Data Processing Agreement

Processor

Early Years Business Support Ltd — Company Number 15975558 — ICO Registration Reference ZB818168.

Controller

The subscribing nursery, provider, business or other Customer using EYBS Compass.

Where the Customer determines why and how Customer Personal Data is processed, the Customer acts as Controller and EYBS acts as Processor where processing is carried out on that Customer's instructions.

This DPA applies where EYBS processes personal data on behalf of the Customer through EYBS Compass.

EYBS may separately act as Controller for its own billing, account administration, contractual records, security, business administration and legal compliance.

Both parties will comply with their applicable UK data-protection obligations. Early Years Business Support Ltd is registered with the ICO under registration reference ZB818168.

The subject matter is the provision, hosting, operation, maintenance, security and support of EYBS Compass.

The DPA applies for the duration of the Customer's use of EYBS Compass plus any appropriate period required afterwards for return, deletion, backup, legal retention and security.

Processing may include collection, recording, storage, organisation, retrieval, consultation, document extraction, indexing, AI-assisted retrieval, searching, display, updating, backup, restriction and deletion.

The purpose is to provide services including Documents, Ask Compass, Audits, Risk Assessments, Actions, Nursery Site management, multi-site permissions, user management, notifications, Ofsted Readiness, support and audit logging.

EYBS Compass is intended primarily to process organisational compliance documentation and user and account information.

Data subjects may include owners, directors, managers, employees, apprentices, volunteers, applicants, contractors, suppliers, professional contacts and parents or carers. Children would only be data subjects where a Customer independently chooses to upload a document containing identifiable information about a child.

Personal data may include names, contact details, job titles, user roles, account information, training and compliance information, audit information, actions, policy acknowledgements, support records, audit logs and information contained in Customer-uploaded Documents.

EYBS Compass is intended primarily to process organisational compliance documentation and user and account information. Personal data may be present within Customer-uploaded documents where the Customer chooses to include it. EYBS Compass does not require detailed child, safeguarding, medical or employee case records for its ordinary compliance functionality.

The Customer remains responsible for deciding whether personal information contained in an uploaded document is necessary, proportionate and lawful.

Uploaded documents may be processed, text extracted, indexed, searched and retrieved for the purpose of providing Ask Compass. This indexing does not create profiles about individual children, parents or employees.

Special-category personal data is not required for ordinary EYBS Compass account operation or ordinary Ask Compass use.

If a Customer independently uploads a document containing special-category information, the Customer remains responsible for ensuring that:

• the information is necessary
• an appropriate lawful basis applies
• an appropriate Article 9 condition applies where required
• access is restricted appropriately
• suitable retention arrangements are in place

Customers should not routinely upload individual child case files, safeguarding chronologies, child protection case records, individual medical records, detailed accident or incident case records containing unnecessary personal data, staff disciplinary files, staff grievance files, detailed HR case files or other sensitive personal records, unless EYBS Compass has specifically been configured and agreed for that purpose.

EYBS will process Customer Personal Data only on documented Customer instructions, as reasonably necessary to provide EYBS Compass, or where required by UK law.

Use and configuration of EYBS Compass constitutes documented instructions for processing necessary to provide the service.

The Customer remains responsible for determining lawful bases, deciding what information to upload, data minimisation, privacy information, special-category conditions, retention, user permissions, individual rights requests, accuracy and lawful instructions.

The Customer remains responsible for deciding whether personal information contained in an uploaded document is necessary, proportionate and lawful, and for ensuring that documents uploaded to EYBS Compass are appropriate and limited to information necessary for the intended compliance purpose.

EYBS will ensure persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

EYBS will maintain appropriate technical and organisational security measures, which may include authentication, role-based permissions, tenant separation, Nursery Site separation, least-privilege access, protected storage, secure password handling, encryption where supported and appropriate, audit logging, controlled Super Admin access, support-session logging, backups and security incident processes.

EYBS Compass is a multi-tenant service. Each Organisation's private information must remain separated from unrelated Organisations. Data should remain separated according to Organisation, Nursery Site, authorised user, role and enabled features.

Nursery Site permissions must be respected, Ask Compass retrieval must be limited to authorised data, and there must be no intentional cross-client fallback to another Organisation's or Nursery Site's private documents.

One Customer must not intentionally be provided another Customer's private information.

Ask Compass searches authorised policies, procedures and guidance documents available within the selected Nursery Site and uses relevant information from those documents to generate an answer.

Ask Compass must only retrieve information the authenticated user is authorised to access, and must not intentionally use private documents belonging to another unrelated Organisation or Nursery Site.

Authorised Customer Documents may be processed, text extracted, indexed, searched and retrieved to provide Ask Compass. Retrieval respects Organisation, Nursery Site, permissions and authorised Documents.

Customers should avoid uploading unnecessary personal or sensitive information into documents intended for Ask Compass.

Where the Previous Chats / Chat History feature is enabled, stored conversations may include questions, answers, titles, timestamps and source references, and follow applicable User, Organisation and Nursery Site permissions.

Where that feature is not enabled, Ask Compass conversations are not routinely retained as a stored conversation history.

EYBS may access a Customer environment where reasonably necessary for support, troubleshooting, maintenance, configuration assistance, security and administration.

Support access should be appropriately controlled and logged. EYBS does not require a Customer user's password to use authorised Support Mode.

The Customer provides general authorisation for EYBS to use subprocessors reasonably necessary to provide EYBS Compass. These may provide hosting, application infrastructure, databases, authentication, file storage, email, AI processing, document processing, indexing and search, monitoring and security.

EYBS will ensure relevant subprocessors are subject to appropriate contractual data-protection obligations and will maintain appropriate information concerning material subprocessors.

Where Customer Personal Data is subject to a restricted international transfer, EYBS will seek to ensure an appropriate legal transfer mechanism or safeguard is used.

Taking account of the nature of processing, EYBS will provide reasonable assistance to help the Customer respond to applicable individual rights requests. The Customer remains responsible for deciding and responding to those requests as Controller.

EYBS will notify the Customer without undue delay after becoming aware of a qualifying personal-data breach affecting Customer Personal Data where required, and will provide reasonably available information and assistance.

EYBS will provide reasonable assistance, where applicable, concerning security, breach management, individual notification, Data Protection Impact Assessments and regulatory consultation.

Where a Customer determines a DPIA is required, EYBS will provide relevant information reasonably available to it concerning EYBS Compass.

EYBS will make reasonably necessary information available to demonstrate compliance with applicable processor obligations.

Any audit or inspection must be proportionate, normally have reasonable notice, minimise disruption, protect other customers, maintain confidentiality and not compromise platform security.

At the end of the relevant processing service, EYBS will, at the Customer's choice where technically and legally applicable, return or delete relevant Customer Personal Data. Existing copies will also be deleted unless applicable UK law requires continued storage.

Protected backups may remain until overwritten through normal secure backup cycles provided the information remains appropriately protected and beyond normal use.

Pausing or archiving an account does not automatically instruct EYBS to permanently delete Customer Personal Data.

Turning off a module does not automatically delete data held within that module.

Where technically available and appropriate, EYBS will provide reasonable functionality or assistance for export of relevant Customer-controlled information.

Where this DPA conflicts with another term specifically concerning EYBS's processing of Customer Personal Data as Processor, this DPA takes priority to the extent of the conflict.

EYBS may update this DPA because of changes in law, regulatory guidance, changes to EYBS Compass, changes in processing or changes to subprocessors. Material changes may require re-acceptance.

An authorised representative registering an Organisation confirms they have authority to accept this DPA for the Customer. Electronic acceptance through EYBS Compass constitutes acceptance where applicable.