1. About this agreement

This data processing agreement ("DPA") is between the data controller named when the agreement is accepted in the Squono app ("the school") and Wilgenry Software Limited, a company registered in England and Wales (company number 17392061), registered office 42a Church Street, Hatfield, England, AL9 5AW, trading as Squono ("Squono", "we", "us"). Contact: hello@squono.com.

It contains the terms required by Article 28 of the UK GDPR for Squono's processing of personal data on the school's behalf. For schools in Ireland, references to the UK GDPR mean the EU GDPR, and references to the Data Protection Act 2018 mean Ireland's Data Protection Act 2018 (see section 17).

It applies whenever the school uses Squono in Schools mode. Where it conflicts with Squono's general terms of service on data protection, this DPA wins.

Squono is free for schools. No money changes hands under this agreement, and the school's data is never the price of the service: Squono makes no use of school data for its own purposes (section 9).

2. The parties and who signs

The processor is Wilgenry Software Limited. The controller is the body legally responsible for the school's personal data. When accepting in the app, the signatory chooses the type of controller and enters its full legal name. Who that is depends on the nation and the kind of school:

The signatory confirms that they are authorised to accept this DPA on the controller's behalf. If the school has told Squono the wrong controller, the school must correct it and accept again.

How acceptance in the app works

• The signatory's name and role, the controller type and legal name, the schools covered (for a trust or council), the nation, the date and time, the version of this DPA and a cryptographic hash of this exact text are recorded, together with the Squono account used and a keyed hash of the IP address.
• A countersigned copy, showing those details and Squono as processor, can be downloaded as a PDF at any time.
• The school can't invite parents until this DPA has been accepted.
• When this text changes it gets a new version number. The new version must be accepted before any more parents are invited. Squono will tell the school's administrators at least 30 days before a new version replaces the one the school accepted, unless the change is needed sooner to comply with the law.

3. Subject matter, duration, nature and purpose

4. Data subjects and personal data

Pupils do not have Squono accounts. Dates of birth are never stored: if an import file contains them, the year group is worked out and the date is discarded.

Special category data is excluded by default

The medical information feature is off by default for schools, because the school's MIS is the right place for medical information. Consent slips can ask only a yes/no question about changes to medical needs, and tell parents to give the details to the school office. Squono never collects the detail on a slip.

If the school chooses to switch the medical information feature on, that is the school's documented instruction and the school must record its own Article 9 condition. Medical details can then be read only by the child's parents and staff given medical access, every read is logged, and the details are deleted 30 days after the pupil leaves.

The school must not use Squono to record safeguarding or child protection concerns, SEND information or health records. It is not a record-keeping system for those.

5. The controller split: what Squono is responsible for itself

Squono processes school data as the school's processor. A small amount of data is Squono's own, and Squono is the controller for it. The split is stated here openly so that nobody is unsure who is responsible for what.

Squono is the controller for

• Each parent's and staff member's own Squono account: login details, password (stored only as a hash), two-factor settings, sign-in and security logs, notification settings and devices.
• A parent's use of Squono for their own clubs and teams outside school, which is between the parent and those clubs.
• Service emails about the account itself, such as sign-in codes and password resets.
• Squono's own billing. Nothing is billed to schools, and Squono Pro is not available to school teams.

Everything else is school data

Everything the school puts into Squono, and everything created on the school's instructions, is school data that Squono processes only as processor under this DPA. That includes pupil lists and parent contacts from the import, teams, fixtures, consent slips and answers, transport details, registers, results, photos, documents, staff messages and the link between a parent's account and the school's pupils.

When a parent accepts the school's invitation, their account is theirs. If the school leaves Squono, the parent keeps their account (under Squono's privacy notice), but its link to the school and all school data are deleted under section 14.

6. Documented instructions – Article 28(3)(a)

Squono processes school data only on the school's documented instructions, including instructions about transfers outside the UK, unless the law requires otherwise. If the law requires other processing, Squono will tell the school before doing it, unless the law forbids that.

The school's instructions are:

• this DPA;
• the school's choices and settings in the app, for example who is invited, which features are on, results publishing levels, consent slip levels and retention settings; and
• written instructions from the school's administrators or data protection officer sent to hello@squono.com.

If Squono thinks an instruction breaks data protection law, it will tell the school straight away.

7. Confidentiality – Article 28(3)(b)

Everyone Squono authorises to process school data is bound by a duty of confidentiality, by contract or by law, and sees only what they need for the task.

Squono staff can see a school's data only through a support grant that the school approves in the app. A grant lasts 2 hours by default and 24 hours at most, and every access under it is recorded in the audit log.

8. Security – Article 28(3)(c)

Squono takes the measures required by Article 32 of the UK GDPR. They are described in the security overview (squono.com/schools/trust/security), which forms the security annex to this DPA. In summary: hosting in London; HTTPS everywhere; two-factor authentication required for every school staff account before any school data can be seen; permission checks on the server for every request; an audit log; and time-limited, school-approved support access.

Squono will not reduce the overall level of security described in the security overview while this DPA is in force.

9. No use of school data for Squono's own purposes

Squono uses school data only to provide, secure and support the service for the school. In particular:

• no advertising – Squono shows no adverts to anyone;
• no sale, rental or sharing of school data for anyone else's purposes;
• no profiling of pupils, parents or staff;
• no product analytics on pupil data – Squono uses no analytics or advertising tools of any kind;
• no AI training – school data is never used to train or improve AI or machine-learning models, and Schools mode has no face recognition or automatic tagging;
• no marketing to parents using school data – Squono never uses contact details from the school, or anything else the school provides, to market to parents;
• Squono Pro (match video) is not available to school teams and is never promoted to parents of school teams, in the app or by email.

