Data Processing Agreement

Last updated: 10 August 2026

This Data Processing Agreement (“DPA”) explains how ClassAdapt processes personal data on behalf of schools, colleges, trusts and other educational organisations that use the ClassAdapt platform.

ClassAdapt is committed to protecting the privacy and security of learners, teachers and educational organisations. We design our services around the principles of data protection by design and by default and seek to align our AI-enabled services with the Department for Education’s AI Product Safety Standards.

This DPA is intended to form part of the agreement between ClassAdapt and an educational organisation where ClassAdapt processes personal data on that organisation’s behalf.

1. Roles of the parties

Where a school, college, academy trust or other educational organisation determines why and how personal data is processed through ClassAdapt, that organisation acts as the Data Controller.

ClassAdapt acts as the Data Processor and processes personal data only in accordance with the Controller’s documented instructions and the purposes described in the agreement between the parties.

ClassAdapt may act as a separate Data Controller for limited information that it processes for its own legitimate business purposes, such as account administration, billing, security, service management and legal compliance. Such processing is described in the ClassAdapt Privacy Policy.

2. What data may be processed?

Depending on how the platform is configured and used, ClassAdapt may process:

learner names or identifiers;
school-issued usernames;
school and class information;
year group;
teacher and staff account information;
learning activity and simulation activity;
assessment responses and results;
learner progress information;
accessibility settings;
platform interaction data;
technical and device information;
security and authentication logs; and
information provided to ClassAdapt for customer or technical support.

ClassAdapt follows the principle of data minimisation and does not require schools to provide personal information that is not necessary to use the relevant service.

3. Special category and SEND information

ClassAdapt is designed to support inclusive education and learners with additional educational needs.

The standard use of ClassAdapt does not require schools to provide medical diagnoses, health information or other special category personal data.

Where a school chooses to provide information relating to SEND, disability, an EHCP or another potentially sensitive area, the school remains responsible for ensuring that it has an appropriate lawful basis and condition for processing that information.

ClassAdapt will apply appropriate technical and organisational safeguards to such information and will not require sensitive information where the service can reasonably operate without it.

4. How ClassAdapt uses personal data

ClassAdapt processes personal data to:

provide the ClassAdapt platform;
authenticate users;
provide educational simulations and learning activities;
record learning activity and assessment results;
provide teacher-facing learning information;
provide accessibility features;
provide adaptive learning functionality;
provide AI-assisted educational functionality;
maintain platform security;
detect and prevent misuse;
provide technical and customer support;
maintain and improve the reliability and performance of the service; and
comply with applicable legal obligations.

ClassAdapt will not use personal data for purposes incompatible with those for which it was provided.

5. AI and learner data

ClassAdapt uses artificial intelligence to provide certain educational features.

ClassAdapt does not use learner personal data supplied by schools to train or fine-tune general-purpose AI models.

ClassAdapt will not sell learner personal data or use it for targeted advertising or commercial profiling.

Where an AI service is used to process information on behalf of a school, ClassAdapt will apply appropriate contractual, technical and organisational safeguards.

AI-generated outputs are intended to support teaching and learning and should not replace appropriate professional judgement.

ClassAdapt does not use AI as the sole basis for significant decisions concerning individual learners, such as decisions relating to admission, exclusion, safeguarding, educational placement or other decisions that may have significant effects on a learner.

6. Human oversight

ClassAdapt is designed to support teachers rather than replace them.

AI-generated educational content, explanations, recommendations or other outputs may contain errors or inaccuracies. Teachers and authorised education professionals remain responsible for reviewing information where professional judgement is required.

ClassAdapt maintains processes for identifying and addressing inappropriate, inaccurate or harmful AI-generated outputs.

7. Children and young people

ClassAdapt may be used by children and young people. We therefore take additional care when designing learner-facing functionality.

