Data Processing Agreement

1. Definitions

For the purposes of this Agreement, Controller, Processor, Personal Data, Processing and Data Subject have the meanings set out in the UK General Data Protection Regulation (UK GDPR).

Service means the iMedia Hub online learning platform.

2. Subject Matter and Duration of Processing

Hub Learning Ltd shall process personal data solely for the purpose of providing the Service to the Controller. Processing shall continue only for the duration of the Controller's use of the Service and in accordance with the Controller's instructions.

3. Nature and Purpose of Processing

Processing activities include:

• Creation and management of user accounts
• Delivery of assignments, revision tasks and learning activities
• Storage of student responses and progress data
• Provision of analytics to authorised school staff
• System authentication, security and technical support

Hub Learning Ltd shall not process personal data for any purpose other than providing the Service under the Controller's instruction.

4. Categories of Data Subjects

• Students and pupils
• Teachers
• School administrators
• Authorised school staff using iMedia Hub

5. Types of Personal Data

Personal data processed may include:

• Names
• School email addresses
• User roles
• Class or group membership
• Assignment responses, revision activity and progress data
• Scores, XP, completion timestamps and activity records
• Authentication and security logs

No special category data is intentionally processed. Schools and users should not enter sensitive personal data into free-text fields.

6. Controller Responsibilities

The Controller shall:

• Determine the lawful basis for processing
• Provide appropriate privacy information to pupils, parents and staff where required
• Ensure personal data provided to the Service is accurate, necessary and appropriate
• Determine retention requirements
• Ensure appropriate safeguarding and educational use of the Service
• Manage data subject rights requests where the school is the Controller

7. Processor Obligations

Hub Learning Ltd shall:

• Process personal data only on documented instructions from the Controller
• Ensure persons authorised to process personal data are subject to confidentiality obligations
• Implement appropriate technical and organisational measures to protect personal data
• Not sell, share or use personal data for advertising, profiling or independent purposes
• Assist the Controller, where reasonably possible, with data subject rights requests
• Inform the Controller if an instruction is considered to infringe UK GDPR

8. Security of Processing

Hub Learning Ltd shall implement appropriate technical and organisational measures including:

• HTTPS encryption in transit
• Secure password hashing
• Role-based access controls
• Restricted administrative access
• Secure UK-based hosting infrastructure
• Regular updates and security monitoring
• Backups stored within secure hosting infrastructure

These measures are designed to ensure a level of security appropriate to the risk in accordance with UK GDPR Article 32.

9. Sub-processors

Hub Learning Ltd may use sub-processors where necessary to provide infrastructure, hosting, email, security and related technical services.

Current sub-processor:

• Fasthosts (UK) - hosting and infrastructure services

Hub Learning Ltd shall ensure that sub-processors are subject to data protection obligations no less protective than those set out in this Agreement. The Controller will be informed of material changes where required.

10. International Transfers

Personal data is hosted within the United Kingdom. Hub Learning Ltd does not routinely transfer personal data outside the UK. If international transfers become necessary, appropriate safeguards will be implemented in accordance with UK GDPR.

11. Personal Data Breaches

Hub Learning Ltd shall notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data. Notification shall include, where available:

• The nature of the breach
• The categories of data affected
• Likely consequences
• Measures taken or proposed to mitigate the effects

12. Data Subject Rights

Hub Learning Ltd shall assist the Controller, where reasonably possible, in fulfilling obligations relating to access requests, rectification, erasure, restriction of processing and data portability.

Requests received directly from data subjects will be referred to the Controller unless legally required otherwise.

13. Deletion or Return of Data

Upon termination of the Service, Hub Learning Ltd shall, at the Controller's instruction:

• Delete personal data, or
• Provide an export where technically feasible

Residual data contained within backups shall expire through normal backup rotation processes.

14. Audit and Compliance

Hub Learning Ltd shall make available reasonable information necessary to demonstrate compliance with this Agreement and allow reasonable audits or inspections by or on behalf of the Controller, subject to confidentiality and security safeguards.

Hub Learning Ltd will provide reasonable information to assist schools with Data Protection Impact Assessments where iMedia Hub forms part of the processing activity.

15. Changes to this Agreement

Hub Learning Ltd may update this Data Processing Agreement from time to time to reflect changes in legislation, platform functionality, security practices or operational requirements. The latest version will be published on the iMedia Hub website.

16. Order of Precedence

This Agreement governs data protection matters between the parties and takes precedence over conflicting provisions relating to data protection in other service terms.

17. Contact

For questions about this Data Processing Agreement or data protection, please contact contact@imediahub.co.uk.