Data Processing Agreement

Last updated: October 2026

Summary: This agreement sets out how Sear Education handles personal data on your organisation's behalf when you use Mr Sear's MTC. Your organisation remains in control of the data at all times. By using the Service, your organisation agrees to the terms of this Data Processing Agreement.

1. Parties

Data Controller ("the Organisation"): The school, tutoring practice, home educator, or other educational organisation or individual using the Service.

Data Processor ("we", "us", "Sear Education"): Daniel Sear trading as Sear Education, the operator of Mr Sear's MTC.

2. Scope and Purpose

This Data Processing Agreement ("DPA") applies to personal data processed by Sear Education on behalf of the Organisation through the Mr Sear's MTC service ("the Service"). It supplements our Terms of Service and Privacy Policy.

The purpose of processing is to provide an online multiplication tables practice tool for educational use.

3. Data Processed

Pupil data:

Data type	Purpose
First names only (no surnames)	Identifying pupils within their class
Individual PIN codes	Secure login to the pupil's account
Display alias (e.g., "Star", "Moon")	Protecting pupil identity from other pupils
Test level and progress	Tracking which multiplication tables to practise
Test results and response times	Measuring progress and identifying areas for practice
Practice scores	Classroom leaderboard and motivation
Achievement data (crowns, earned badges, streaks and progress totals)	Gamification, motivation, and tracking improvement
In-app rewards (token balance, total earned, session counts and daily limit) and unlocked decorations	Gamification and motivation; spent on seat decorations, also awarded as teacher-set game prizes
Seat designs (a background colour and up to five stickers from a fixed set)	Personalisation. No uploads or free text; seen only within the child's own class
Game-mode activity (e.g. best answering streak, team contribution)	Running the class game modes (Chaos, Red vs Blue, Raid boss)
Display preferences (dyslexia-friendly font, larger text, higher contrast)	Accessibility. Saved so the child's chosen settings stay on for them
Session status	Classroom management (who is logged in)
Pupil group flags (optional): pupil premium, SEND, EAL	The school's own progress reporting to its leaders and governors. Set by teachers, never shown to pupils. Only group membership is held, no further detail.

Special category data: A SEND flag may reveal information about a child's health or disability. Where it is special category data, the Organisation must identify both a lawful basis under UK GDPR Article 6 and a separate condition under Article 9 before recording it. Public task is an Article 6 basis, not an Article 9 condition. The Organisation must also meet any relevant Data Protection Act 2018 Schedule 1 requirements, including an appropriate policy document where required. Sear Education processes group flags only on the Organisation's instructions, holds no diagnoses or supporting notes, and never shows the flags to pupils.

Teacher/staff data:

Data type	Purpose
Email address	Account login and invitations
Display name	Identification within the Service
Reading preferences	Saving the staff member's chosen font, text size and contrast settings
IP address (teachers only)	Security auditing (retained 90 days)
Action logs (teachers only)	Security auditing (retained 90 days)

Technical information: To investigate connection problems, the Service keeps a short connection diary with a random browser label, class identifier, device/browser details, connection timings and errors. It contains no pupil names, pupil numbers or answers. The latest 20 visits for a browser are kept locally and copied to the Service, with newer visits replacing older ones. Unsaved results can also be kept locally until they are successfully sent. See the Privacy Policy for details.

Categories of data subjects: Pupils (typically aged 5-11) and their teachers/staff.

4. Our Obligations as Data Processor

Sear Education shall:

Process data only on the Organisation's instructions - We will process personal data only on the Organisation's documented instructions, including instructions about international transfers, for the purposes described in this agreement. If UK law requires other processing, we will tell the Organisation before doing so unless the law prevents us. We will tell the Organisation immediately if we believe an instruction infringes data protection law.
Ensure confidentiality - Only authorised Sear Education personnel have access to personal data. This includes the developer, who may access data where necessary for service operation, maintenance, technical support, or legal compliance. We do not routinely access individual pupil data. Access is limited to what is necessary for operating and maintaining the Service.
Implement appropriate security measures - We use industry-standard security measures including:
- Encrypted data transmission (HTTPS/TLS)
- Secure cloud infrastructure (Google Firebase)
- Hashed passwords (bcrypt)
- Individual pupil PIN codes for access control
- Privacy-protected display names to hide pupil identities
- Role-based access controls (teachers see only their class)
- Audit logging of teacher/admin actions
Not engage sub-processors without authorisation - The Organisation gives general written authorisation for the services listed in Section 6. We will give advance written notice of proposed additions or replacements, with reasonable time for the Organisation to object before they take effect. We will put equivalent data protection obligations in place with each sub-processor and remain responsible to the Organisation for their compliance.
Assist the Organisation with data subject requests - We will help the Organisation respond to requests from individuals exercising their rights under UK GDPR (access, rectification, erasure, etc.).
Assist with data protection duties - Taking account of the processing and information available to us, we will help the Organisation with security, breach notifications, Data Protection Impact Assessments (DPIAs), and any required prior consultation with the ICO.
Notify the Organisation of data breaches - We will alert the Organisation without undue delay as soon as we become aware of a personal data breach, and in any event within 72 hours. We will not wait for a full investigation before sending an initial notification.
Delete or return data on termination - At the Organisation's choice, we will return its personal data or delete it when the Service ends, and delete remaining copies unless UK law requires us to keep them. Section 8 explains the normal recovery window and how to request earlier permanent deletion.