We seek to:

minimise the personal data collected from learners;
avoid collecting unnecessary sensitive information;
provide appropriate privacy information;
apply appropriate access controls;
protect learner information from unauthorised access;
consider the particular risks associated with AI systems used by children; and
design AI functionality with child safety and educational appropriateness in mind.

ClassAdapt seeks to align its services with applicable ICO guidance concerning children’s privacy and the Department for Education’s AI safety expectations.

8. Security

ClassAdapt implements appropriate technical and organisational measures to protect personal data.

Depending on the service and technical architecture, these measures may include:

encryption of data in transit;
encryption of data at rest where appropriate;
role-based access controls;
least-privilege access;
secure authentication;
multi-factor authentication for privileged access;
security logging and monitoring;
vulnerability management;
security updates and patching;
backup and recovery procedures;
incident response procedures;
secure software development practices;
confidentiality obligations for personnel;
staff security training; and
secure deletion procedures.

Access to personal data is restricted to authorised personnel who require access for legitimate purposes.

9. Sub-processors

ClassAdapt may use carefully selected third-party service providers to provide infrastructure, hosting, authentication, security, AI processing, communications and other services necessary to operate the platform.

ClassAdapt requires relevant sub-processors to provide appropriate data protection and security safeguards.

ClassAdapt remains responsible for ensuring that its sub-processors comply with applicable contractual data protection requirements.

A current list of ClassAdapt’s relevant sub-processors is available below.

ClassAdapt Sub-processor Register

Sub-processor	Purpose	Data processed	Processing location
[HOSTING PROVIDER]	Hosting and infrastructure	Platform data	[LOCATION]
[DATABASE PROVIDER]	Data storage	Account and learning data	[LOCATION]
[AI PROVIDER]	AI functionality	[DATA TYPES]	[LOCATION]
[AUTHENTICATION PROVIDER]	User authentication	Account information	[LOCATION]
[OTHER PROVIDER]	[PURPOSE]	[DATA TYPES]	[LOCATION]

ClassAdapt will update this register when material changes are made to the sub-processors used to process personal data.

10. International data transfers

ClassAdapt will not transfer personal data outside the United Kingdom unless the transfer is permitted under applicable UK data protection law.

Where an international transfer takes place, ClassAdapt will ensure that an appropriate legal transfer mechanism and suitable safeguards are in place.

Where appropriate, these may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

11. Data breaches

ClassAdapt maintains procedures for identifying, investigating and responding to personal data breaches.

Where ClassAdapt becomes aware of a personal data breach affecting personal data processed on behalf of a school or other Controller, ClassAdapt will notify the Controller without undue delay.

Where reasonably possible, the notification will provide information concerning:

the nature of the breach;
the categories of data affected;
the categories of individuals affected;
the likely consequences;
measures taken to contain the incident; and
measures proposed to prevent recurrence.

ClassAdapt will provide reasonable assistance to the Controller in relation to its obligations following a personal data breach.

12. Data subject rights

ClassAdapt will provide reasonable assistance to Controllers in responding to requests from individuals exercising their rights under UK data protection law.

These rights may include:

the right of access;
the right to rectification;
the right to erasure;
the right to restriction of processing;
the right to object;
the right to data portability; and
applicable rights concerning automated decision-making.

Where ClassAdapt receives a request relating to personal data that it processes on behalf of a school, it will normally refer the request to the relevant Controller.

13. Data retention and deletion

ClassAdapt will retain personal data only for as long as necessary for the purposes for which it is processed or as otherwise required by law.

When a school’s use of ClassAdapt ends, personal data will be deleted or returned in accordance with the school’s agreement with ClassAdapt, subject to any legal requirements to retain information.

Backup copies may remain temporarily within secure backup systems before being securely deleted in accordance with ClassAdapt’s backup retention procedures.

ClassAdapt does not retain learner personal data indefinitely.

14. Data protection impact assessments

ClassAdapt considers privacy and data protection risks when developing and operating its services.

Where appropriate, ClassAdapt conducts or contributes to Data Protection Impact Assessments (DPIAs), particularly where processing may present a high risk to individuals.

