INTRODUCTION
“Data Protection Requirements”: as applicable: (i) the Data Protection Act 2018, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) or equivalent legislation, the Privacy and Electronic Communications (EC Directive) Regulations 2003, Directive 2002/58/EC of the European Parliament (the ePrivacy Directive) and all other applicable laws (including judgments of any relevant court of law) and regulations relating to the processing of personal data, data privacy, electronic communications, marketing and data security, in each case as amended, extended or re-enacted from time to time and all orders, regulations, statutes, instruments or other subordinate legislation made thereunder in any jurisdiction from time to time; and (ii) the guidelines, recommendations, best practice, opinions, directions, decisions, codes of practice and codes of conduct issued, adopted or approved by the European Commission, the European Data Protection Board, the UK’s Information Commissioner’s Office and/or any other supervisory authority or data protection authority from time to time in relation to the processing of personal data, data privacy, electronic communications, marketing and data security.
“Cross-Border Processing” or “School Personal Data Transfers” means any communication, copying or transmission of School Personal Data to a Third Country.
“School Personal Data” means any personal data processed or transferred by the School to Onboard360 in relation to the Services Agreement and in connection with the Services.
“Third Country” means any country that is not in the European Union or which has not been recognised by the European Commission as providing an adequate level of protection for personal data under the Data Protection Requirements.
1.1. For the purpose of this Services Agreement, including this Privacy and Data Protection Annex, personal data and the terms process, data subject, data controller, controller, data processor, processor, subprocessor, personal data breach and supervisory authority shall have the meanings given to them in the applicable Data Protection Requirements.
1.2. The Parties acknowledge that the School is the data controller and Onboard360 is the data processor of School Personal Data.
1.3. The School remains solely liable for upholding data subject’s rights in relation to the processing of such School Personal Data under the Services Agreement, specifically their rights of access, right to request rectification and/or erasure and if necessary the right to object to processing, and the School shall promptly notify Onboard360 of any request relating to the same received from a data subject.
1.4. Each Party warrants that it shall comply with all of its obligations under the Data Protection Requirements which arise in connection with the Services, or either party’s performance of its obligations, and that it shall not, in respect of any School Personal Data processed, do any act or make any omission which puts the other party in breach of its obligations under the Data Processing Requirements.
1.5. The School shall ensure that it has all necessary consents from data subjects or that another legal basis is satisfied under the Data Protection Requirements in order for Onboard360’s processing of School Personal Data to comply with the Data Protection Requirements, including without limitation, processing for the purposes of providing international education systems for curriculum planning, assessment, reporting & admissions and related services for new staff, students, parents, schools and exam boards.
1.6. The School’s instructions relating to the processing of School Personal Data shall comply with the Data Protection Requirements and the Customer shall have the sole responsibility for the accuracy, quality, integrity, reliability and lawfulness of the School Personal Data;
1.7. The School shall promptly notify Onboard360 if it becomes aware of any breaches of or other irregularities with the Data Protection Requirements.
2. Onboard360’S OBLIGATIONS
2.1. General Obligations
2.1.1. Onboard360 shall process School Personal Data for the sole purpose of the provision of the Services to the School and any Members and shall act only in accordance with the commercially reasonable documented instructions of the School in respect of the processing of School Personal Data during the term of the Services Agreement.
2.1.2. Onboard360 shall promptly notify the School if, in Onboard360’s opinion, the School’s documented data processing instructions breach the Data Protection Requirements, and Onboard360 shall be entitled without penalty to suspend execution of the instructions concerned, until the School confirms such instructions in writing. Any notification by Onboard360 under this clause should not be regarded as legal advice and Onboard360 shall not be required to perform a legal assessment of the School’s instructions. The School shall seek its own legal advice on applicable Data Protection Requirements. If and to the extent Onboard360 is unable to comply with any instruction received from the School, it shall promptly notify the School accordingly.
2.1.3. The purpose of Onboard360’s processing School Personal Data is the performance of the Services pursuant to this Privacy and Data Protection Addendum. The categories of data subjects and the types of School Personal Data processed under this Addendum are set out in Appendix 1 (School Personal Data).
2.1.4. Onboard360 shall provide reasonable assistance to the School in order to ensure the School’s compliance with the Data Protection Requirements and/or in case of inspection by a supervisory authority taking into account the nature of the processing and the information available to Onboard360.
