsibilities of the School

The School is responsible for:

a. determining the purposes and means of its processing of School Data;

b. ensuring that its collection and use of Personal Data through Jolly Classroom is lawful;

c. identifying an appropriate lawful basis for processing;

d. identifying any applicable condition under Article 9 UK GDPR where Special Category Data is processed;

e. providing appropriate privacy information to staff, pupils, parents or carers where required;

f. ensuring Personal Data entered into Jolly Classroom is adequate, relevant, accurate and limited to what is necessary;

g. determining which optional information is entered into Jolly Classroom;

h. determining whether integrations such as Wonde are enabled;

i. managing authorised users and School administrator permissions; and

j. promptly informing Jolly Learning of any instruction, deletion request or other matter relevant to Jolly Learning's processing of School Data.

6. Jolly Learning's Processor Obligations

Jolly Learning will:

a. process School Data only in accordance with Section 4;

b. ensure that persons authorised to process School Data are subject to appropriate duties of confidentiality;

c. implement appropriate technical and organisational security measures;

d. take reasonable steps to ensure personnel with access to School Data receive appropriate data protection and security guidance;

e. assist the School with Data Subject requests in accordance with Section 14;

f. assist the School with its obligations relating to security, Personal Data Breaches, Data Protection Impact Assessments and consultation with Supervisory Authorities;

g. comply with the Subprocessor requirements in Section 11;

h. make available information reasonably necessary to demonstrate compliance with this DPA;

i. delete or return School Data at the end of the relevant processing in accordance with Section 16; and

j. maintain such records of processing as are required of Jolly Learning under Applicable Data Protection Law.

7. Jolly Classroom Personal Data

The exact Personal Data processed depends on how the School configures and uses Jolly Classroom.

7.1 Teacher and School Staff Data

This may include:

name;
email address;
school or organisation;
account and user identifiers;
authentication information;
account settings;
platform usage information;
support communications; and
administrative information.

Teacher and School staff authentication uses Firebase Authentication with email/password and supported Google, Apple and Microsoft sign-in. Password hashing is managed by the authentication provider; passwords are not stored in readable form.

7.2 Pupil Data

Depending on the School’s use of the Service, Pupil Data comprises:

(a) Pupil identity and profile data: first name, surname, display identifier, date of birth, gender, profile photograph, class membership, archived status, integration identifiers (such as Wonde), and tracking tags described in Section 8.

(b) Teacher-entered records about a pupil: assessment grades and marks, and observations, including free text and photographs.

(c) Learning and progress data: records generated by the pupil’s use of Jolly Classroom’s educational activities, homework and assessments, such as results, attempts, time spent, completion, practice items and measures derived from them (for example score bands, intervention lists and cohort comparisons).

New or changed features may add learning and progress data within category (c) without amendment to this DPA, provided that the processing remains necessary for the purposes in Schedule 1, falls within the School’s documented instructions, links the data to the pupil only through the identifiers in category (a), and does not introduce:

additional categories of Special Category Data, or new processing that infers or reveals Special Category Data, beyond the processing expressly described in Section 8 and authorised by the School’s documented instructions;
audio, video or images of pupils, biometric data, or spoken pupil responses;
new recipients, Subprocessors or processing locations; or
use of Pupil Data for purposes other than providing the Service to the School.

These limits concern additions through new or changed features under category (c). They do not prevent the existing processing of profile photographs, teacher-entered observations and photographs, optional School-selected tracking tags described in Section 8, or live remote lessons as described below. New learning measures must be assessed for whether they infer or reveal sensitive information; describing them as learning or progress data does not remove the protections applicable to that information.

Before introducing a feature that adds a new kind of learning and progress data, Jolly Learning shall assess and record, proportionately to the change, its necessity, data minimisation and any sensitive inferences. It shall provide the School with relevant information and reasonable assistance where the change requires the School to review its privacy information or data protection impact assessment.

Existing security, access, retention and deletion requirements continue to apply. Any change outside the limits above is a material change under clause 21.3. Before introducing processing outside those limits or the School’s documented instructions, Jolly Learning shall provide the School with relevant information, obtain any required updated documented instructions or authorisation, and update this DPA and its Schedules where necessary. Applicable Subprocessor authorisation and international-transfer requirements shall also apply. Notice under clause 21.3 alone does not authorise processing outside the School’s documented instructions.

Pupils do not have individual logins. Remote lesson audio and video is live and is not recorded. The Service does not provide speech recognition or voice-note recording.

Schools decide whether optional information is entered and must limit it to what is necessary.

7.3 Data Minimisation and Pupil Privacy Mode

Pupil Privacy Mode is a display and data-minimisation feature, not anonymisation. Names already entered or imported remain stored. Schools requiring identifiers-only storage should enter identifiers instead of names.

7.4 Importing Data

Schools may create pupil records manually or import pupil information using CSV files or Wonde. CSV import currently uses Flatfile in the United States. The whole uploaded file, including additional columns, may be transmitted to Flatfile. Schools must remove unnecessary columns and information before upload. Section 12 and Schedule 3 address the associated international transfer.

7.5 Exporting Pupil Data

Jolly Classroom does not provide a self-service export of complete pupil records. Authorised School users can download assessment overviews and reports; clause 16.15 applies to those copies. Return of School Data is governed by clause 16.4.

This does not limit any legal obligation Jolly Learning may have to assist the School with access, portability or other Data Subject rights where applicable. Return requests are governed by clause 16.4; absence of a self-service export facility does not remove those obligations.

