Data Processing Agreement

Plain English: You — the practitioner or setting — are the Data Controller. We are the Data Processor. Your students' data never leaves your Google Workspace. We provide the software engine; you hold the keys. This agreement makes that relationship legally explicit under UK GDPR.

1. Parties

Data Controller

The subscribing practitioner, AP setting, or academy.

You determine the purposes and means of processing student personal data. You bear full legal responsibility as Data Controller under UK GDPR and the Data Protection Act 2018.

Data Processor

The Arena Hub Ltd

Company No. CH#1708605
Registered in England & Wales
D-U-N-S: 234652645
Tel: 01618702916
Email: compliance@thearenahub.co.uk

This DPA takes effect upon completing the Arena Lite subscription checkout or executing a written agreement with The Arena Hub Ltd.

2. Subject Matter, Nature, and Duration

Subject matter: Provision of Arena Lite — a cloud-based evidence management platform enabling practitioners in Alternative Provision and SEMH settings to capture, organise, and report on student evidence within a forensically structured, UK GDPR-compliant architecture.

Nature of processing: Storage, retrieval, and automated cross-referencing of student educational evidence within your own Google Workspace environment. All student Personally Identifiable Information (PII) is processed and stored exclusively within your Google Workspace tenant. The Arena Hub Ltd's Cloud Run infrastructure (GCP europe-west2, United Kingdom — London) processes only anonymised licence validation handshakes and operational telemetry; no student PII transits or resides on Arena Hub servers during normal operation.

Duration: This DPA remains in force for the duration of your active Arena Lite subscription. Processor obligations on data destruction take effect upon termination as set out in Clause 10.

3. Purpose of Processing

Personal data is processed for the following educational purposes only:

Capture and forensic structuring of student evidence against statutory educational taxonomies (EYFS Development Matters, AQA Unit Award Scheme, and equivalent frameworks).
SEND portfolio management, EHCP progress tracking, and Graduated Approach documentation.
Safeguarding chronology management and KCSIE-aligned incident logging.
Attendance and engagement monitoring, including resilience indicator scoring.
AI-assisted evidence cross-referencing (Evidence Multiplier) — subject to mandatory practitioner review before any AI suggestion is committed to the student's formal record.
Gap analysis and LA-ready PDF report generation.

4. Types of Personal Data and Data Subjects

Data Subjects

Students (children and young people) enrolled at the subscribing setting. Secondary data subjects: teaching and support staff whose identity is recorded in practitioner attribution fields.

Standard Personal Data (Article 6)

Student name, Unique Pupil Number, date of birth, year group, cohort, enrolment dates. Staff name, school email, job role, and practitioner attribution within evidence records.

Special Category Data (Article 9)

Health and neurodevelopmental data: SEND category and EHCP status where recorded for curriculum planning purposes.
Welfare and safeguarding data: Welfare chronology entries and DSL case records. Processed under DPA 2018 Schedule 1, Part 1 (safeguarding children).
SEMH indicators: Engagement scores and welfare flags requiring mandatory human DSL review before any formal record is created.

Lawful basis — Standard data: Article 6(1)(e) — public task. Grounded in the Education Act 1996, Children and Families Act 2014, SEND Code of Practice 2015, and DfE Alternative Provision statutory guidance.

Lawful basis — Special category data: Article 9(2)(g) — substantial public interest. DPA 2018 Schedule 1, Part 2 (health or social care) and Part 1, para. 18 (safeguarding children).

5. Processor Obligations — Article 28 UK GDPR

5.1 Process only on documented instructions

The Processor shall process personal data only on the Controller's documented instructions. This DPA and the platform's technical architecture (Sovereign Hybrid v7.0.0) constitute those instructions. Where the Processor considers an instruction to infringe UK GDPR, it shall immediately inform the Controller.

5.2 Confidentiality

All persons authorised to process personal data under this DPA are bound by confidentiality obligations. Access to Controller data is restricted to personnel with a specific operational requirement, subject to role-based access controls.