10. Sub-processors – Articles 28(2), 28(3)(d) and 28(4)

The school gives Squono general written authorisation to use the sub-processors in the published list (squono.com/schools/trust/sub-processors), which shows what each one does, where, and the transfer mechanism used.

• Squono will give at least 30 days' notice before adding or replacing a sub-processor that processes school data, by email to the school's administrators and data protection contact, and on the list with the date.
• The school may object on reasonable data protection grounds during those 30 days. Squono will discuss the objection with the school. If it can't be resolved, the school may stop using Squono, and Squono will complete the export and deletion in section 14.
• Squono imposes data protection obligations on each sub-processor by contract that give the protection Article 28(3) requires (Article 28(4)). Some sub-processors are large providers whose standard data processing terms Squono relies on.
• Squono remains fully liable to the school for the performance of each sub-processor's obligations.

11. International transfers

School data is hosted, stored and emailed from London (Amazon Web Services, eu-west-2). Squono transfers personal data outside the UK only as shown in the sub-processor list:

• Push notifications to phones go through Google Firebase Cloud Messaging and, for iPhones, Apple Push Notification service. They carry a device token and the notification text, and are used only if a parent or staff member installs the app and allows notifications.
• The Squono mobile app downloads its fonts from Google's servers the first time it runs, which sends the device's IP address to Google.

The transfer mechanisms are listed with each provider. Squono will not start any other transfer of school data outside the UK without following section 10.

For schools in Ireland, processing in the UK relies on the European Commission's adequacy decision for the UK. The school's DPO should check its current status before relying on this.

12. Helping with data subject rights – Article 28(3)(e)

• Squono will help the school respond to requests from pupils, parents and staff to exercise their rights (access, rectification, erasure, restriction, objection and portability).
• Most requests can be handled by the school directly in the app: staff can correct and delete records and export the school's data.
• Where the school needs more, Squono will provide the information, export or deletion within 5 working days of the school's request.
• If someone asks Squono directly about school data, Squono will pass the request to the school within 5 working days and will not answer it on the school's behalf unless the school asks it to. Requests about a person's own Squono account (section 5) are answered by Squono as controller.

13. Breaches, DPIAs and prior consultation – Article 28(3)(f)

Personal data breaches

Squono will tell the school about a personal data breach affecting school data without undue delay, with a target of 24 hours, and never later than 48 hours after becoming aware of it. That leaves the school time to decide whether to report to the regulator within its own 72-hour deadline.

The notice will describe, as far as is then known:

• what happened and when;
• the categories and approximate numbers of people and records affected;
• the likely consequences;
• what Squono has done and proposes to do, including to limit any harm; and
• who to contact at Squono for more information.

Squono will send updates as it learns more, keep a record of the breach, and help the school with any report to the regulator or to the people affected. Squono won't tell the regulator or affected people about a breach of school data on the school's behalf unless the school asks it to or the law requires it.

Security, DPIAs and consultation with the regulator

Squono will help the school meet its duties under Articles 32 to 36 of the UK GDPR, taking into account the nature of the processing: it publishes a pre-filled DPIA template (squono.com/schools/trust/dpia), answers the school's DPO's questions, and gives the information needed if the school consults the regulator.

14. End of the service: return and deletion – Article 28(3)(g)

• The school can export its data at any time, including CSV exports of fixtures, results, attendance and consent slips.
• The school can stop using Squono at any time by emailing hello@squono.com from an administrator's email address or through its data protection officer.
• On termination, Squono will make the export available and then delete the school's data within 30 days of termination, unless the law requires it to keep something (in which case Squono will tell the school what and why).
• Database backups roll off within 35 days, so deleted data leaves every backup within 35 days of deletion.
• Deletion at exit is a manual process run by Squono. On request, Squono will confirm in writing that the deletion is complete.
• Parents' and staff members' own accounts are not school data (section 5). They stay open unless their owners delete them, but lose every link to the school.

15. Information and audits – Article 28(3)(h)

• Squono will make available all information necessary to show that it meets Article 28, starting with this supplier pack (squono.com/schools/trust).
• Squono will answer the school's supplier questionnaire once a year free of charge.
• The school, or an auditor it appoints who is bound by confidentiality, may carry out an audit or inspection, on site or remotely, on reasonable notice and at the school's cost. Audits normally take place no more than once a year, unless they follow a personal data breach or a regulator's request.

16. The school's responsibilities

• Having a lawful basis for the processing it instructs, and telling parents about it (a privacy notice template is in this pack).
• Keeping the data it imports accurate, including re-importing photo consent each academic year.
• Deciding who is invited, what is shared and at which results publishing level.
• Keeping the controller details and signatory in the app correct.
• Staff following the school's own policies, including its photo and device policies.

17. Governing law and nation variants

18. Changes, and how long this DPA lasts

• This DPA lasts as long as Squono processes school data for the school, and its deletion and confidentiality terms continue after that.
• Squono may publish a new version to reflect changes in the law, the service or its sub-processors. The version the school accepted stays in force until the school accepts a new one or stops using Squono.
• Each version is published with its date on this page, and older versions are available on request.