8. Special Category and Sensitive Information

8.1 Jolly Classroom does not require a School to provide Special Category Data in order to use its core functionality.

8.2 Jolly Classroom offers optional built-in tracking categories, and Schools can define their own. Some built-in categories may reveal special category or other sensitive information, for example special educational needs, ethnicity or minority background, refugee status, or eligibility for free school meals. The School shall determine the lawful basis and, where applicable, the Article 9 condition for each category it enables, and should enable only those it needs. Tracking tags are visible to and can be assigned by all authorised staff of the School; only School managers can choose which categories are enabled.

8.3 The School is responsible for determining whether information it enters constitutes Special Category Data and, where applicable, ensuring that:

a. an appropriate Article 6 lawful basis applies;

b. an appropriate Article 9 condition applies;

c. the processing is necessary and proportionate;

d. appropriate transparency information has been provided; and

e. the information is limited to what is reasonably necessary.

8.4 Jolly Learning will process such information only as part of providing Jolly Classroom and in accordance with the School's documented instructions.

9. Children's Personal Data

9.1 Jolly Learning recognises that information relating to children requires particular care.

9.2 Jolly Classroom is designed primarily for use under the direction and control of teachers, Schools and other educational organisations.

9.3 School administrators and authorised teachers may create pupil records.

9.4 Pupils do not have individual logins or require individual email addresses for School-maintained pupil records. Parents/carers using school-linked access are also Data Subjects in relation to their own information.

9.5 Schools remain responsible for determining the lawful basis on which pupil information is processed and for providing any privacy information required to pupils, parents or carers.

9.6 Jolly Learning will not use Pupil Data processed on behalf of the School for independent advertising or direct marketing to pupils.

9.7 Jolly Learning will not sell Pupil Data.

9.8 Jolly Learning shall restrict school-linked parent/carer access to the pupil or pupils expressly linked to that parent/carer by an authorised School user. Such access shall not permit viewing or retrieving another pupil’s records through searches, reports, links, notifications or other Service functions. When an authorised School user removes a parent/carer link, that parent/carer's access to the pupil's records ends within one hour.

9.9 Distributor and trainer access to School Data through Jolly Connect is governed by clause 3.6. The School’s authorisation shall identify the recipient and permitted purposes and scope of access. Before enabling access, Jolly Learning shall establish and document the recipient’s role for the relevant processing and ensure that appropriate confidentiality, security and data protection arrangements are in place. Where the recipient acts as Jolly Learning’s Subprocessor, sections 11 and 12 apply. Where the recipient acts directly on the School’s instructions, the School shall ensure that the necessary agreement is in place with that recipient. School authorisation does not replace applicable contractual or international-transfer requirements. General account or licence support does not authorise access to Pupil Data. Distributor or trainer management of pupil records falls outside the administrative access permitted by clause 3.6 and requires separate documented arrangements and any necessary amendment to this DPA before that processing takes place.

10. Wonde Integration

10.1 Where the School connects Wonde, pupil and staff details are imported from the School’s management system. Removing a record there does not delete it in Jolly Classroom, and unlinking keeps imported records. Archiving is not permanent deletion. The data categories exchanged through the integration are set out in the data-categories schedule in Schedule 1.

10.2 The School controls whether the Wonde integration is enabled and remains responsible for ensuring that its use of Wonde and Jolly Classroom has an appropriate lawful basis.

11. Subprocessors

11.1 The School gives Jolly Learning general written authorisation to appoint Subprocessors necessary to provide Jolly Classroom.

11.2 Jolly Learning will ensure that each Subprocessor processing School Data is bound by written data protection obligations that provide a level of protection for School Data equivalent in all material respects to the obligations imposed on Jolly Learning under this DPA.

11.3 Jolly Learning remains responsible to the School for the performance of its Subprocessors' data protection obligations.

11.4 Schedule 3 incorporates the relevant Jolly Classroom entries in Jolly Learning’s Subprocessor List by reference. Only recipients processing School Data on Jolly Learning’s behalf fall within the Subprocessor authorisation in this section; inclusion in the list does not, by itself, determine a provider’s legal role.

11.5 Jolly Learning may add or replace Subprocessors where reasonably necessary to operate or improve Jolly Classroom.

11.6 Jolly Learning shall give the School at least 30 days’ prior written notice of any intended addition or replacement of a Subprocessor, by email to the School’s account holder and on https://jollylearning.com/subprocessors, allowing the School an opportunity to object on reasonable data-protection grounds before the change takes effect. The notice shall identify the recipient, processing and relevant safeguards.

11.7 The Parties shall work in good faith to resolve objections; if no suitable resolution is available, the School may terminate the affected Service in accordance with the Service Agreement.

12. International Transfers

12.1 Jolly Learning will ensure that any restricted international transfer of School Data for which it is responsible complies with Applicable Data Protection Law.

12.2 Depending on the relevant destination and recipient, transfer safeguards may include:

UK adequacy regulations;
EU adequacy decisions, where EU GDPR applies;
the UK International Data Transfer Agreement ("IDTA");
the UK Addendum to the European Commission Standard Contractual Clauses;
European Commission Standard Contractual Clauses;
the UK Extension to the EU-US Data Privacy Framework, where applicable;
the EU-US Data Privacy Framework, where applicable; or
another legally recognised transfer mechanism.

