Data processing addendum

ACEL-Pro Data Processing Addendum

Version 1.0
Effective from 5 October 2026
Provided by ALTA Education Limited

Download PDF

This Data Processing Addendum ("DPA") is provided by:

ALTA Education Limited, Regent Court, 70 West Regent Street, Glasgow G2 2QZ, Scotland, Company Number SC784684 ("ALTA" or "the Processor").

This DPA forms part of any ACEL-Pro Service Agreement which expressly incorporates this version of the DPA.

For the purposes of this DPA:

  • Customer means the organisation entering into the relevant ACEL-Pro Service Agreement with ALTA.
  • Controller means the organisation identified as the Data Controller in the relevant ACEL-Pro Service Agreement.
  • Service Agreement means the agreement governing the Customer's use of ACEL-Pro.

This DPA takes effect in relation to a Customer on the date on which the relevant Service Agreement incorporating it takes effect.

1. Purpose and definitions

The Controller has appointed ALTA to provide ACEL-Pro under the Service Agreement.

In providing ACEL-Pro, ALTA will process certain personal data on behalf of the Controller.

This DPA sets out the terms governing that processing. It is intended to satisfy the processor terms required under Article 28 of the UK General Data Protection Regulation.

For the purposes of this DPA:

  • Data Protection Laws means applicable UK data protection legislation, including the UK General Data Protection Regulation and the Data Protection Act 2018, in each case as amended or replaced from time to time.
  • Personal Data, Data Subject, Personal Data Breach and Processor have the meanings given to them by applicable Data Protection Laws.
  • Subprocessor means another processor engaged by ALTA to process personal data on behalf of the Controller in connection with ACEL-Pro.

2. Relationship with the Service Agreement

This DPA forms part of the contractual arrangements between the Controller and ALTA for ACEL-Pro.

The Service Agreement continues to apply except where this DPA expressly deals with the processing of personal data.

If there is any conflict between this DPA and the Service Agreement in relation to the processing of personal data, this DPA will take priority.

Nothing in this DPA changes the commercial scope, fee, access period or other commercial terms agreed in the Service Agreement.

Where the parties enter into a separate written data processing agreement specifically relating to ACEL-Pro, that agreement will take precedence over this DPA to the extent of any conflict.

3. Roles and responsibilities

For personal data processed through ACEL-Pro under the Service Agreement:

  • the Controller acts as the Data Controller; and
  • ALTA acts as the Data Processor.

The Controller determines the purposes for which personal data is processed through ACEL-Pro and is responsible for:

  • identifying an appropriate lawful basis for the processing;
  • providing any privacy information required to pupils, staff or other data subjects;
  • deciding which pupils and staff should use ACEL-Pro;
  • ensuring that only personal data necessary for the agreed purposes is entered into ACEL-Pro;
  • managing its internal permissions and user access;
  • completing any DPIA, information-governance, IT/security or other internal approval required before personal data is shared with ALTA or entered into ACEL-Pro.

4. Processing on documented instructions

ALTA will process personal data only:

  • on the documented instructions of the Controller;
  • as necessary to provide, operate and support ACEL-Pro under the Service Agreement and this DPA; or
  • where ALTA is required to process the personal data by applicable UK law.

The Service Agreement, this DPA, ACEL-Pro account and configuration instructions, and other written instructions given by the Controller form part of the Controller's documented instructions.

If applicable law requires ALTA to process personal data other than on the Controller's instructions, ALTA will inform the Controller before carrying out that processing unless the law prohibits ALTA from doing so.

ALTA will inform the Controller immediately if, in ALTA's reasonable opinion, an instruction infringes applicable Data Protection Laws.

5. Confidentiality

ALTA will ensure that any person authorised to process personal data on its behalf:

  • accesses personal data only where necessary for their role;
  • is subject to an appropriate duty of confidentiality; and
  • processes personal data only in accordance with this DPA and the Controller's documented instructions.

The confidentiality obligations in this DPA continue after the end of the Service Agreement.

6. Security and authorised support access

ALTA will implement and maintain appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The principal security measures currently used for ACEL-Pro are described in Schedule 2.