ClassAdapt will provide reasonable information and assistance to enable educational organisations to conduct their own DPIAs where required.

The educational organisation remains responsible for determining whether its particular use of ClassAdapt requires a DPIA.

15. Data protection by design

ClassAdapt incorporates privacy and security considerations into the design and development of its services.

We seek to minimise:

the amount of personal data collected;
unnecessary access to personal data;
unnecessary sharing with third parties;
retention periods; and
the use of sensitive information.

Where technically feasible, ClassAdapt provides configuration and access controls that allow educational organisations to apply appropriate privacy settings.

16. AI safety

ClassAdapt seeks to align its AI-enabled services with the Department for Education’s Generative AI Product Safety Standards.

Our AI safety approach includes consideration of:

privacy and data protection;
security;
harmful or inappropriate content;
filtering and safeguards;
monitoring and reporting;
intellectual property;
testing and evaluation;
governance;
cognitive development;
emotional and social development;
mental health; and
manipulation and inappropriate influence.

AI systems are reviewed as they evolve, and ClassAdapt will seek to improve safeguards as new risks, technologies and regulatory expectations emerge.

17. Intellectual property and uploaded content

Educational materials uploaded by a school, teacher or other authorised user remain subject to the rights of the relevant rights holder.

ClassAdapt processes uploaded materials to provide the requested service.

ClassAdapt does not use school-provided educational materials or learner-generated content to train or fine-tune general-purpose AI models unless expressly authorised and supported by an appropriate legal basis and contractual arrangement.

18. Audits and compliance

ClassAdapt will provide reasonable information necessary for educational organisations to assess compliance with applicable data protection requirements.

Where appropriate and proportionate, ClassAdapt may provide information concerning:

security controls;
data processing practices;
sub-processors;
international transfers;
retention practices;
incident response procedures;
DPIAs; and
relevant security or compliance documentation.

Reasonable audit rights may be agreed between ClassAdapt and the relevant educational organisation.

19. Responsibilities of the school or educational organisation

The Controller is responsible for:

establishing an appropriate lawful basis for processing;
providing appropriate privacy information to learners, staff and other Data Subjects;
ensuring that it has authority to provide personal data to ClassAdapt;
ensuring that personal data supplied to ClassAdapt is accurate and appropriate;
avoiding unnecessary sensitive personal data;
managing user access;
completing its own DPIA where required;
providing appropriate instructions to ClassAdapt; and
ensuring that users use ClassAdapt appropriately.

20. ClassAdapt’s responsibilities

ClassAdapt is responsible for:

processing personal data in accordance with documented instructions;
maintaining appropriate security measures;
maintaining confidentiality;
managing sub-processors appropriately;
assisting with data subject rights;
supporting Controllers with data protection compliance;
notifying Controllers of relevant personal data breaches;
applying appropriate retention and deletion procedures;
maintaining appropriate AI safety measures; and
complying with applicable UK data protection legislation.

21. Applicable law

This Data Processing Agreement is intended to operate in accordance with applicable UK data protection legislation, including the UK GDPR and Data Protection Act 2018, as amended or replaced from time to time.

ClassAdapt also takes account of relevant guidance and standards published by the Information Commissioner’s Office and the Department for Education.

22. Updates to this DPA

ClassAdapt may update this DPA from time to time to reflect:

changes in applicable law;
regulatory guidance;
changes to ClassAdapt’s services;
changes to its security practices;
changes to AI technology and associated risks; or
changes to its sub-processors.

The latest version will be published on the ClassAdapt website.

23. Contact

If you have questions about this Data Processing Agreement or how ClassAdapt processes personal data, please contact:

ClassAdapt
Website: https://classadapt.com
Data Protection Contact: [PRIVACY EMAIL]
Registered Office: [REGISTERED ADDRESS]

For questions concerning a school’s particular use of ClassAdapt, schools should contact their own Data Protection Officer or equivalent data protection lead.