2.1.5. Onboard360 shall promptly respond to any request of the School concerning the processing of School Personal Data carried out by Onboard360, and provide the School with all reasonable information, so that the School is able to: (i) inform the data subjects and respond to their requests for access, objection, rectification, restriction or deletion of School Personal Data; and/or (ii) respond to any administrative formalities concerning the processing of such personal data to the supervisory authority; and/or (iii) comply with all requests of any administrative or judicial authority regarding the processing carried out under the Services Agreement.
2.1.6. Onboard360 shall promptly correct any errors or inaccuracies in the School Personal Data which are notified to it either by the School or a data subject, or shall provide a means for the data subject to self-correct any errors or inaccuracies within such personal data, to ensure that such School Personal Data is kept accurate and up to date.
2.1.7. Onboard360 shall provide reasonable assistance to the School in order to ensure its compliance with its obligations to maintain a record of all categories of School Personal Data processing activities. In particular, Onboard360 shall record and make available such School Personal Data for a period of eighteen (18) months from the Services Agreement expiration or termination date, and shall ensure that the School Personal Data records are backed-up regularly throughout this period. Thereafter, Onboard360 shall destroy all files containing School Personal Data, or return all such School Personal Data to the School, unless required to retain any or part of the School Personal Data by applicable law.
2.2. Security
2.2.1. Onboard360 shall implement appropriate technical and organisational security measures necessary for the processing of School Personal Data and Services to be performed under this Services Agreement to ensure the confidentiality and security of School Personal Data and, in particular, to prevent such School Personal Data from being distorted, damaged or communicated to unauthorized third-parties, and to protect the School Personal Data against any accidental or unlawful destruction, accidental loss, alteration, dissemination and/or unauthorized access, as well as against all unlawful forms of processing provided that, such measures shall ensure a level of security appropriate to the risks inherent in the processing and the nature of the School Personal Data to be protected.
2.2.2. In case of a personal data breach involving School Personal Data, Onboard360 shall:
(i) notify the School without delay after becoming aware of an actual personal data breach involving School Personal Data, and;
(ii) take steps to remedy such personal data breach involving School Personal Data as soon as possible so as to minimize the impact of any personal data breach to all relevant data subjects.
2.2.3. Such notification must contain:
a) A description of the nature of the personal data breach including:
- Categories of School Personal Data concerned;
- Approximate number of data subjects concerned;
- Categories of School Personal Data records concerned;
- Approximate number of School Personal Data records concerned, and;
b) A description of the likely consequences of the personal data breach involving School Personal Data and;
c) A description of the measures taken or proposed to be taken by Onboard360 to address such personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
2.2.4. Onboard360 shall document any personal data breach involving School Personal Data, comprising the facts relating to it, its effects and the remedial action taken.
2.3. Access to Personal Data
2.3.1. In accordance with confidentiality obligations as defined in the Services Agreement, Onboard360 shall not transfer, communicate or disclose in any manner any personal data to any third parties, except to those subcontractors and personnel required to provide the Services to the School (hereinafter the “Authorised Recipients”) for the sole purpose of such Authorised Recipients of performing the Services under the Services Agreement. Where a subcontactor is engaged by Onboard360 shall ensure that they are appointed in accordance with clause 2.4 below.
2.3.2. Onboard360 shall ensure that the Authorised Recipients in charge of the performance Services process the School Personal Data only on a need-to-know basis and are subject to appropriate obligations of confidentiality and security, and bound by a non-disclosure agreement that is least as stringent as the one in force between the parties.
2.3.3. In case of any investigation or seizure of School Personal Data by government officials, a supervisory authority or any law enforcement authority, Onboard360 shall take reasonable steps at its disposal to protect the confidentiality of School Personal Data.
2.3.4. If a Party is compelled to disclose School Personal Data by law, such Party shall promptly notify the other Party of the disclosure order (if and to the extent permitted by laws and/or regulations).
2.4. Personal Data Transfers
2.4.1. As part of the Services, the School acknowledges that Onboard360 transfers School Personal Data all over the world as part of its business operations to facilitate the provision of the Services to the School. Where Onboard360 transfers personal data to a Third Country, it shall take steps to ensure that it has appropriate safeguards in place to protect the School Personal Data in accordance with Data Protection Requirements. Further information about the transfers and the basis on which those transfers are made is set out in this paragraph 2.4.
2.4.2. The School provides its prior consent to Onboard360 transferring School Personal Data between its group companies in UK, USA, Taiwan and Hong Kong, and data centres in Canada, USA Hong Kong, Singapore, Ireland and UK. Where required by Data Protection Requirements, appropriate safeguards shall be in place to cover such transfers, where personal data is transferred outside of the European Union, Onboard360 has entered into standard contractual clauses issued by the European Commission as required under the Data Protection Requirements.