Authorised ALTA personnel may access relevant customer personal data where reasonably necessary, and limited to the minimum personal data required, to provide account support, technical support, security, maintenance or troubleshooting. Any such access is subject to appropriate access controls, purpose limitation and confidentiality obligations.

ALTA will keep its security arrangements under review and may update them where appropriate, provided that the overall level of protection for personal data is not materially reduced.

7. Subprocessors

The Controller gives ALTA general written authorisation to use subprocessors where reasonably necessary to provide ACEL-Pro.

The Controller specifically authorises the subprocessors listed in Schedule 3 as at the effective date of this DPA.

ALTA will:

  • enter into a written agreement with each subprocessor that imposes data-protection obligations; each such agreement must provide an equivalent level of protection for the relevant personal data;
  • remain responsible to the Controller for the performance of those data-protection obligations by its subprocessors;
  • give the Controller at least 14 days' prior written notice of any intended addition or replacement of a subprocessor; and
  • give the Controller an opportunity during that notice period to object to the proposed change on reasonable data-protection grounds.

If the Controller raises a reasonable data-protection objection during the notice period, the parties will work together in good faith to identify an appropriate solution.

If the proposed subprocessor is necessary to continue providing ACEL-Pro and no reasonable alternative can be agreed, either party may terminate the affected service before the proposed subprocessor begins processing the Controller's personal data.

ALTA will not use the proposed subprocessor to process the Controller's personal data before such termination takes effect.

The consequences of termination, including any refund of prepaid fees for the unused period, will be governed by the Service Agreement.

8. International transfers

ALTA will not make a restricted transfer of personal data unless:

  • the Controller has instructed or authorised the transfer; and
  • the transfer is made in accordance with applicable Data Protection Laws, including the use of an appropriate transfer mechanism where required.

The current ACEL-Pro hosting and transactional-email arrangements are described in Schedule 3.

9. Data-subject rights

Taking into account the nature of the processing, ALTA will provide reasonable assistance to the Controller, including appropriate technical and organisational measures where possible, to help the Controller respond to requests by individuals exercising their rights under Data Protection Laws.

If ALTA receives a request directly from a data subject concerning personal data processed on behalf of the Controller, ALTA will normally refer the request to the Controller unless legally required to deal with it directly.

ALTA will not respond substantively on behalf of the Controller unless instructed to do so or required by law.

10. Assistance with compliance

Taking into account the nature of the processing and the information available to ALTA, ALTA will provide reasonable assistance to the Controller in meeting its applicable obligations relating to:

  • security of processing;
  • personal data breaches;
  • notifications to affected data subjects where required;
  • data protection impact assessments;
  • consultation with the UK data protection regulator where required; and
  • other reasonable information-governance enquiries relating to ALTA's processing of the Controller's personal data.

11. Personal data breaches

If ALTA becomes aware of a Personal Data Breach, or a security incident which ALTA reasonably suspects involves unauthorised access to, disclosure, alteration, loss or destruction of personal data processed on behalf of the Controller, ALTA will:

  • investigate the incident promptly;
  • take reasonable steps to contain and mitigate its effects;
  • notify the Controller without undue delay, and where practicable within 24 hours of becoming aware;
  • preserve all relevant logs and records where reasonably necessary and legally permissible; and
  • provide the information reasonably available to ALTA that the Controller requires to assess the incident and meet its reporting obligations.

Where relevant information is not immediately available, ALTA may provide it in stages as the investigation develops.

12. Return and deletion of personal data

At the end of the Service Agreement or other agreed ACEL-Pro access period, the Controller may choose to instruct ALTA to:

  • return the personal data processed on its behalf and then delete existing copies; or
  • delete the personal data without return.

Where the Controller requests return of the personal data, ALTA will provide it in a reasonably usable electronic format appropriate to the nature of the ACEL-Pro service.

Unless the Controller instructs earlier deletion or another written agreement requires a different period, the Controller instructs ALTA to apply its standard ACEL-Pro offboarding process.

Under that process:

  • customer personal data may remain in the live ACEL-Pro systems for a maximum of 90 days after the contract or agreed access period ends, solely to allow authorised data return, recovery or resolution of an offboarding request;
  • the personal data is then deleted from the live ACEL-Pro systems;
  • automatic hosting backups operate on a rolling cycle and an earlier copy may remain within that normal backup rotation for up to 14 further days after deletion from the live system;
  • backup data is not used for routine active processing and is retained only for service continuity, security and disaster-recovery purposes.