5.3 Security

The Processor shall implement appropriate technical and organisational measures in accordance with UK GDPR Article 32 (see Clause 8).

5.4 Sub-processors

By accepting this DPA, the Controller grants general authorisation to engage the sub-processors listed in Clause 7. The Processor shall notify the Controller of any intended changes to the sub-processor schedule no less than 30 days before the change takes effect, giving the Controller the opportunity to object.

5.5 Data Subject Rights

The Processor shall assist the Controller in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection). Because all student data resides in the Controller's own Google Workspace, the Controller can action the majority of Subject Access Requests directly. Where technical assistance is required, the Processor shall respond within 48 hours of written request.

5.6 Audit Rights

The Processor shall make available all information necessary to demonstrate compliance with this DPA. Written responses to compliance questionnaires will be provided within 10 working days. A completed DPIA (ARENA-DPIA-2026-001, v1.1, approved 2 May 2026) is available upon request from compliance@thearenahub.co.uk.

6. Automated Processing and Article 22

Arena Lite includes AI-assisted components. The following applies to all automated processing:

Evidence Multiplier: Cross-references submitted evidence against adjacent taxonomy criteria. Suggestions include a confidence score and require explicit practitioner approval before being committed to the student's formal record. No AI suggestion enters the statutory record without authenticated human review.

No automated decision-making: No decision producing legal or similarly significant effects on a student is made solely by automated means. The platform is a Decision-Support Infrastructure. The practitioner is the Decision Authority. This is constitutionally enforced under Article VI of the Sovereign Educational Infrastructure Constitution.

7. Authorised Sub-Processors

Sub-Processor	Purpose	Data	Transfer Basis
Google LLC Google Workspace	All student data is stored exclusively in the Controller's own GWS tenant. Google hosts under the Controller's GWS terms.	All student PII (Controller-held). Arena Hub holds no copies.	UK–US Data Privacy Framework
Google LLC GCP europe-west2 (London)	Anonymised telemetry and HMAC-authenticated licence validation. No student PII transits this layer.	Anonymised event logs + practitioner email + licence key only.	UK–US Data Privacy Framework. UK data residency.
Twilio Inc.	DSL two-factor authentication (SMS) only. Used solely to verify DSL identity when accessing the Welfare Silo.	DSL mobile number only. Not linked to student data.	UK Standard Contractual Clauses
Google Gemini AI	NODE insights: AI-assisted welfare pattern detection for DSL advisory flagging. Stateless — no student data is used for AI training.	Anonymised signal summaries only. No student names or UPNs included.	Google Cloud API Terms. europe-west2 (London).

8. Technical and Organisational Measures

Sovereign Data Anchoring

All student PII stored exclusively in the Controller's GWS tenant. Arena Hub holds zero copies at rest.

Role-Based Access Control

GWS-native permissions govern all access. Managed by the Controller's GWS administrator.

Welfare Silo

Safeguarding data in a GWS subfolder with inheritance revoked. DSL-exclusive access only. Arena Hub has no access to this silo.

VAR Sentry — Immutable Audit Trail

Every edit captured with WHO / WHAT / WHEN / WHERE. Cannot be altered or deleted by any user.

HMAC-Authenticated Perimeter

The only data crossing the GWS boundary is a cryptographically signed licence handshake. Contains no student PII.

DSL Two-Factor Authentication

Welfare Silo access requires GWS OAuth + Twilio SMS 2FA. A compromised GWS credential alone cannot access safeguarding records.

Forensic Firewall

Constitutionally prohibits automated emotional state classification, neurological profiling, and automated risk scoring without human review.

Stateless AI Inference

All Gemini AI calls are stateless. No student data retained between calls. No student data used for model training.

