This Data Processing Agreement ("Agreement") is between Knowness Ltd, a company registered in England and Wales under company number 13204257, with its registered office at Studio 9, 50–54 St Paul's Square, Birmingham, England, B3 1QS ("Data Processor" or "Knowness"), and the school, academy trust or educational organisation using Knowness ("Data Controller" or "School").
Together referred to as the "Parties".
1. Purpose
This Agreement governs the processing of personal data by Knowness on behalf of the School in accordance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
The School acts as the Data Controller, while Knowness acts as the Data Processor for school-managed student and teacher accounts.
2. Nature, Purpose and Duration of Processing
Knowness processes personal data to provide its educational platform, including account management, educational content, learning activities, progress tracking, teacher administration, technical support and platform security.
Personal data may be received through Wonde, which facilitates secure, school-authorised transfers from the School's Management Information System (MIS).
Processing continues for the duration of the School's use of Knowness and until the relevant personal data has been deleted in accordance with this Agreement.
3. Personal Data Processed
Knowness may process the following information:
Students:
- Name and school email address.
- School, year group, classes and subjects.
- Account and authentication information.
- Platform usage, learning activity and academic performance information.
Teachers:
- Name, title and school email address.
- School, department, classes and subjects.
- Account and authentication information.
- Platform usage and teaching activity.
Knowness processes only information necessary to provide its educational services.
Independently registered accounts, including parent accounts, are not covered by this Agreement.
4. Obligations of Knowness
Knowness shall:
- Process personal data only on the School's documented instructions, including instructions concerning international transfers, unless otherwise required by applicable law. Where legally required to process data without such instructions, Knowness shall inform the School beforehand unless prohibited by law.
- Ensure authorised personnel are subject to confidentiality obligations.
- Implement appropriate technical and organisational security measures in accordance with Article 32 of the UK GDPR.
- Assist the School in responding to data subject rights requests.
- Notify the School without undue delay upon becoming aware of a personal data breach affecting its information.
- Assist the School with data security, breach notifications, Data Protection Impact Assessments (DPIAs) and consultations with the ICO, where required.
- Make available information necessary to demonstrate compliance and allow for audits and inspections by the School or its appointed auditor.
- Inform the School immediately if, in Knowness's opinion, an instruction infringes applicable data protection law.
- Delete or return personal data in accordance with Section 8.
Knowness shall not sell school-provided personal information or use it for third-party advertising or marketing.
5. Obligations of the School
The School shall:
- Establish an appropriate lawful basis for processing personal data.
- Provide relevant privacy information to students, teachers and, where appropriate, parents or guardians.
- Authorise the information shared with Knowness through Wonde or other approved methods.
- Ensure information provided is accurate, relevant and necessary.
- Manage authorised staff access and relevant data subject requests.
- Provide Knowness with lawful processing instructions.
The School is responsible for determining whether parental consent is required for any particular processing activity. Such consent is not automatically required for school-directed educational processing.
6. Subprocessors and Third-Party Services
The School grants Knowness general written authorisation to engage subprocessors necessary to operate and maintain its educational platform.
These may include providers of hosting, data storage, authentication, communications, technical monitoring and educational functionality.
Knowness shall:
- Maintain an up-to-date list of subprocessors, available to the School upon request.
- Ensure subprocessors are bound by written agreements imposing appropriate data protection obligations consistent with Article 28 of the UK GDPR.
- Remain responsible for its subprocessors' performance of their relevant data protection obligations.
- Inform the School in advance of any intended additions or replacements to its subprocessors, providing a reasonable opportunity to object.
Knowness uses an external AI service to assist with answer checking. Only submitted answer content is sent for processing, without attaching student names, email addresses or account identifiers. Submitted information is not used for AI model training.
Wonde facilitates authorised school data integration under its applicable contractual arrangements.
7. Data Security and International Transfers
Knowness implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure.
These include appropriate encryption, access controls, secure authentication, confidentiality safeguards and security monitoring, together with measures supporting system resilience, recovery and regular assessment of security effectiveness.
Personal data transferred through Wonde uses secure, authorised connections.
Where personal data is transferred outside the United Kingdom, Knowness shall ensure that the transfer complies with applicable data protection law and the School's documented instructions, using appropriate safeguards where required.
8. Data Retention and Deletion
Knowness retains personal data only for as long as necessary to provide its services or meet applicable legal obligations.
When a school-managed account is terminated, associated personal data is deleted from Knowness's active systems immediately, unless continued retention is required by law or authorised by the School.
Upon termination of the School's agreement with Knowness, personal data shall be returned or securely deleted at the School's choice, including existing copies unless applicable law requires their retention.
Where immediate deletion from backups is not technically practicable, remaining information shall be securely protected, placed beyond ordinary use and deleted in accordance with documented retention procedures.
9. Compliance and Individual Rights
Knowness shall cooperate with the School in meeting its obligations under applicable data protection legislation.
This includes providing reasonable assistance with individual rights requests, personal data breaches, DPIAs, regulatory enquiries and compliance verification.
The School remains responsible for decisions concerning personal data processed under its authority.
Knowness shall maintain appropriate records of its processing activities and relevant security measures as required by law.
10. Agreement and Governing Law
This Agreement forms part of the contractual arrangements governing the School's use of Knowness and takes effect when incorporated into a legally binding agreement or other valid acceptance arrangement between the Parties.
The Agreement may be accepted electronically and does not require a physical signature. Where this Agreement is incorporated into the School's authorised onboarding or approval process, including through Wonde, the School's approval constitutes acceptance of this Agreement.
This Agreement is governed by the laws of England and Wales.
11. Contact Information
Knowness Ltd
Registered Office:
Studio 9, 50–54 St Paul's Square
Birmingham, England
B3 1QS
Operational Address:
The Exchange
3 Centenary Square
Birmingham
B1 2DR
Email: [email protected]
Website: https://knowness.com
ICO Registration Number: ZB873664