12.3 Core data is stored in Google Cloud’s EU multi-region eur3, involving Belgium and the Netherlands, with selected servers and live video processing in London, United Kingdom (europe-west2). Flatfile’s United States CSV processing is an international transfer. Supplier-specific transfer arrangements are addressed in Schedule 3; the primary hosting region does not describe every support, diagnostic or onward-processing location.

12.4 Jolly Learning will implement any transfer risk assessment or other supplementary safeguards required by Applicable Data Protection Law where Jolly Learning is responsible for initiating a restricted transfer.

13. Security

13.1 Jolly Learning will implement appropriate technical and organisational measures taking into account:

the state of the art;
implementation costs;
the nature, scope, context and purpose of processing; and
the risks to the rights and freedoms of Data Subjects.

13.2 The technical and organisational measures to be maintained by Jolly Learning are described in Schedule 2.

13.3 Jolly Learning shall restrict access to School Data to authorised personnel and service providers who require it for legitimate operational purposes.

13.4 Core data is stored in Google Cloud’s EU multi-region eur3, involving Belgium and the Netherlands. Selected servers and live video processing operate in London, United Kingdom (europe-west2). These locations do not establish the locations of every supplier or onward recipient.

13.5 Jolly Learning may periodically update its technical and organisational measures provided that such updates do not materially reduce the overall security of the Service.

14. Data Subject Rights

14.1 The School is responsible for responding to requests from Data Subjects relating to School Data.

14.2 Taking into account the nature of the processing, Jolly Learning will provide reasonable assistance to enable the School to respond to requests relating to:

access;
rectification;
erasure;
restriction;
objection;
portability, where applicable; and
other rights arising under Applicable Data Protection Law.

14.3 If Jolly Learning receives a request directly from a Data Subject concerning School Data, Jolly Learning will:

a. notify the School without undue delay where reasonably identifiable;

b. not respond substantively to the request unless instructed by the School or required by law; and

c. provide reasonable assistance to the School.

14.4 Where the request relates to a pupil, Jolly Learning may direct the individual or parent/carer to the relevant School because the School is responsible for determining how Pupil Data is processed.

14.5 Where Jolly Learning receives a deletion request directly from a pupil, parent or carer concerning School Data, it shall notify the School without undue delay and within one working day of receipt. Jolly Learning shall not delete the data or respond substantively except on the School’s documented instructions or as required by law. It shall provide reasonable assistance within the School’s applicable response deadline and carry out any resulting verified deletion instruction under the relevant deletion provisions of this DPA.

15. Personal Data Breaches and Compliance Assistance

15.1 Personal Data Breaches

Jolly Learning shall notify the School without undue delay after becoming aware of a Personal Data Breach affecting School Data. The notification shall include available information about its nature, affected data and individuals, likely consequences, mitigation and a contact point. Where information is unavailable initially, Jolly Learning shall provide it in phases without undue further delay and shall assist the School with its notification obligations.

15.2 Security and Regulatory Assistance

Taking into account the nature of processing and information available to Jolly Learning, Jolly Learning will provide reasonable assistance to the School with its obligations under Articles 32–36 UK GDPR, including:

security of processing;
assessment and notification of Personal Data Breaches;
communication of high-risk breaches to Data Subjects;
Data Protection Impact Assessments (DPIAs); and
prior consultation with the ICO or another relevant Supervisory Authority.

16. Return, Retention and Deletion

16.1 General retention

School Data will be retained only for as long as reasonably necessary to provide Jolly Classroom and in accordance with the Service Agreement, this DPA and applicable legal requirements.

16.2 School’s choice at service end

At the end of the relevant Service, Jolly Learning will, at the choice of the School, delete or return all School Data and delete existing copies unless applicable law requires storage. This obligation is not conditional on available Service functionality.

16.3 Verification of instructions

Jolly Learning shall verify that instructions for return, export or deletion originate from a person authorised by the School and shall maintain a record of the instruction and action taken. Returned data shall be delivered securely to an authorised recipient. Verification requirements shall be proportionate and shall not be used to frustrate the School’s rights under this DPA. Deletion is requested by the School’s account holder in Jolly Classroom and confirmed through a one-time link emailed to them. Where the account holder cannot access that email, Support verifies their identity and authority manually.

16.4 Return of School Data

On receiving the School’s verified instruction to return its School Data, Jolly Learning shall provide the requested data securely to an authorised School recipient without undue delay and within 30 calendar days. The return shall include structured records in a commonly used, machine-readable format, associated files and sufficient information to interpret them.

Where return accompanies termination of processing, Jolly Learning shall agree the return and deletion sequence with the School and delete remaining copies in accordance with this DPA, unless applicable law requires storage. A request for a copy during an ongoing subscription shall not, by itself, trigger deletion. Where the request supports a Data Subject request, Jolly Learning shall assist within the School’s applicable response deadline.

16.5 School teaching and learner data — expired trial

Where a trial ends without conversion to a paid subscription, the School instructs Jolly Learning to securely delete School teaching and learner data from active systems within 30 calendar days after trial expiry, unless the School requests return before the trial ends. Any requested return shall be completed securely before deletion within that period. At trial expiry, the Service’s teaching features are disabled; until deletion, authorised School users can still view School Data so that it can be reviewed or returned. Retained data shall remain access-restricted and shall be used only for that review, authorised return or deletion. Deletion shall include relevant linked records, files and copies in active systems, with instructions passed to relevant subprocessors within the same deadline. Restricted backup copies shall expire under the separately agreed backup arrangements; deletion instructions shall be reapplied before restored data returns to ordinary use. Any storage required by law shall be limited, access-restricted and explained to the School.

