Data Processing Agreement

Important: This is a template for general onboarding and commercial use. It is not legal advice. Spurr Empire Limited and each School should have it reviewed by qualified legal counsel and adapted to their own requirements and local laws, including the Jamaica Data Protection Act, 2020 and, where applicable, the GDPR, before signing.

This Data Processing Agreement (the "DPA") forms part of the School Services Agreement between the Provider and the School and applies where SpurrCampus processes personal data on behalf of the School.

1. Parties and roles

Processor: Spurr Empire Limited ("SpurrCampus," "Processor"), Kingston, Jamaica, West Indies.

Controller: ________________________________ (the "School")

For personal data the School enters into or manages through SpurrCampus, the School is the Data Controller and SpurrCampus is the Data Processor, as described in Section 3 of the Privacy Policy at https://www.spurrcampus.com/privacy-policy.

SpurrCampus may act as a Data Controller for limited business, security, billing, support, and administrative purposes, as described in the Privacy Policy.

2. Subject matter and duration

The subject matter of the processing is the provision of the SpurrCampus services under the School Services Agreement. Processing continues for the term of that Agreement and during any agreed data export and deletion period after termination.

3. Nature and purpose of processing

SpurrCampus processes personal data on the School's instructions to provide and support school operations, including student registration and records, parent and guardian relationships, staff roles and permissions, check-in and check-out workflows, pickup and drop-off authorization, bulletins, announcements, notifications, and related administration, as described in Section 6 of the Privacy Policy.

4. Types of personal data

Depending on the School's configuration, processing may include:

Student information (such as name, class, grade, branch, enrollment, identification details, and photos where used)
Parent, guardian, driver, emergency contact, and authorized representative details
Relationship and authorization information
Staff information (such as name, contact details, role, and access records)
Check-in, check-out, pickup, drop-off, confirmation, override, and audit records
Communication records and notification preferences
Technical and usage information, as described in Section 4 of the Privacy Policy

5. Categories of data subjects

Students and children
Parents and guardians
Drivers, emergency contacts, and authorized pickup persons
School staff and administrators

6. Controller instructions

SpurrCampus processes personal data only on the documented instructions of the School, including as set out in the School Services Agreement and this DPA, unless required to act otherwise by law. The School is responsible for ensuring it has a lawful basis for the processing it instructs.

7. Sub-processors

The School authorizes SpurrCampus to engage sub-processors to help provide the services, such as cloud hosting, database and storage, email delivery, SMS, WhatsApp messaging, push notifications, payment processing, analytics, monitoring, customer support, security, and AI providers.

The categories and current sub-processors are listed in the SpurrCampus Sub-processor List, available as a separate document in the Resource Center. SpurrCampus will require sub-processors to protect personal data appropriately and will remain responsible for their processing under this DPA. SpurrCampus will give the School a reasonable way to learn of material changes to sub-processors.

8. Security

SpurrCampus applies reasonable technical, administrative, and organizational measures designed to protect personal data, as described in Section 10 of the Privacy Policy and on the Security page at https://www.spurrcampus.com/security. These may include encryption in transit, role-based access controls, audit logging, least-privilege access, secure cloud infrastructure, backups, monitoring, and incident response procedures.

9. International transfers

SpurrCampus may process personal data in countries other than Jamaica through its providers. Where required by applicable law, SpurrCampus uses appropriate safeguards for international transfers, as described in Section 9 of the Privacy Policy.

10. Personal data breaches

If SpurrCampus becomes aware of a personal data breach affecting personal data processed on behalf of the School, SpurrCampus will notify the School without undue delay, and in any event within ________ hours (default 72 hours) of becoming aware, and will provide reasonable information to help the School meet its own notification obligations, consistent with Section 18 of the Privacy Policy.

11. Assistance to the Controller

Taking into account the nature of the processing, SpurrCampus will provide reasonable assistance to help the School:

Respond to data subject requests (such as access, correction, deletion, restriction, objection, and portability)
Meet its security, breach notification, and data protection impact assessment obligations

Where a request relates to data the School controls, SpurrCampus may refer the request to the School, as described in Section 12 of the Privacy Policy.

12. Return and deletion

On termination or expiry of the School Services Agreement, the School may request export of its data within the period stated in that Agreement (default 30 days). After that period, SpurrCampus will delete or return processor-held personal data, except where retention is required or permitted by law, audit, or security needs. SpurrCampus will confirm deletion on the School's written request.

13. Audit

SpurrCampus will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to reasonable audits, on reasonable prior written notice, during normal business hours, and subject to confidentiality, in a way that does not compromise the security of other customers.

14. Order of precedence

This DPA forms part of the School Services Agreement. If there is a conflict between this DPA and the rest of that Agreement on the processing of personal data, this DPA controls to the extent of the conflict.

15. Signatures

For the School (Controller)

Name: ________________________________

Title: ________________________________

Signature: ________________________________

Date: ________________________________

For the Provider (Processor, Spurr Empire Limited)