Legal
Data Processing Agreement
Signed with every school client as part of onboarding — student work is personal data, and processing it without a DPA would put the school in breach, not just us. Countersigned copies are exchanged with the first quote.
1. Subject matter and roles
This agreement, under Art. 28 GDPR, governs our processing of personal data contained in material the client submits — typically student scripts, recordings, and names within test documents. The client is controller; EnglishCorrection is processor and processes only on the client's documented instructions.
2. Scope of processing
| Data subjects | Students whose work is submitted; client staff named in materials |
| Data categories | Names, written work, voice recordings, assessment results |
| Purpose | Marking and quality review as ordered |
| Duration | Deleted 60 days after delivery unless instructed otherwise |
3. Our obligations
- Confidentiality undertakings from every reviewer.
- Encryption in transit and at rest; EU-hosted storage.
- Pseudonymisation of student work where the client has not already done so.
- Assistance with data-subject requests and breach notification without undue delay.
- Deletion or return of all personal data at the end of the engagement, at the client's choice.
4. Subprocessors and audits
Subprocessors (hosting, email) are listed in the annex to the signed DPA; we give 30 days' notice before changes, and the client may object. The client may audit our compliance once per year on reasonable notice, or rely on our written responses to audit questionnaires.
5. Getting the signed copy
The countersignable DPA is sent with every school quote. Existing clients can request a copy at any time: office@englishcorrection.site, subject “DPA”.