This Data Processing Agreement (“DPA”) forms part of the agreement between TOPDEVS SOLUTIONS LTD, company number 15016255, registered office at 20 Wenlock Road, London, England, N1 7GU (“Studioly”, “Processor”) and the studio, school, club, academy or other organisation using Studioly (“Customer”, “Controller”), where Studioly processes Personal Data on the Customer’s behalf.
Scope and precedence
This DPA applies to processing of Personal Data contained in Customer Data. If this DPA conflicts with the Terms of Service on a data-protection matter, this DPA prevails for that matter.
Roles
The Customer is Controller and Studioly is Processor for Customer Data processed on the Customer’s documented instructions. Each party remains independently responsible for personal data it processes as a Controller.
Processing instructions
Studioly will process Customer Personal Data only on documented instructions from the Customer, including as necessary to provide, secure, support and maintain the Services, unless UK law requires otherwise. If legally permitted, Studioly will inform the Customer before processing required by law.
Confidentiality
Studioly will ensure persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality.
Security
Studioly will implement appropriate technical and organisational measures taking account of the nature, scope, context and purposes of processing and the risks to individuals. Measures will include appropriate access control, authentication, encryption in transit, logging/monitoring, backup/recovery, vulnerability management, secure development and incident-response practices as applicable to the production architecture.
Sub-processors
The Customer gives general written authorisation for Studioly to engage sub-processors. Studioly will maintain a current Sub-processor List, impose data-protection obligations providing an equivalent level of protection, remain responsible for its sub-processors as required by law, and provide reasonable advance notice of material new sub-processors so the Customer can raise legitimate data-protection objections.
International transfers
Studioly will not make a restricted transfer of Customer Personal Data unless an applicable UK GDPR transfer mechanism is in place, such as UK adequacy regulations or an appropriate Article 46 safeguard, including the UK IDTA or UK Addendum where applicable, together with any required transfer risk assessment.
Data subject requests
Taking account of the nature of processing, Studioly will provide reasonable assistance to the Customer in responding to requests to exercise data-subject rights. If Studioly receives a request relating to Customer-controlled data, it will normally direct the requester to the Customer and will not respond substantively except on the Customer’s instructions or where required by law.
Personal data breaches
Studioly will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and will provide information reasonably available to support the Customer’s assessment, notification and remediation obligations.
DPIAs and regulatory consultation
Studioly will provide reasonable assistance, taking account of the nature of processing and information available to it, with data protection impact assessments and prior consultation obligations relating to the Services.
Return and deletion
On termination and at the Customer’s choice, Studioly will return or make available an export of Customer Personal Data and delete it in accordance with the agreed lifecycle, unless law requires retention. The launch standard is a 30-day recovery/export window after termination, followed by deletion from active systems; residual backup copies are removed through the normal backup cycle within up to 90 additional days, subject to legal holds and mandatory retention.
Audit information
Studioly will make available information reasonably necessary to demonstrate compliance with Article 28 UK GDPR. Audits must be reasonable, proportionate, protect other customers and Studioly security/confidentiality, and ordinarily use available certifications, reports, questionnaires or remote review before an on-site inspection.
Customer obligations
The Customer is responsible for lawful instructions, transparency, lawful bases, safeguarding obligations, role/access configuration, accuracy where required, and obtaining any permissions needed for Customer Data, including children’s data and media.
Governing law
This DPA is governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction subject to mandatory applicable rights.
Schedule 1: Details of Processing
- Subject matter
- Provision of the Studioly studio-management platform, Studio Portal and mobile applications.
- Duration
- For the Subscription/Customer relationship plus the agreed deletion/recovery period and backup lifecycle.
- Nature and purpose
- Hosting, organising, retrieving, displaying, transmitting, securing, supporting, backing up and otherwise processing Customer Data to provide the Services.
- Data subjects
- Students (including children), guardians/parents, teachers, instructors, coaches, tutors, studio team members, Customer administrators and other participants entered by the Customer.
- Personal data
- Identity/contact data; account/role data; guardian relationships; class/session/schedule data; attendance; progress/evaluations; events/showcases; photos/videos/media; notes and other Customer-entered information; technical/security records associated with service use.
- Special category data
- Not required as a standard Studioly data category. Customers must not enter special category data unless necessary, lawful and supported by appropriate safeguards. Product design and fields should minimise collection.
- Frequency
- Continuous/recurring while the Services are used.
Schedule 2: Contact
Processor: TOPDEVS SOLUTIONS LTD- Address
- 20 Wenlock Road, London, England, N1 7GU
- Privacy/contact email
- [email protected]