5. The Organisation's Obligations as Data Controller

The Organisation shall:

Ensure there is a lawful basis for processing pupil data through the Service (typically "public task" under UK GDPR Article 6(1)(e) for schools, or "legitimate interests" under Article 6(1)(f) for tutors and other educational settings)
Where applicable, inform parents/carers about the use of the Service (e.g., through the school's privacy notice or by other appropriate means)
Enter only the information needed for the Service: first names rather than surnames, and no diagnoses, medical notes or free-text details of support needs. Optional pupil premium, SEND and EAL flags may be used only where the Organisation has established the necessary lawful basis and, where needed, special category condition described in Section 3
Keep class passwords and pupil PINs confidential and only share them with authorised users
Notify Sear Education promptly if a teacher leaves or should have their access revoked

6. Sub-processors

We use the following sub-processors to provide the Service:

Sub-processor	Purpose	Location
Google Firebase Firestore	Main database (pupil names, scores, results)	London, UK (europe-west2)
Google Firebase Realtime Database	Live session data (who is logged in)	Belgium, EU (europe-west1)
Google Firebase Authentication	Teacher login accounts	May involve processing outside UK/EU with appropriate safeguards (SCCs + UK Addendum)
Google Cloud Functions	Server-side processing	US (us-central1)
Zoho Mail (via SMTP)	Sending invitation emails to teachers	EU (Zoho EU data centres)
jsDelivr CDN	Hosting open-source libraries (charts, PDF export, browser compatibility)	Global CDN (no pupil data sent)

Google LLC is certified under the EU-US Data Privacy Framework and processing is subject to Standard Contractual Clauses with the UK Addendum where data may leave the UK.

7. International Transfers

The primary storage of pupil data is in the UK and EU (London and Belgium). Some processing may occur outside the UK/EU through Google's infrastructure. Where this happens, appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) with UK International Data Transfer Addendum
EU-US Data Privacy Framework certification

8. Data Retention and Deletion

Automatic retention periods:

Data type	Retention period
Detailed test/practice results (question-by-question)	20 days, then automatically removed from the record
Summary statistics (scores, dates, levels)	While the school uses the Service, unless deleted earlier
Pupil names, levels, group flags, rewards, seat designs and preferences	While the school uses the Service, unless deleted earlier
Teacher audit logs and IP addresses	90 days, then automatically deleted
Teacher accounts	Until deleted by organisation lead or account holder

Soft deletion (30-day recovery period):

When an organisation lead deletes a class through the Service:

The class is immediately hidden from view
All associated data (pupil names, scores, results) is retained securely for 30 days to allow recovery in case of accidental deletion
After 30 days, all data is permanently and irreversibly deleted by an automated process
Organisations may request early permanent deletion by contacting info@mrsearmtc.uk

Teacher account deletion:

When an organisation lead removes a teacher, the teacher's account and access are deleted immediately and permanently.

On termination:

The Organisation can choose to have its data returned before deletion, using the available exports or by contacting info@mrsearmtc.uk. It can also request immediate permanent deletion rather than the normal 30-day recovery window.

When the Organisation ends its use of the Service, it should contact us to arrange deletion of the school account by the service administrator. The school and all its classes are immediately hidden from view. Teachers are unassigned from the school but their accounts are retained. All associated data (classes, pupils, results) is retained securely for 30 days to allow recovery in case of error, after which it is permanently and irreversibly deleted by an automated process.

9. Data Breach Notification

In the event of a personal data breach affecting the Organisation's data:

We will notify the Organisation's designated contact without undue delay as soon as we become aware of the breach, and in any event within 72 hours. We will send further information as it becomes available; the initial alert will not wait for a full investigation
We will provide details of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken to address it
We will cooperate with the Organisation and the ICO (Information Commissioner's Office) as needed. The Organisation remains responsible for deciding whether to notify the ICO or affected individuals, including meeting the ICO's 72-hour deadline where a report is required.

10. Audit and Compliance

We will:

Make available to the Organisation all information necessary to demonstrate compliance with this DPA
Allow for and contribute to audits or inspections conducted by the Organisation or an auditor mandated by the Organisation (with reasonable notice)
Maintain records of processing activities as required by UK GDPR Article 30

11. Duration and Termination

This DPA applies for as long as the Organisation uses the Service. It will automatically terminate when:

The Organisation stops using the Service and all data has been deleted
The Service is discontinued (with at least 30 days' notice)

Sections relating to data deletion, confidentiality, and breach notification survive termination.

12. Governing Law

This DPA is governed by the laws of England and Wales and is subject to the jurisdiction of the courts of England and Wales.

13. Contact

For any questions about this Data Processing Agreement or to report a data concern:

Sear Education
Email: info@mrsearmtc.uk

Back to Classroom