Education Data Processing Agreement

Modified on Thu, 17 Jul, 2025 at 12:38 PM

We hope this initial response is helpful, summarising our data processing and privacy practices.

Education Data Processing Agreement (Link)

We act as the data processor for information extracted from your MIS, which we use solely to deliver our services. Our Data Processing Agreement (DPA) outlines how we collect, use, and retain this data. Appendix A details our obligations under relevant Data Protection legislation, including the UK GDPR. It covers key areas such as:

Confidentiality
Data security
Compliance responsibilities
Data breach handling
Subject access rights
Secure data disposal

ISO 27001 Compliance

We are compliant with the ISO 27001 international standard for information security management and undergo annual third-party audits. Our certified Information Security Management System (ISMS) applies across all areas of our operations and supports continual improvement in security and privacy management.

Date Privacy Policy (Link)

Our Privacy Policy reflects a low tolerance for risk in relation to data protection and outlines the privacy principles embedded throughout our operations. It explains our commitment to a Privacy by Design and Default approach — ensuring data protection is built into every stage of our service lifecycle. This includes safeguards for accurate processing and appropriate data retention. It also sets out our approach to Data Sharing, confirming that personal data is only shared:

When lawful and necessary
With a valid legal basis or clear consent
Limited to what is strictly required
Never disclosed informally or to unauthorised individuals

All staff receive regular training on Cloud Design Box’s data handling standards.

How can we help further?
If you have any further questions or would like additional clarification, please don’t hesitate to get in touch. For example, if you are drafting a DPIA for our product and would like support with specific sections relating to Cloud Design Box, feel free to share them — we’ll be more than happy to assist. Our goal is to help you feel confident and fully supported in meeting your data protection obligations.