Data processing agreement

1. Roles

The school is the controller of family personal data. Nalda is the processor. Nalda processes that data only on the school's documented instructions, which are this agreement, the settings the school chooses in the product, and any further written instruction from the school.

Nalda is the controller of its own staff account data, meaning the names and work email addresses of the people at the school who sign in, for the purpose of running the service.

2. Subject matter, duration, nature and purpose

Subject matter: answering questions from families on the school's behalf, from the school's own published content, and booking visits.

Duration: for as long as the school has an account, plus the retention period the school sets for conversations.

Nature and purpose: storing, retrieving, drafting and sending communications, and recording outcomes.

3. Categories of data subject and of personal data

Data subjects: prospective, admitted and current families who contact the school, and the school's own staff who use the product.

Categories of personal data: name, email address, telephone number where volunteered, the year group or entry year of a child where volunteered, the content of messages a family sent, the content of replies sent to them, and booking times.

Special category data is not requested and no field exists for it. A family may nevertheless type something sensitive into a free text message. Nalda classifies such messages as sensitive and routes them to a person rather than answering them.

No student records are processed. Nalda has no connection to a student information system.

4. Subprocessors

The current list is published at /legal/subprocessors and is generated from the product's own configuration, so it reflects what is actually in use.

Nalda will give schools notice before adding a subprocessor that can see family data, and a school may object. Each subprocessor is bound by terms no weaker than these.

5. Security

The measures actually in place are described in full at /legal/security. In summary: data in transit is encrypted; data at rest is encrypted at the storage layer; every row carries the school it belongs to and every query in the application is pinned to one school by a single database access layer that a build gate enforces; staff actions are written to an append-only audit log; permissions are role based; secrets live only in the environment.

The security page also names what is not in place yet. That is deliberate.

6. Assistance with data subject rights

Nalda provides the school with self-service export and deletion for any household, from inside the product, available to staff with admin permission. Nalda does not need to be contacted for a routine request.

Export produces a readable file containing every record held about that household. Deletion removes the household record, every conversation, every message, every draft, every capture, every queued send and every booking.

Two record types survive deletion: the append-only ledger and the append-only staff audit log. Neither contains the family's words or contact details. Their identifiers are left pointing at a record that no longer exists, and a tombstone marks that the household was erased. This is described in plain language at /legal/privacy.

7. Personal data breach

Nalda will notify the school without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting that school's data, with what is known at the time and what is being done.

8. Return and deletion

On the end of the account, the school may export its data. Nalda deletes the account and its data 90 days after the subscription ends, or sooner on request.

9. Audit

Nalda will answer a school's reasonable questions about these measures in writing and will make available the information needed to demonstrate compliance. Nalda holds no third party certification today. That is stated on the security page rather than implied away here.

10. International transfers

Processing takes place in the United States. A school outside the United States that needs a transfer mechanism should raise it before signing, because the appropriate clauses have not yet been prepared.

11. Status of this document

This agreement has not yet been reviewed by a qualified lawyer and names no legal entity, because none is incorporated yet. It is published in this state on purpose: it says what the product actually does, and it does not pretend to be executed. See the notice at the top of the page.