16.6 School teaching and learner data — expired paid subscription

When a paid subscription expires without renewal, the School instructs Jolly Learning to retain School teaching and learner data necessary for reactivation for up to 12 months after paid access ends, unless the School requests earlier return or deletion. Paid access ends at the end of any applicable renewal grace period: 30 days for distributor vouchers or 60 days for pending invoice renewals. After paid access ends, paid features are disabled; authorised School users can still view School Data so that it can be reviewed or returned. During the retention period, this DPA continues to apply and data is used only for secure storage, authorised review, return or reactivation, and compliance with School instructions. If the School has not reactivated, Jolly Learning shall complete any requested return and securely delete the data from active systems by the end of that 12-month period. Deletion shall include relevant linked records, files and copies in active systems, with instructions passed to relevant subprocessors within the same deadline. Restricted backup copies shall expire under the separately agreed backup arrangements; deletion instructions shall be reapplied before restored data returns to ordinary use. Any storage required by law shall be limited, access-restricted and explained to the School.

16.7 School teaching and learner data — deletion on request

On receiving the School’s verified deletion instruction, Jolly Learning shall securely delete the specified School teaching and learner data from active systems without undue delay and within 30 calendar days, subject to any earlier deadline necessary to assist the School with a Data Subject request. The instruction overrides any remaining reactivation period. Affected School-linked parent/carer access shall be revoked without undue delay. Jolly Learning shall confirm completion and identify any legally required retention or restricted backup copies and their scheduled expiry. Deletion shall include relevant linked records, files and copies in active systems, with instructions passed to relevant subprocessors within the same deadline. Restricted backup copies shall expire under the separately agreed backup arrangements; deletion instructions shall be reapplied before restored data returns to ordinary use. Any storage required by law shall be limited, access-restricted and explained to the School.

16.8 Teacher and staff account data — expired trial

Where a trial ends without conversion to a paid subscription, the School instructs Jolly Learning to securely delete Teacher and staff account data relating to the expired School service from active systems within 30 calendar days after trial expiry, unless the School requests return before the trial ends. Any requested return shall be completed securely before deletion within that period. At trial expiry, the Service’s teaching features are disabled; until deletion, authorised School users can still view School Data so that it can be reviewed or returned. Retained data shall remain access-restricted and shall be used only for that review, authorised return or deletion. Deletion shall include relevant linked records, files and copies in active systems, with instructions passed to relevant subprocessors within the same deadline. Restricted backup copies shall expire under the separately agreed backup arrangements; deletion instructions shall be reapplied before restored data returns to ordinary use. Any storage required by law shall be limited, access-restricted and explained to the School. Data necessary for another active account shall remain subject to its own retention rules; only the expired School relationship is removed. Separately justified minimal marketing records are governed by the marketing retention policy.

16.9 Teacher and staff account data — expired paid subscription

When a paid subscription expires without renewal, the School instructs Jolly Learning to retain Teacher and staff account data, including teacher activity records, necessary for reactivation for up to 12 months after paid access ends, unless the School requests earlier return or deletion. Paid access ends at the end of any applicable renewal grace period: 30 days for distributor vouchers or 60 days for pending invoice renewals. After paid access ends, paid features are disabled; authorised School users can still view School Data so that it can be reviewed or returned. During the retention period, this DPA continues to apply and data is used only for secure storage, authorised review, return or reactivation, and compliance with School instructions. If the School has not reactivated, Jolly Learning shall complete any requested return and securely delete the data from active systems by the end of that 12-month period. Deletion shall include relevant linked records, files and copies in active systems, with instructions passed to relevant subprocessors within the same deadline. Restricted backup copies shall expire under the separately agreed backup arrangements; deletion instructions shall be reapplied before restored data returns to ordinary use. Any storage required by law shall be limited, access-restricted and explained to the School. Only data relating to the expired School relationship shall be removed where another account remains active. Marketing consent does not extend retention of Classroom data.

16.10 Teacher and staff account data — deletion on request

On receiving the School’s verified deletion instruction, Jolly Learning shall securely delete the specified Teacher and staff account data relating to the affected School service from active systems without undue delay and within 30 calendar days, subject to any earlier deadline necessary to assist the School with a Data Subject request. The instruction overrides any remaining reactivation period. Affected School access shall be revoked without undue delay. Jolly Learning shall confirm completion and identify any legally required retention or restricted backup copies and their scheduled expiry. Deletion shall include relevant linked records, files and copies in active systems, with instructions passed to relevant subprocessors within the same deadline. Restricted backup copies shall expire under the separately agreed backup arrangements; deletion instructions shall be reapplied before restored data returns to ordinary use. Any storage required by law shall be limited, access-restricted and explained to the School. This shall not remove data necessary for another active account. Staff self-service controls do not override the School’s instructions or authorise retention of the affected School data.

16.11 Archived or departed pupils

The School shall review archived and departed pupils’ records at least once each school term and instruct Jolly Learning when those records are no longer required. Jolly Learning shall retain them only in accordance with the School’s documented instructions and agreed retention schedule. Archiving does not constitute deletion. A pupil’s absence from a Wonde feed does not trigger deletion, and unlinking Wonde does not delete previously imported records.