2.4.3. The School provides its general authorisation to Onboard360’s use third party suppliers, as listed and updated on Onboard360’s which may process School Personal Data on behalf of Onboard360 (“Subprocessors”) in order for Onboard360 to provide the Services to the School.
2.4.4. Onboard360 shall provide updates to the list of Subprocessors and proposed Subprocessers via https://onboard360.io/legal/privacy-policy/subprocessors Schools may object in writing to the processing of its Personal Data by a new sub-processor within thirty (30) days following the update of the list of Subprocessors and such objection shall describe School’s legitimate reason(s) for objection. If a School does not object during such time period the new Subprocessor(s) shall be deemed accepted.
2.4.5. Onboard360 shall include in any contract with its Subprocessors which will process School Personal Data obligations on such Subprocessors which are equivalent to those obligations imposed upon Onboard360 in this Privacy and Data Protection Addendum. Onboard360 shall be liable for the acts and omissions of its Subprocessors to the same extent Onboard360 would be liable if performing the services of each Subprocessor directly under the terms of this Privacy and Data Protection Addendum.
2.4.6. Where Subprocessors are located in a Third Country, Onboard360 shall put in place appropriate safeguards to protect the School Personal Data and ensure that such transfers of School Personal Data are at all times in accordance with the Data Protection Requirements. This shall include, entering into and maintaining accurate standard contractual clauses adopted by the European Commission, or, where a Subprocessor is located in the USA, Onboard360 may rely upon a Subprocessor’s Privacy Shield certification, to the extent that these data transfer mechanisms are considered to be lawful under the Data Protection Requirements (where applicable).
2.5. Information Requests & Review
2.5.1. The School shall be entitled to request information and review Onboard360 LLC and related documents, processes and workflows relating to its internal Data Protection and Compliance standards and its obligations set out in this Privacy and Data Protection Addendum. The School shall also be entitled to request Onboard360 to contribute to and allow for audits and inspections by the School. The School may not exercise its audit right more than once in any twelve month period. The School shall use all reasonable endeavours to ensure that the conduct of any audit by the School or its authorised agents does not unreasonably disrupt Onboard360 or its business. Any audit by the School or its authorised agents will be limited to an audit of the School Personal Data and the processes relating to the School Personal Data and will not include any information relating to any other customer of Onboard360 or any other third party. The School will be responsible for any fees or costs incurred from carrying out such an audit.
Any information and review requests can be directed to Onboard360’s Information Security Officer at security@onboard360.io.
3. PERSONAL DATA PROCESSING CONDITIONS
3.1. Onboard360’s Server locations
3.1.1. Onboard360 informs the School that the Personal Data will be hosted in servers located in the following countries:, USA and UK.
3.1.2. Any change of the server(s) location by Onboard360 shall be promptly notified to the School and shall be included in the form of a written amendment pursuant to the conditions of this Services Agreement.
Appendix 1
School Personal Data
Categories of Data Subjects
Data subjects include:
Students, Parents/Guardians of students, Teachers, School Administrators (“Admin”) and External Advisors.
Types of School Personal Data
The School Personal Data may include the following types of data:
Student First and Last Name
Student Year Level
Student Email Address
Student Password
Student ID Number
Student Gender
Student DOB
Student Languages
Student Nationality
Student IBIS Personal Code
Student FSM/Free or Reduced Lunch Status
Student Pupil Premium / SEN Status
Student SSN Last 4 Digits
Student Activities
Student Grades
Student University List
Student Address and Telephone
Parent(s) First and Last Name
Parent(s) Email Address
Parent(s) Password
Parent(s) Phone Number
Teacher First and Last Name
Teacher Email Address
Teacher Password
Teacher Phone Number
Teacher Document Copies (if requested by the school)
Teacher photos
Admin First and Last Name
Admin Role
Admin Email Address
Admin Password
Admin Phone Number
School Name
School Address
Geolocation: coarse (city-level) location data
Browser Type
Machine Model
Access Time
Referring URLs
Page Views
IP Address
Device ID
Device Type and OS
Purposes
School Personal Data is processed by Onboard360 for the following purposes:
Providing international education systems for onboarding staff, teachers, administrators, substitutes, parent volunteers to a school environment. All materials collected are at the request of the participating schools.