Terms, Policies & Agreements
These terms & policies explain our legal relationship with you.
GDPR Privacy & Data Protection Addendum
“Data Protection Requirements” as applicable: (i) the Data Protection Act 2018, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) or equivalent legislation, the Privacy and Electronic Communications (EC Directive) Regulations 2003, Directive 2002/58/EC of the European Parliament (the ePrivacy Directive) and all other applicable laws (including judgments of any relevant court of law) and regulations relating to the processing of personal data, data privacy, electronic communications, marketing and data security, in each case as amended, extended or re-enacted from time to time and all orders, regulations, statutes, instruments or other subordinate legislation made thereunder in any jurisdiction from time to time; and (ii) the guidelines, recommendations, best practice, opinions, directions, decisions, codes of practice and codes of conduct issued, adopted or approved by the European Commission, the European Data Protection Board, the UK’s Information Commissioner’s Office and/or any other supervisory authority or data protection authority from time to time in relation to the processing of personal data, data privacy, electronic communications, marketing and data security.
“Cross-Border Processing” or “School Personal Data Transfers” means any communication, copying or transmission of School Personal Data to a Third Country.
“School Personal Data” means any personal data processed or transferred by the School to Daigon in relation to the Services Agreement and in connection with the Services.
“Third Country” means any country that is not in the European Union or which has not been recognised by the European Commission as providing an adequate level of protection for personal data under the Data Protection Requirements.
1.1. For the purpose of this Services Agreement, including this Privacy and Data Protection Annex, personal data and the terms process, data subject, data controller, controller, data processor, processor, subprocessor, personal data breach and supervisory authority shall have the meanings given to them in the applicable Data Protection Requirements.
1.2. The Parties acknowledge that the School is the data controller and Daigon is the data processor of School Personal Data.
1.3. The School remains solely liable for upholding data subject’s rights in relation to the processing of such School Personal Data under the Services Agreement, specifically their rights of access, right to request rectification and/or erasure and if necessary the right to object to processing, and the School shall promptly notify Daigon of any request relating to the same received from a data subject.
1.4. Each Party warrants that it shall comply with all of its obligations under the Data Protection Requirements which arise in connection with the Services, or either party’s performance of its obligations, and that it shall not, in respect of any School Personal Data processed, do any act or make any omission which puts the other party in breach of its obligations under the Data Processing Requirements.
1.5. The School shall ensure that it has all necessary consents from data subjects or that another legal basis is satisfied under the Data Protection Requirements in order for Daigon’s processing of School Personal Data to comply with the Data Protection Requirements, including without limitation, processing for the purposes of providing international education systems for curriculum planning, assessment, reporting & admissions and related services for students, parents, schools and exam boards.
1.6. The School’s instructions relating to the processing of School Personal Data shall comply with the Data Protection Requirements and the Customer shall have the sole responsibility for the accuracy, quality, integrity, reliability and lawfulness of the School Personal Data;
1.7. The School shall promptly notify Daigon if it becomes aware of any breach of or other irregularity with the Data Protection Requirements.
2. Daigon's Obligations
2.1. General Obligations
2.1.1. Daigon shall process School Personal Data for the sole purpose of the provision of the Services to the School and any Members and shall act only in accordance with the commercially reasonable documented instructions of the School in respect of the processing of School Personal Data during the term of the Services Agreement.
2.1.2. Daigon shall promptly notify the School if, in Daigon's opinion, the School’s documented data processing instructions breach the Data Protection Requirements, and Daigon shall be entitled without penalty to suspend execution of the instructions concerned, until the School confirms such instructions in writing. Any notification by Daigon under this clause should not be regarded as legal advice and Daigon shall not be required to perform a legal assessment of the School’s instructions. The School shall seek its own legal advice on applicable Data Protection Requirements. If and to the extent Daigon is unable to comply with any instruction received from the School, it shall promptly notify the School accordingly.
2.1.3. The purpose of Daigon’s processing School Personal Data is the performance of the Services pursuant to this Privacy and Data Protection Addendum. The categories of data subjects and the types of School Personal Data processed under this Addendum are set out in Appendix 1 (School Personal Data).
2.1.4. Daigon shall provide reasonable assistance to the School in order to ensure the School’s compliance
with the Data Protection Requirements and/or in case of inspection by a supervisory authority taking into account the nature of the processing and the information available to Daigon.
2.1.5. Daigon shall promptly respond to any request of the School concerning the processing of School Personal Data carried out by Daigon, and provide the School with all reasonable information, so that the School is able to:
(i) inform the data subjects and respond to their requests for access, objection, rectification, restriction or deletion of School Personal Data; and/or
(ii) respond to any administrative formalities concerning the processing of such personal data to the supervisory authority; and/or
(iii) comply with all requests of any administrative or judicial authority regarding the processing carried out under the Services Agreement.
2.1.6. Daigon shall promptly correct any errors or inaccuracies in the School Personal Data which are notified to it either by the School or a data subject, or shall provide a means for the data subject to self-correct any errors or inaccuracies within such personal data, to ensure that such School Personal Data is kept accurate and up to date.
2.1.7. Daigon shall provide reasonable assistance to the School in order to ensure its compliance with its obligations to maintain a record of all categories of School Personal Data processing activities. In particular, Daigon shall record and make available such School Personal Data for a period of eighteen (18) months from the Services Agreement expiration or termination date, and shall ensure that the School Personal Data records are backed-up regularly throughout this period. Thereafter, Daigon shall destroy all files containing School Personal Data, or return all such School Personal Data to the School, unless required to retain any or part of the School Personal Data by applicable law.