On the School’s documented instruction, Jolly Learning shall de-identify an archived or departed pupil’s record without undue delay and within 30 calendar days, subject to any earlier deadline necessary to assist the School with a Data Subject request. De-identified attainment data shall remain part of the class's learning history. No separate retention period applies to it. It shall be retained and deleted together with the rest of the School's teaching and learner data under the agreed retention schedule, including on expiry, termination or a School deletion request.

Identifiable recovery copies shall expire no later than 98 days after creation. Where the retained attainment data remains capable of identifying a pupil, it remains School Data subject to this DPA and the School’s return and deletion instructions; de-identification shall not be treated as fulfilment of an instruction to delete that personal data.

16.12 Conversion or renewal before deletion

Where the School converts its trial or renews its subscription before scheduled deletion takes place, Jolly Learning shall cancel the expiry-related deletion of records necessary to continue the Service. Those records shall remain subject to this DPA and the applicable retention schedule. Conversion or renewal shall not override a separate valid deletion instruction or authorise restoration of records previously deleted under that instruction.

16.13 Temporary import files

Jolly Learning shall ensure that temporary files held by it or its import tool are deleted as soon as the import completes. Abandoned or failed uploads shall be deleted within seven calendar days after upload. Temporary copies shall be access-restricted and used only for the authorised import or error resolution. Successfully imported records shall follow the applicable School Data retention schedule.

16.14 Copies held by Subprocessors

Jolly Learning shall pass relevant deletion instructions without undue delay to Subprocessors that support deletion on request, including CRM records and file-imports, and shall require deletion of the affected School Data, associated files and linked records within the deadline applicable to Jolly Learning under this DPA. Completion shall be recorded. Where agreed arrangements provide for fixed-period expiry, relevant copies shall expire under the specified schedule: error-reporting records within 90 days and recovery copies no later than 98 days after creation. Any remaining copies shall be access-restricted and used only for their documented permitted purpose pending expiry. Copies required by applicable law shall be identified and restricted to that purpose. Jolly Learning remains responsible for its Subprocessors’ performance of these obligations.

16.15 Downloaded reports and temporary report files

The School is responsible for securely storing, restricting access to and deleting reports it downloads, prints or stores outside the Service, in accordance with its own retention obligations. Jolly Learning remains responsible for copies within its possession or control. No report copies are created on Jolly Learning’s servers.

16.16 Recovery copies and deleted cloud files

Recovery copies expire no later than 98 days after creation. These recovery copies do not include login accounts or files. Deleted files in cloud storage are retained for up to seven days before permanent removal. Recovery copies shall be access-restricted and used only for disaster recovery. Jolly Learning shall record valid deletion instructions and reapply them following restoration before restored data is returned to ordinary use. These arrangements shall not authorise indefinite retention of historical exports or other copies.

16.17 Historical exports and duplicates

Jolly Learning shall not retain unnecessary historical exports, BigQuery copies or other duplicates of School Data. The return and deletion obligations in this DPA shall apply to those copies as well as the primary records.

Any retention required by applicable law shall be limited to the necessary data and period, with restricted access. Retained copies shall not be used to recreate records deleted under the School’s instructions.

16.18 Financial and accounting records

Jolly Learning shall retain financial and accounting records necessary to meet its UK legal obligations for six years from the end of the last company financial year to which they relate, or longer where applicable law requires. These may include invoices, payment records, credit notes and supporting transaction records.

Jolly Learning acts as an independent Controller for this processing. Retention shall be limited to the information necessary for those obligations and shall not authorise retention of pupil learning records, photographs, observations or tracking tags. Records shall be securely deleted when the applicable retention requirement ends, unless another documented lawful basis requires continued retention.

16.19 CRM, reactivation and marketing records

Following expiry of a trial without conversion to a paid subscription, Jolly Learning shall delete Classroom contact, account and usage information synchronised to its CRM within 30 calendar days after trial expiry. Where paid access ends without renewal, Jolly Learning may retain only the adult business-contact, account and usage information necessary for the agreed reactivation period, for up to 12 months after paid access ends, as defined in clause 16.9. The corresponding deletion process in Jolly Classroom shall trigger deletion of synchronised Classroom data in the CRM; earlier verified deletion instructions shall also apply. Where a contact remains linked to another active account, deletion shall remove the expired School relationship and its data while preserving only data necessary for that active account.

Support records are governed by clause 16.20. Any continued retention for accounting or legal obligations shall follow a separately documented retention schedule and be explained in the Privacy Notice. Where valid marketing consent remains in place, only the email address, marketing preferences and necessary consent evidence shall be retained for marketing, subject to periodic review. Marketing consent does not extend retention of Classroom data or support tickets. Following withdrawal, marketing shall stop and only minimal records necessary to honour the opt-out and meet applicable obligations shall be retained.

16.20 Support records

Jolly Learning shall limit personal data in support records to what is necessary to handle the enquiry and shall not ask Schools to send pupil information by email. Support correspondence is retained for no longer than 36 months after the last activity and is then deleted automatically. On a School's request, specific support correspondence containing pupil information shall be deleted within 30 days. Copies held in internal support tooling are deleted 12 months after the last activity.

16.21 Incident, complaint and deletion records

Jolly Learning shall maintain proportionate, access-restricted records of incidents, complaints and deletion instructions, including relevant decisions, actions and completion dates. Records shall contain no more Personal Data than necessary.

Core personal data breach records shall be retained for six years from formal closure and reviewed annually. Brief triage records for incidents determined not to involve a personal data breach shall be retained for two years from closure.

