Data processing agreement
These texts are drafts. A UK solicitor reviews these before any school is charged.
In short
- For student data, the school decides and MyDS acts on its behalf.
- MyDS follows the school's instructions and nothing else.
- The helpers we use are listed below.
01Roles
The school is the controller of its students' data. MyDS is the processor: it handles that data for the school and only for the school.
02Instructions
MyDS processes school data only on the school's instructions, to provide the service, and helps the school answer requests from its students.
03Staff and security
People at MyDS who can reach school data are bound by confidentiality. MyDS protects the data with technical and organisational measures, including encryption in transit and at rest, and stores it in the UK.
To complete after legal review: The measures schedule, completed after the security review.
04Helpers (sub-processors)
These companies help MyDS run the service. Every row is a sample until the final suppliers are confirmed.
| Supplier | What it does | Where |
|---|---|---|
| Amazon Web Services Sample | Hosting and file storage | London [VERIFY] |
| Amazon SES Sample | To be confirmed [VERIFY] | |
| AWS End User Messaging Sample | SMS | To be confirmed [VERIFY] |
| Amazon Bedrock Sample | AI drafts | Region to be confirmed [VERIFY] |
| Amazon Transcribe Sample | Voice notes to text | To be confirmed [VERIFY] |
| Meta WhatsApp Cloud API Sample | WhatsApp messages | To be confirmed [VERIFY] |
| Telnyx Sample | Phone calls | To be confirmed [VERIFY] |
| Twilio Sample | SMS fallback, if used | To be confirmed [VERIFY] |
Card payments go through the school's own Stripe account; Stripe is not a MyDS sub-processor. [VERIFY]
05Data breaches
MyDS tells the school about a breach affecting its data without delay and within 72 hours.
06When a school leaves
MyDS returns the data (export) and then deletes it after 30 days, except the records the law says must be kept, such as financial records for 5 years or more.
07Audits
On request, MyDS shows the school what it needs to check that this agreement is followed. [VERIFY]
To complete after legal review: Whether schools accept this agreement online at sign-up.