2.2.1. Daigon shall implement appropriate technical and organisational security measures necessary for the processing of School Personal Data and Services to be performed under this Services Agreement to ensure the confidentiality and security of School Personal Data and, in particular, to prevent such School Personal Data from being distorted, damaged or communicated to unauthorized third-parties, and to protect the School Personal Data against any accidental or unlawful destruction, accidental loss, alteration, dissemination and/or unauthorized access, as well as against all unlawful forms of processing provided that, such measures shall ensure a level of security appropriate to the risks inherent in the processing and the nature of the School Personal Data to be protected.
2.2.2. In case of a personal data breach involving School Personal Data, Daigon shall:
(i) notify the School without undue delay after becoming aware of an actual personal data breach involving School Personal Data, and;
(ii) take steps to remedy such personal data breach involving School Personal Data as soon as possible so as to minimize the impact of any personal data breach to all relevant data subjects.
2.2.3. Such notification must contain:
a) A description of the nature of the personal data breach including:
Categories of School Personal Data concerned;
Approximate number of data subjects concerned;
Categories of School Personal Data records concerned;
Approximate number of School Personal Data records concerned, and;
b) A description of the likely consequences of the personal data breach involving School Personal Data and;
c) A description of the measures taken or proposed to be taken by Daigon to address such personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
2.2.4. Daigon shall document any personal data breach involving School Personal Data, comprising the facts relating to it, its effects and the remedial action taken.
2.3. Access to Personal Data
2.3.1. In accordance with confidentiality obligations as defined in the Services Agreement, Daigon shall not transfer, communicate or disclose in any manner any personal data to any third parties, except to those subcontractors and personnel required to provide the Services to the School (hereinafter the “Authorised Recipients”) for the sole purpose of such Authorised Recipients of performing the Services under the Services Agreement. Where a subcontactor is engaged by Daigon shall ensure that they are appointed in accordance with clause 2.4 below.
2.3.2. Daigon shall ensure that the Authorised Recipients in charge of the performance Services process the School Personal Data only on a need-to-know basis and are subject to appropriate obligations of confidentiality and security, and bound by a non-disclosure agreement that is as least as stringent as the one in force between the parties.
2.3.3. In case of any investigation or seizure of School Personal Data by government officials, a supervisory authority or any law enforcement authority, Daigon shall take reasonable steps at its disposal to protect the confidentiality of School Personal Data.
2.3.4. If a Party is compelled to disclose School Personal Data by law, such Party shall promptly notify the other Party of the disclosure order (if and to the extent permitted by laws and/or regulations).
2.4. Personal Data Transfers
2.4.1. As part of the Services, the School acknowledges that Daigon transfers School Personal Data all over the world as part of its business operations to facilitate the provision of the Services to the School. Where Daigon transfers personal data to a Third Country, it shall take steps to ensure that it has appropriate safeguards in place to protect the School Personal Data in accordance with Data Protection Requirements. Further information about the transfers and the basis on which those transfers are made is set out in this paragraph 2.4.
2.4.2. The School provides its prior consent to Daigon transferring School Personal Data between its company in the UK and data centres in the USA, the EU, and UK. Where required by Data Protection Requirements, appropriate safeguards shall be in place to cover such transfers.
2.4.3. The School provides its general authorisation to Daigon’s use third party suppliers, as listed and updated on Daigon's website via https://www.daigonesports.com/terms/privacy-policy/subprocessors which may process School Personal Data on behalf of Daigon(“Subprocessors”) in order for Daigon to provide the Services to the School.
2.4.4. Daigon shall provide updates to the list of Subprocessors and proposed Subprocessers via https://www.daigonesports.com/terms/privacy-policy/subprocessors Schools may object in writing to the processing of its Personal Data by a new sub-processor within thirty (30) days following the update of the list of Subprocessors and such objection shall describe School’s legitimate reason(s) for objection. If a School does not object during such time period the new Subprocessor(s) shall be deemed accepted.
2.5. Information Requests & Review
2.5.1. The School shall be entitled to request information and review documents, processes and workflows relating to its internal Data Protection and Compliance standards and its obligations set out in this Privacy and Data Protection Addendum. The School shall also be entitled to request Daigon to contribute to and allow for audits and inspections by the School. The School may not exercise its audit right more than once in any twelve month period. The School shall use all reasonable endeavours to ensure that the conduct of any audit by the School or its authorised agents does not unreasonably disrupt Daigon or its business. Any audit by the School or its authorised agents will be limited to an audit of the School Personal Data and the processes relating to the School Personal Data and will not include any information relating to any other customer of Daigon or any other third party. The School will be responsible for any fees or costs incurred from carrying out such an audit.
Any information and review requests can be directed to Daigon’s Information Security Officer at firstname.lastname@example.org.
3. Personal Data Processing Conditions
3.1. Daigon’s Server locations
3.1.1. Daigon informs the School that the Personal Data will be hosted in servers located in the following countries: US and European Union.
3.1.2. Any change of the server(s) location by Daigon shall be promptly notified to the School and shall be included in the form of a written amendment pursuant to the conditions of this Services Agreement.
School Personal Data
Categories of Data Subjects
Data subjects include:
Students, Parents/Guardians of students, Teachers and School Administrators (“Admin”)
Types of School Personal Data
The School Personal Data may include the following types of data:
Student First Name
Student Year Level
Student Email Address
Student ID Number
Parent(s) First and Last Name
Parent(s) Email Address
Teacher First and Last Name
Teacher Email Address
Admin First and Last Name
Admin Email Address
Geolocation: coarse (city-level) location data
Device Type and OS
School Personal Data is processed by Daigon for the following purposes:
Providing international school with managed Esports and Gaming After School Clubs using Daigon's platform and curriculum.