Supporting incident evidence, including logs, screenshots, exports and affected files, shall be deleted when no longer needed, normally within 12 months of closure. This is an outer default, not a minimum retention period. Any justified extension shall be documented.

Core complaint records, final responses and necessary supporting evidence shall normally be retained for three years after closure, with annual review and earlier removal or anonymisation where no longer necessary.

Jolly Learning shall retain a minimal record of deletion instructions and their completion for three years from completion of the instruction, subject to annual review and earlier deletion or anonymisation where no longer necessary. The record shall be limited to information necessary to demonstrate the instruction received, the requester’s authority, the scope of deletion, actions taken, completion dates and confirmation provided.

The audit record shall not contain copies of deleted pupil records or unnecessary personal information or attachments. Where deletion from backups or a relevant Subprocessor remains outstanding, the record shall distinguish completed actions from pending steps and record the applicable deadline and final completion. Any longer retention shall require a documented justification and review date under this clause.

Relevant records subject to an investigation, unresolved complaint, legal claim or preservation requirement shall be retained for the justified period. The reason, scope, responsible owner and review date shall be recorded. On release of any hold, retention shall be reassessed and disposal recorded. Unnecessary pupil content and duplicate attachments shall be removed as soon as their evidential purpose has ended.

17. Security Monitoring and Licence Protection

17.1 Processing to operate and secure Jolly Classroom remains subject to the School’s documented instructions and the restrictions in clauses 1.6 and 9.

17.2 Operational and administrative logging described in Schedule 2 must not be treated as evidence of an implemented Jolly Classroom licence-sharing detection system.

Analytics copies derived from School Data, including event logs keyed by internal identifiers and account, school and billing history, are anonymised and held by Jolly Learning unless deletion is requested.

Jolly Learning shall limit error reporting and operational analytics involving School Data to what is necessary to provide and secure the Service under the School’s documented instructions. It shall exclude unnecessary pupil content and shall not use Pupil Data for independent analytics purposes. Unnecessary historical copies shall be securely deleted, and relevant deletion instructions shall apply to any retained identifiable diagnostic records.

17.3 This DPA does not authorise additional pupil-data analytics or independent reuse for licence enforcement.

17.4 Any further licence-monitoring purpose, data category or recipient requires a separately documented scope and role assessment before inclusion.

17.5 This DPA makes no assertion about automated licence-enforcement decisions in a separate Jolly service.

17.6 Contractual consequences of unauthorised licence sharing are governed by the applicable Service Agreement. Any restriction, suspension or termination does not relieve Jolly Learning of its continuing obligations under this DPA.

18. Audits and Demonstrating Compliance

18.1 Jolly Learning will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA and Article 28 UK GDPR.

18.2 Jolly Learning may satisfy reasonable due diligence requests by providing appropriate documentation, including where available:

security information;
privacy documentation;
Subprocessor information;
relevant policies;
responses to reasonable security questionnaires.

18.3 Where the information available under Section 18.2 is not reasonably sufficient, the School may request an audit or inspection relating to Jolly Learning's processing of School Data.

18.4 Any audit must:

a. be requested on reasonable written notice;

b. take place during normal business hours;

c. be limited to information and systems relevant to the School's Personal Data;

d. be conducted in a way that protects the confidentiality and security of other customers and Jolly Learning;

e. not unreasonably disrupt Jolly Learning's operations; and

f. be subject to appropriate confidentiality requirements.

18.5 The School will bear the costs of any independent auditor it appoints. Jolly Learning will bear its own costs of providing routine compliance information and reasonable cooperation with audits under this Section.

Where an audit request requires assistance materially beyond such routine provision and reasonable cooperation, Jolly Learning may charge reasonable, proportionate and documented additional costs, provided that the scope of the additional assistance and the charges are agreed with the School in writing before those costs are incurred.

Jolly Learning will not charge the School for its assistance where the audit:

(a) is required by Applicable Data Protection Law or a Supervisory Authority;

(b) arises from a material breach of this DPA by Jolly Learning; or

(c) is reasonably necessary to investigate credible evidence of a breach of this DPA by Jolly Learning or its Subprocessors.

No charge, or disagreement concerning charges, will prevent or delay Jolly Learning’s performance of its obligations under Article 28 or the School’s exercise of its audit rights under this DPA.

This allocation of costs does not affect any right to recover costs under the Service Agreement or Applicable Data Protection Law.

19. Confidentiality

19.1 Jolly Learning will ensure that employees, contractors and other persons authorised to access School Data:

access it only where necessary for their role;
are subject to appropriate confidentiality obligations; and
receive relevant data protection and security guidance.

19.2 Jolly Learning will not disclose School Data to third parties except:

as instructed by the School;
to authorised Subprocessors;
as necessary to provide the Service; or
where required by law.

20. Liability

20.1 Each Party remains responsible for complying with its obligations under Applicable Data Protection Law. Any agreed contractual limitation of liability shall operate only to the extent permitted by law and shall not restrict a Data Subject’s rights or a supervisory authority’s powers. Any additional contractual cap or allocation shall be expressly set out in the Terms of Service.

21. Changes to this DPA

21.1 Jolly Learning may update this DPA where reasonably necessary to:

reflect changes in Applicable Data Protection Law;
reflect changes to Jolly Classroom;
improve data protection safeguards; or
address regulatory guidance.

21.2 Jolly Learning will not materially reduce the protections provided to School Data through an update to this DPA.

21.3 Where a change materially affects the processing of School Data, Jolly Learning will provide reasonable notice to the School.

