Data Processing Agreement

This agreement is between the School named on the accepted Founding Schools application (the Controller) and Net Werth Ltd, trading as Monteeno (the Processor).

It governs Monteeno’s processing of personal data on the School’s behalf while the School uses Monteeno under a school licence. It takes effect when the School’s licence is activated and continues until the licence ends and clause 8 has been completed.

Where this agreement and the School Licence Terms conflict on the handling of personal data, this agreement prevails.

The School is the controller of personal data relating to its pupils and staff. The School decides which pupils are given accounts and for what educational purpose.

Monteeno is the processor of that data, and processes it only to provide the service to the School.

Monteeno is a separate controller in respect of its own business records: the School’s application to the programme, the contact details of the School’s nominated staff, and correspondence between the parties. That processing is described in the Privacy Policy and is outside this agreement.

Set out in Annex A, together with the types of personal data and the categories of data subject, as required by Article 28(3) UK GDPR.

Monteeno processes the personal data only on the School’s documented instructions, including in relation to transfers to a third country, unless required to do otherwise by law. Where the law requires it, Monteeno will tell the School before processing unless the law forbids that notification.

The School’s documented instructions are: this agreement, the School Licence Terms, the actions taken by the School’s staff through the Monteeno interface, and any further written instruction the School gives.

Monteeno will tell the School if, in its opinion, an instruction infringes UK data protection law.

Monteeno does not and will not use pupil personal data to train machine learning models, to advertise to pupils, to build advertising profiles, or for any purpose of its own beyond providing and securing the service.

Monteeno ensures that the people authorised to process the personal data are bound by an obligation of confidentiality, and limits access to those who need it to deliver or support the service.

Monteeno implements the technical and organisational measures set out in Annex B, which are appropriate to the risk in accordance with Article 32 UK GDPR.

Annex B states what is in place and also what is not, including the certifications Monteeno does not hold. It is deliberately not written as a list of reassurances.

The School gives general authorisation for Monteeno to engage the subprocessors listed in Annex C.

Monteeno will give the School at least 30 days’ notice by email to the nominated contact before adding or replacing a subprocessor. The School may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the School may terminate the licence without penalty and clause 8 applies.

Monteeno imposes data protection obligations on each subprocessor equivalent to those in this agreement, and remains fully liable to the School for their performance.

At the School’s choice, Monteeno will delete or return the personal data at the end of the licence, and delete existing copies, unless required by law to retain them.

Monteeno will act on a deletion request within 30 days and confirm in writing when it is complete. Data in routine backups is overwritten in the ordinary backup cycle rather than extracted individually.

If the School gives no instruction, Monteeno will delete the School’s pupil accounts and learning records 12 months after the licence ends.

The 12-month rule is enforced automatically: a job runs every night and deletes pupil accounts and learning records once a School’s licence has been over for 12 months. A School that renews is not affected, because the rule looks for a current licence before deleting anything. Sign-in attempt records are deleted after 90 days and expired sessions after 30.

The database holding all pupil personal data is hosted in the United Kingdom (AWS eu-west-2, London). It was moved there from AWS us-east-1 on 24 September 2026. Pupil records processed under this agreement are not transferred outside the UK at the database layer.

Some subprocessors remain outside the UK, and the platform Monteeno contracts with has not confirmed its own transfer mechanism. Annex C marks each one. In particular the hosting platform is a United States company that has not supplied an Article 28 agreement or stated a transfer mechanism, despite being asked in writing. A School should take that into account rather than treat the move to London as settling every question.

A transfer risk assessment has been completed and is available to your data protection officer on request. Where a subprocessor is a US company, it is covered by the UK Extension to the EU-US Data Privacy Framework unless Annex C says otherwise, verified by us on the DPF register rather than taken from the provider.

The current position is set out in full on the data-protection page.

Taking into account the nature of the processing, Monteeno will assist the School by appropriate technical and organisational measures, so far as possible, in responding to requests to exercise data subject rights.

In practice: the School’s staff can view, correct and remove pupil records directly through the Monteeno interface. Where a request cannot be met that way, Monteeno will provide an export or perform a deletion on the School’s instruction within 30 days and at no charge.

If a data subject contacts Monteeno directly about data processed for the School, Monteeno will not respond substantively but will refer them to the School and tell the School promptly.

Monteeno will assist the School in complying with its obligations under Articles 32 to 36 UK GDPR, taking into account the nature of processing and the information available to it.

Monteeno will notify the School without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the School’s data, and will provide the information the School needs to meet its own notification duties.

Monteeno will make available to the School the information necessary to demonstrate compliance with this agreement, and allow for and contribute to audits, including inspections, conducted by the School or an auditor it mandates.

In the first instance Monteeno will respond to written questions and security questionnaires. An on-site or technical audit may be requested on reasonable notice, no more than once a year unless required by a regulator or following a breach.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Liability between the parties is deliberately left to be agreed rather than asserted here. Nothing in this agreement limits either party’s obligations or liability to data subjects or to the Information Commissioner under UK data protection law, which cannot be contracted out of in any event.