9. Data Breach Notification

The Processor shall:

Notify the Controller within 12 hours of becoming aware of any confirmed or suspected personal data breach.
Provide a written incident report within 48 hours covering: nature of the breach; categories and approximate number of data subjects and records affected; likely consequences; and measures taken to address the breach.
Not notify the ICO on the Controller's behalf unless explicitly instructed to do so. The Controller bears sole responsibility for its own ICO notifications under Article 33.

10. Processor Director Access — User-Initiated Temporary Support Access

Zero persistent access: As of version 1.2, the Processor Director holds no persistent editor access to the Controller’s Arena Lite spreadsheet. Access is granted only at the explicit, real-time request of the Controller for a defined support window, and is automatically revoked on expiry.

Arena Lite operates on a Shell-owns-Drive architecture. The Arena Lite Portal Shell — which executes as the accessing user (the Controller) — creates the Arena Lite spreadsheet within the Controller’s Google Workspace during activation. No editor access is granted to the Processor Director during this process. The Arena Engine Library runs as the accessing user for all normal platform operations.

User-initiated temporary support access: If the Controller encounters a technical issue and wishes to grant the Processor Director (j.baguley@thearenahub.co.uk) access for debugging purposes, they may do so via the “Grant Support Access” function in the Arena Lite Portal Dashboard. This mechanism:

(a) Is initiated exclusively by the Controller — no access can be granted without the Controller’s explicit action;
(b) Grants editor-level access to the Controller’s Arena Lite spreadsheet only — no other files in the Controller’s Google Workspace are affected;
(c) Is time-limited: the Controller selects a support window (default: 48 hours), after which a GAS time-based trigger automatically revokes access;
(d) May be revoked at any time by the Controller via the “Relinquish Access” function in the Portal, or by the Processor Director via the Command Centre;
(e) Is fully audited: every grant and revocation event is written to a forensic SUPPORT_ACCESS_LOG tab within the Controller’s own Arena Lite spreadsheet, recording timestamp, granted account, duration, and action type;
(f) Is subject to the full confidentiality obligations in Clause 5 — the Processor Director will not access, copy, share, or use Controller data for any purpose other than resolving the specific technical issue raised by the Controller.

Protected ranges: Certain sheet ranges (including the STUDENT_AUDIT_LOG and SUPPORT_ACCESS_LOG tabs) are protected from manual editing via GAS sheet protection. These protections are enforced by the Google Apps Script execution model; no human has manual write access to these protected ranges.

11. Return and Deletion of Data

Because all student data resides in your own Google Workspace, you retain unconditional physical control at all times. Upon termination:

Your student data remains in your GWS. Access is ended by revoking the platform's GWS API authorisation — no action by the Processor is required.
The Processor shall destroy all configuration and licence data within 30 days of termination and provide written confirmation upon request.
Account data (email, name, organisation name, licence record) is retained for a maximum of 30 days post-termination for query resolution, then permanently deleted.

The Controller's statutory retention obligations remain in force independently of this DPA: safeguarding records (25 years), student performance records (6 years), audit logs (7 years).

12. International Data Transfers

All primary student data processing occurs within the United Kingdom. Arena Hub Ltd's GCP infrastructure operates exclusively in the europe-west2 (London) region. No student PII is transferred outside the UK during normal operation. Sub-processor transfers under US law are governed by the UK–US Data Privacy Framework and UK Standard Contractual Clauses (see Clause 7).

13. Governing Law

This DPA is governed by the laws of England and Wales. Any dispute shall be subject to the exclusive jurisdiction of the courts of England and Wales. This DPA forms part of the Arena Lite subscription agreement and prevails over the subscription terms in respect of personal data processing where any conflict arises.

14. Contact

For all DPA queries, DPIA requests, audit enquiries, or to exercise Controller rights:

The Arena Hub Ltd · CH#1708605 · Registered in England & Wales

Email: compliance@thearenahub.co.uk

Tel: 01618702916

Response: all DPO queries acknowledged within 48 hours; documentation requests fulfilled within 5 working days.