22. Governing Law

22.1 Unless otherwise required by mandatory applicable law, this DPA is governed by the laws of England and Wales.

22.2 The courts of England and Wales will have jurisdiction in relation to this DPA, subject to any mandatory rights of a Data Subject or Supervisory Authority under Applicable Data Protection Law.

23. Contact

Questions relating to this DPA or Jolly Learning's processing of School Data should be sent to:

Jolly Learning Ltd
77 Hornbeam Road
Buckhurst Hill
Essex
IG9 6JX
United Kingdom

Email: info@jollylearning.com

Responsibility for data protection currently sits with Jolly Learning's Chief Executive Officer.

SCHEDULE 1 – DETAILS OF PROCESSING

1. Controller

The school, academy trust, local authority or other educational organisation using Jolly Classroom.

2. Processor

Jolly Learning Ltd.

3. Subject Matter

The provision, operation, maintenance, security and support of Jolly Classroom, including related School and staff administration and authorised distributor or trainer support through Jolly Connect under clause 3.6.

Jolly Classroom is provided through web browsers and apps on supported devices. Current supported platforms and feature availability are described in the product documentation and may change without amendment to this DPA, provided the change does not alter the categories of personal data, the purposes of processing, the processing locations or the Subprocessors.

4. Duration

For the duration of the School’s use of Jolly Classroom and any limited period permitted under section 16 for reactivation, return, deletion, backups or applicable legal obligations.

5. Purpose of Processing

Processing may include:

creation and administration of School and teacher accounts;
related administration and support through Jolly Connect by an identified distributor or trainer, within the School’s documented authorisation under clause 3.6;
creation and management of pupil records;
delivery of educational functionality;
recording learning activity;
recording pupil assessment and progress;
displaying educational reports and insights to authorised School users;
synchronisation with authorised integrations such as Wonde;
authentication and access management;
customer and technical support;
security monitoring;

investigation of reported unauthorised access;

operation, maintenance and troubleshooting of the Service; and

archiving, instructed de-identification, and return/deletion in accordance with section 16.

6. Categories of Data Subjects

pupils/students;
teachers;
School administrators;
teaching assistants and other authorised School staff; and
parents/carers using school-linked access; and other authorised users designated by the School.

7. Categories of Personal Data

School teaching and learner data

Personal data supplied by or on behalf of the school, or generated through use of Jolly Classroom for the school’s educational purposes. This includes pupil profiles and identifiers, classes and group memberships, learning and assessment records, including learning and progress data as described in clause 7.2(c), teacher observations, home-practice records and associated relationships and metadata, where these features are used.

Teacher and staff account data

Staff contact details, account identifiers, roles, permissions, class assignments and information about staff use of Jolly Classroom, processed to provide and administer the School’s service. Scope is the affected School relationship; data necessary for another active account remains subject to its own retention rules. Marketing consent does not extend retention of Classroom account and usage information.

Authentication, settings and support communications are also processed as described in section 7.1.

For authorised distributor or trainer access through Jolly Connect, the permitted data categories are relevant School details, staff names and business contact details, account roles, and subscription or licence information. The restrictions in clause 3.6 apply; these categories do not permit access to pupil records or school-linked parent/carer information.

Wonde-imported fields

Where supplied, the integration imports:

Pupils: first name, surname, gender, date of birth and MIS/Wonde identifiers.
Staff: name and one email address. School: name, address, postcode, country, local-authority code, establishment number, URN and region.

Operational and administrative logs, device/browser information and necessary account/usage information may be processed to provide and secure the Service. This does not assert comprehensive authentication-event logging or authorise independent pupil-linked analytics. School-linked parents/carers’ account, contact and access information is within scope where processed for the School; exact fields require confirmation.

Jolly Classroom uses an approximate country, derived by its hosting provider from the request, to set the School’s initial country and related language defaults, which the School can change. The derived value is not otherwise stored or logged.

8. Special Category Data

Jolly Classroom does not require Special Category Data for core use.

The optional categories, School responsibilities and access arrangements are described in section 8.2. A category’s label alone does not determine whether Article 9 applies.

9. Processing Operations

May include:

collection;
recording;
organisation;
structuring;
storage;
adaptation;
retrieval;
consultation;
use;
synchronisation;
reporting;
restriction;
archiving; and
deletion.

10. Intended Recipients

Authorised School staff and service recipients identified in Schedule 3 may receive School Data for the relevant authorised purposes. School-linked parent/carer access is governed by clause 9.8. Identified distributors and trainers authorised by the School may receive the limited administrative information described in clause 3.6, subject to clauses 3.6 and 9.9. Distributor or trainer management of pupil records requires separate documented arrangements before processing.

SCHEDULE 2 – TECHNICAL AND ORGANISATIONAL MEASURES

This schedule sets out the proposed contractual security measures. In this WIP draft, comments identify controls requiring deployment, verification or approval; inclusion of wording is not evidence that an outstanding control has been implemented.

1. Access Control

Jolly Learning shall restrict workforce and privileged access to authorised personnel with a need to perform their duties, apply least-privilege permissions, require multi-factor authentication for such access, and maintain documented access approval, role-change and leaver procedures.

Jolly Learning shall review privileged access at least every six months and on relevant personnel or role changes. Reviews shall record the access checked, the reviewer, required changes and completion of those changes. Access no longer required shall be removed without undue delay.

