Data Processing Agreement

Scope

These terms form part of the School Terms of Service and are the agreement required by Article 28 of the UK and EU GDPR. The school is the controller of student information and DAIGON is its processor. A school that needs a standalone signed agreement can request one from legal@daigonesports.com.

What is processed

Purpose

Running the clubs, competitions and lessons the school has chosen.

Data subjects

Students taking part in DAIGON activities.

Personal data

First name and family-name initial (or a label such as “Student 1”), age group, school, and for competitions an in-game name and results. No special category data.

Duration

The length of the school’s subscription, plus the deletion period below.

What DAIGON commits to

• Process student information only on the school’s documented instructions.
• Never sell it, use it for advertising or profile students.
• Bind everyone with access to confidentiality, and limit access to what each role needs.
• Keep it encrypted in transit and at rest.
• Use only the sub-processors in the Sub-processor Register, each under a contract with equivalent obligations. We announce changes on that page; a school may object in writing within 30 days, and if we cannot resolve the objection it may end the affected service.
• Help the school answer requests from parents and students.
• Tell the school without undue delay, and within 48 hours, after becoming aware of a breach affecting its data.
• Delete or anonymise student information within 6 months of the subscription ending, or within 60 days of the school asking. Competition results are anonymised after 5 years.
• Give the school the information it needs to show compliance, and allow reasonable audits on notice.

What the school commits to

The school has a lawful basis for sharing student information with DAIGON, gives parents the information they are entitled to, and obtains parental consent where a student is under the age of digital consent in its country. The school shares only the data listed above.

International transfers

Student information is stored in the European Union. Transfers outside the UK and EU use Standard Contractual Clauses or the UK transfer addendum. Schools in Saudi Arabia sign the SDAIA Standard Contractual Clauses with us; schools in the UAE are covered by the safeguards of the UAE data protection law.

United States

COPPA. DAIGON does not collect personal information directly from children. The school provides student information and acts for parents in giving consent, as COPPA allows for school-authorised educational services. Parents can review or ask to delete their child’s information through the school.

FERPA. DAIGON acts as a school official with a legitimate educational interest, under the school’s direct control, uses education records only for the service, and does not re-disclose them.