This agreement applies when ActivityOS handles personal data on behalf of a school, club, studio or other organisation that uses the ActivityOS platform. It forms part of the main agreement between the two parties, and the customer accepts it by creating an account or using the platform.
Data Protection Laws means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended from time to time, including by the Data (Use and Access) Act 2025.
Personal Data, Data Subject, Controller, Processor, Processing, Personal Data Breach and Special Category Data have the meanings given in the Data Protection Laws.
Customer Data means all Personal Data that the Customer or its users enter into, upload to or create through the ActivityOS platform, including data about pupils, parents, guardians and staff.
Services means the ActivityOS platform and related support, as described in the main agreement. Sub-processor means a third party we engage to process Customer Data.
For Customer Data, the Customer is the Controller and ActivityOS is the Processor.
Schedule 1 sets out the subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects.
ActivityOS is a separate Controller of the account data it holds about the Customer's users for its own purposes, such as managing accounts, billing the subscription, security and support. That data is covered by our Privacy Policy and not by this agreement.
We process Customer Data only on the Customer's documented instructions, including on transfers outside the UK, unless the law requires otherwise. If it does, we will tell the Customer before processing unless the law prevents us. The main agreement, this agreement and the Customer's use and configuration of the platform are the Customer's complete instructions.
If we believe an instruction breaks the Data Protection Laws, we will tell the Customer promptly and may pause that instruction until it is clarified.
We do not sell Customer Data or use it for advertising. We use it only to provide, secure and support the Services.
The Customer is responsible for having a lawful basis for the data it enters and for telling Data Subjects, including parents and guardians, how their data is used.
Most pupils are children. Where the Customer relies on consent, for example for photographs, performances or sharing health information, it must obtain it from a parent or guardian and keep the record up to date.
If the Customer records health information, it must have a condition under Article 9 of the UK GDPR. If it records DBS check information, it must have a lawful basis under Article 10 and the Data Protection Act 2018. The Customer should enter only what it needs.
The Customer controls who has access to its account and what each staff member can see, and is responsible for keeping sign-in details secure.
Everyone we authorise to process Customer Data is bound by a duty of confidentiality and can access it only as far as their work requires.
We keep appropriate technical and organisational measures in place to protect Customer Data, including:
We review these measures regularly. We may change them, but not in a way that reduces the overall level of protection.
The Customer gives general authorisation for us to use the Sub-processors listed in Schedule 2.
We will give at least 30 days' notice, by email or in the platform, before adding or replacing a Sub-processor.
The Customer may object on reasonable data protection grounds during that notice period by writing to the contact in clause 16. We will try to resolve the objection. If we cannot, the Customer may end the affected Services and receive a pro-rata refund of fees paid for the period after termination.
We have a written contract with each Sub-processor that gives data protection obligations no less protective than this agreement, except that Google Drive is used only to hold backups that are encrypted before upload, so Google cannot read them. We remain responsible to the Customer for each Sub-processor's performance.
Customer Data is stored in Germany. The UK recognises the European Economic Area as providing adequate protection for personal data.
Some Sub-processors process data outside the UK and EEA, including in the United States. We allow this only where a lawful transfer mechanism applies: the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge) for certified providers, or the ICO's International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses. Schedule 2 states the position for each Sub-processor.
The Customer instructs us to make the transfers described in Schedule 2.
We help the Customer respond to requests from Data Subjects, such as access, correction and deletion, through the platform's tools and, where needed, direct assistance.
If a Data Subject contacts us directly about Customer Data, we will not respond on the Customer's behalf. We will pass the request to the Customer without undue delay.
We will tell the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data.
The notice will describe, as far as we know, what happened, the categories and approximate number of people and records affected, the likely consequences, what we have done and what we propose to do, and a contact for questions. We may provide this in stages as we learn more.
We will take reasonable steps to contain the breach and will co-operate so the Customer can meet its own duties to notify the ICO and affected individuals.
Taking into account the nature of the Processing and the information we hold, we will help the Customer meet its obligations under Articles 32 to 36 of the UK GDPR, which cover security, breach notification, data protection impact assessments and prior consultation with the ICO.
On reasonable written request, we will give the Customer the information needed to show that we comply with this agreement and Article 28 of the UK GDPR.
The Customer, or an independent auditor bound by confidentiality, may audit our compliance once in any 12 months, or sooner after a Personal Data Breach or if a regulator requires it. The Customer must give at least 30 days' written notice, audit during business hours, avoid unreasonable disruption and pay its own costs.
We may meet an audit request by providing recent third-party audit reports or certifications for our Sub-processors and written answers to a reasonable security questionnaire, where these give the information required. An audit does not extend to other customers' data.
We keep Customer Data while the Customer's account is active. The Customer decides what to keep and can delete records at any time.
Unless the Customer instructs otherwise, the platform applies these rules:
When the agreement ends, or on the Customer's written request, we will make Customer Data available for export for 30 days and then permanently delete it from live systems within a further 30 days, unless the law requires us to keep it. Encrypted backups are deleted on their normal weekly cycle, and no later than six weeks after the live data is deleted. Some records are kept for the periods in Schedule 1, for example invoices for six years.
On request, we will confirm in writing that deletion is complete.
Each party's liability under this agreement is subject to the limits in the main agreement. Nothing in this agreement limits liability that the law does not allow to be limited.
This agreement lasts for as long as we process Customer Data.
We may update it to reflect changes in the law or the Services. We will give at least 30 days' notice of material changes and keep the version history below.
If this agreement conflicts with the main agreement on the handling of Customer Data, this agreement prevails.
This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
For questions about this agreement, to raise an objection under clause 7, or to report a concern about how Customer Data is handled, contact hello@activityos.co.uk.
Stephen Butterworth, trading as ActivityOS, c/o North Wales Accounting, Apartment 31, St. Trillo's Court, Rhos Promenade, Rhos on Sea, Conwy, LL28 4PY.
Pupil health information entered by the Customer or by parents on its behalf: allergies, medical conditions, emergency action, GP name and phone number. See clause 4.3.
Article 9DBS check records for staff, where the Customer chooses to record them.
Article 10By accepting this agreement, the Customer approves these Sub-processors. Customer Data is stored in Germany and may be processed by the others as described.