2. Authentication

Firebase Authentication provides email/password and supported Google, Apple and Microsoft sign-in. Password hashing is provider-managed.

Teacher accounts support optional multi-factor authentication for each teacher, and the School can prompt teachers to enrol. Removing a teacher ends their access to School Data and files within one hour and signs them out of their devices. The School is responsible for promptly identifying users whose access should end.

3. Data Hosting and Infrastructure

Core data is stored in Google Cloud’s EU multi-region eur3, involving Belgium and the Netherlands. Selected servers and live video processing use London, United Kingdom (europe-west2). Separate staging and live cloud environments are maintained. Other recipient locations remain subject to the Schedule 3 review.

4. Encryption

Google-managed TLS protects the relevant cloud connections and encryption at rest is provider-managed. These controls do not establish separate application-level encryption of local device data.

5. Monitoring and Logging

Operational logs shall be retained for no longer than 30 days from the relevant event, except where specified records are necessary for an identified incident investigation or legal obligation. Any exception shall have a documented purpose, restricted access and a review or deletion date. Logs shall contain no more personal data than necessary to operate and secure the Service.

Administrative audit logs shall be retained for no longer than 400 days from the relevant event, except where specified records are necessary for an identified investigation or legal obligation. Access shall be restricted to authorised personnel. The records shall be limited to information necessary for security and accountability and shall not include unnecessary pupil learning content.

6. Vulnerability and Security Management

Jolly Learning shall maintain a risk-based programme for identifying and remediating security vulnerabilities, including automated dependency and secret scanning and periodic internal security review. The programme shall prioritise remediation according to risk and verify relevant fixes.

7. Backup and Resilience

Recovery-copy and cloud-file retention is governed by clause 16.16; historical exports and duplicate copies are governed by clause 16.17.

Jolly Learning shall test at least annually its ability to restore the availability and access to School Data following a physical or technical incident. Restoration procedures shall restrict access during recovery and ensure that valid deletions and access removals are reapplied before the restored data is used for ordinary processing.

8. Personnel and Confidentiality

The confidentiality and authorised-personnel obligations in sections 6, 13 and 19 apply. Workforce access controls and review requirements are set out in paragraph 1 of this Schedule.

9. Supplier Management

The obligations in Sections 11 and 12 apply. Inclusion of a recipient in Schedule 3 does not establish that its contractual role, exact entity, all processing locations or transfer mechanism have been verified.

10. Incident Management

Jolly Learning shall maintain a documented incident-response procedure, with designated responsibilities, deputy cover and an out-of-hours escalation route. The procedure shall address containment, assessment, evidence preservation, notification, supplier coordination, recovery and lessons learned, and shall be reviewed after any incident and at least annually. The notification and assistance obligations in section 15 apply.

11. Data Minimisation

12. Secure Development and Change Management

Automated tests gate backend and application-rule deployments. Separate staging and live environments are maintained.

Jolly Learning shall not store School Data, or credentials that grant access to School Data, in code repositories. It shall remediate identified exposures, including removing the material from current code and revoking or rotating affected credentials

13. Shared Devices and Local Data

Jolly Learning shall test shared-device access controls on supported iPad and browser environments. Tests shall cover user changes, sign-out, local caches and reports, offline work and removal of staff access. Identified failures affecting the confidentiality of School Data shall be remediated and verified.

Jolly Learning shall maintain appropriate session and local-data controls for supported Service environments and provide the School with guidance on secure shared-device configuration. Any local retention shall be limited to what is necessary for the Service. Jolly Learning shall describe material limitations accurately and shall not represent unimplemented local encryption, automatic clearing or timeout controls as implemented safeguards. Signing out clears the offline copy of School Data from the device.

Jolly Learning shall implement controls to prevent subsequent users of a shared device from accessing another user’s School Data following sign-out or access removal. Local caches and queued work shall be limited to what is necessary for the Service. Queued changes are checked against the user's current permissions when they reach Jolly Learning's servers. Changes to pupils or Schools that were deleted or de-identified in the meantime are rejected. Queued changes are checked against current permissions when they reach Jolly Learning’s servers, and changes to pupil records deleted in the meantime are rejected. Local copies under Jolly Learning’s control shall be removed through the agreed device-cleanup process.

SCHEDULE 3 – SUBPROCESSORS AND INTERNATIONAL TRANSFERS

The Jolly Classroom entries in Jolly Learning’s Subprocessor List, available at https://jollylearning.com/subprocessors, are incorporated into this DPA by reference. Subsequent additions or replacements are subject to the prior notice and objection process in section 11.

The Subprocessor List shall identify the relevant contracting entities, services and processing purposes, categories of School Data, processing locations and applicable restricted-transfer safeguards. Only providers processing School Data on Jolly Learning’s behalf for Jolly Classroom, including related administration and support through Jolly Connect under clause 3.6, fall within the Subprocessor authorisation. Providers acting as independent Controllers shall be identified separately; listing a provider does not, by itself, determine its legal role.

Jolly Learning’s obligations concerning Subprocessor contracts and responsibility under section 11, and international transfers under section 12, continue to apply. Publication or amendment of the list does not by itself authorise a restricted transfer or override those obligations. Providers processing School Data on Jolly Learning’s behalf through Jolly Connect within clause 3.6 shall be identified in the relevant incorporated entries in the Subprocessor List and are subject to sections 11 and 12. The use of Jolly Connect does not exempt a provider from those requirements. Distributor and trainer roles and access are addressed in clause 9.9.