How we handle
your school's data.

1

Parties and roles

1.1 This Data Processing Agreement (“DPA”) forms part of the agreement between the school named in the Order Form (“the School”) and Noah Price and Nick Miller, trading as My Language Brain (“MLB”, “we”), made under our School Terms of Service.

1.2 For the personal data of the School's staff and pupils processed through the Service (“School Data”), the School is the controller and MLB is the processor. Annex 1 describes the processing.

1.3 Terms such as “controller”, “processor”, “personal data breach” and “data subject” have the meanings given in the UK GDPR.

2

Our obligations

MLB will:

2.1 Instructions. Process School Data only on the School's documented instructions, which are set out in the agreement and the School's use of the Service's settings, including with regard to international transfers, unless UK law requires otherwise, in which case we will tell the School first unless the law forbids it. We will tell the School immediately if we think an instruction breaks data protection law.

2.2 Confidentiality. Ensure that everyone authorised to process School Data is bound by confidentiality, and that access is limited to what their role requires.

2.3 Security. Maintain appropriate technical and organisational measures to protect School Data, as required by Article 32 of the UK GDPR, including those in Annex 2, and review them regularly.

2.4 Purpose limits. Not sell School Data, use it for advertising or marketing, or use it to train AI models, and not use it for any purpose of our own other than anonymous, aggregated statistics that identify no person or school.

2.5 Individuals' rights. Tell the School promptly if we receive a request from a pupil, parent or member of staff about School Data, without responding ourselves unless the School asks us to, and help the School respond, including by correcting, exporting or deleting records.

2.6 Assistance. Give the School the help it reasonably needs to meet its obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner's Office, taking into account the nature of the processing and the information available to us.

3

Sub-processors

3.1 The School authorises MLB to use the sub-processors listed in Annex 3.

3.2 We will give the School at least 30 days' notice by email before adding or replacing a sub-processor that processes School Data. The School may object on reasonable data protection grounds within 15 days, and we will work with the School to resolve the objection. If we cannot, the School may end the agreement, and receive a refund of any fees for the unused part of the term, before the change takes effect.

3.3 We will impose data protection obligations on each sub-processor that are equivalent to those in this DPA, and remain responsible to the School for their performance.

4

International transfers

School Data is stored in the United Kingdom, in Google Cloud's London region (europe-west2). Where a sub-processor processes School Data outside the UK, we will ensure the transfer is covered by UK adequacy regulations or an appropriate safeguard, such as the UK International Data Transfer Addendum to the EU standard contractual clauses or certification under the UK Extension to the EU–US Data Privacy Framework, as set out in Annex 3.

5

Breaches

5.1 We will notify the School without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting School Data.

5.2 The notification will describe, as far as then known, what happened, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. We will provide further information as it becomes available.

5.3 We will take reasonable steps to contain the breach and help the School investigate it and meet any obligation to notify the Information Commissioner's Office or the people affected.

6

Return and deletion

6.1 When the agreement ends, the School may choose to have its School Data returned, in a common machine-readable format, or deleted. We will do this within 30 days of the end of the agreement, or of the School's instruction if later, and confirm in writing when it is done.

6.2 If the School makes no choice within 30 days of the end of the agreement, we will delete its School Data.

6.3 During the agreement, we will delete the records of individual pupils or staff within 30 days of the School's request.

6.4 Where backup copies exist, they expire within 30 days, so deleted data is removed from them within that period. We keep School Data after the agreement ends only where UK law requires it, and then protect it and use it for no other purpose.

7

Audit and information

We will make available to the School the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR, including answers to the School's data protection and security questionnaires, and will allow for and contribute to audits and inspections by the School or an auditor it appoints, on reasonable notice and in a way that protects the confidentiality of other schools' data.

8

General

8.1 This DPA lasts as long as we process School Data, including after the agreement ends until return or deletion is complete.

8.2 If this DPA conflicts with the School Terms of Service on any matter concerning personal data, this DPA prevails.

8.3 This DPA is governed by the law of England and Wales.

ANNEX 1

Details of processing

ANNEX 2

Security measures

• Hosting: Google Cloud, whose data centres hold ISO/IEC 27001, 27017 and 27018 certification and SOC 2 reports.
• Encryption: all data encrypted in transit (TLS) and at rest.
• Access control: access rules enforced on the server so that a pupil can reach only their own class and a teacher only the classes they teach; teachers sign in with individually approved Google accounts; pupils sign in with a class code, name and personal PIN.
• Operator access: administrative access to production systems is limited to MLB's two operators, using individual accounts.
• Minimisation: no pupil email addresses, home addresses, dates of birth or photographs are collected; pupils' names and account details are not sent to AI services.
• Change control: changes to database access rules are tested against a test copy of the database before release.
• Logging: security and error logs retained for up to 30 days.
• Incident response: breach notification to the School within 48 hours, as in section 5.

ANNEX 3

Sub-processors

Speech-to-text, where a pupil chooses to use it, is performed by the pupil's own web browser under its maker's terms, not by MLB or its sub-processors. MLB does not receive audio.