ALTA may also create temporary manual database backups or exports where reasonably necessary to protect data during higher-risk maintenance, system changes or recovery work.

Any such manual backup:

  • is an operational safety copy only;
  • is subject to restricted access;
  • is not used for routine processing;
  • is deleted when the maintenance or recovery purpose for which it was created has ended; and
  • does not create a separate archival or indefinite-retention category.

Any manual copy containing the Controller's personal data that still exists when the Controller's ACEL-Pro access period ends is subject to the same return or deletion instruction and will be deleted no later than the deletion of that personal data from the live ACEL-Pro systems, unless applicable law requires its continued storage.

ALTA may retain personal data beyond these periods only where required by applicable law.

Where this applies, the retained data will remain protected and will not be processed for any other purpose.

13. Information, audits and inspections

ALTA will make available to the Controller information reasonably necessary to demonstrate compliance with the processor obligations contained in this DPA and applicable Data Protection Laws.

ALTA will allow for and contribute to reasonable audits or inspections by the Controller, or an independent auditor appointed by the Controller, relating to the processing covered by this DPA.

Audits and inspections must:

  • be proportionate to the nature and risk of the processing;
  • take reasonable account of ALTA's security and confidentiality obligations to other customers and users;
  • be arranged on reasonable notice except where an urgent investigation is required following a security incident or regulatory requirement; and
  • avoid unnecessary disruption to ALTA's services and operations.

Where the information reasonably required can be supplied through documentation or written responses, the parties may agree to use that approach instead of an on-site inspection.

14. Sensitive information and free-text fields

ACEL-Pro is designed around data minimisation and does not require special category personal data or other highly sensitive information for its normal operation.

The Controller must not knowingly enter information such as:

  • health or medical information;
  • disability or diagnostic information;
  • safeguarding information;
  • ethnicity;
  • religious or philosophical beliefs;
  • other special category personal data;
  • highly sensitive pastoral information; or
  • similar sensitive information

into teacher notes, group names, intervention names or other free-text fields unless this has first been expressly agreed with ALTA and the parties have confirmed that appropriate data-protection arrangements are in place.

The existence of a free-text field within ACEL-Pro does not mean that the field is intended to hold information outside the agreed purposes of the service.

15. Liability

Nothing in this DPA excludes or limits any liability that cannot lawfully be excluded or limited.

Subject to that, liability between the parties remains governed by the Service Agreement.

16. Duration and termination

This DPA applies for as long as ALTA processes personal data on behalf of the Controller in connection with ACEL-Pro.

Provisions which by their nature are intended to continue after processing ends, including confidentiality, deletion, audit and liability provisions, will continue for as long as necessary.

17. Changes to this DPA

ALTA may publish revised versions of this DPA from time to time. Each revised version will have a new version number and effective date, and previous versions will remain available at their permanent addresses.

Publication of a revised version does not, by itself, amend or replace the version of this DPA incorporated into an existing Service Agreement.

This does not prevent ALTA from making changes expressly permitted under the version already incorporated into a Service Agreement, including updating its security arrangements in accordance with Section 6 or adding or replacing a subprocessor in accordance with Section 7.

Any material change to the processing described in Schedule 1 must be agreed in writing by both parties.

18. Governing law

This DPA is governed by the same law and jurisdiction as the relevant Service Agreement.

Schedule 1: Details of the processing

Subject matter

Provision, operation, support and maintenance of ACEL-Pro under the Service Agreement.

Duration

Processing will take place during the agreed ACEL-Pro access period and any subsequent limited return, recovery, offboarding or deletion period described in this DPA.

Nature and purpose of the processing

ALTA may process personal data as necessary to:

  • create and maintain authorised pupil and staff accounts;
  • organise pupils into agreed schools, classes and groups;
  • deliver mathematical tasks and activities through ACEL-Pro;
  • record pupil responses and related task-session information;
  • generate curriculum-linked learning evidence, indicators and summaries;
  • enable teachers and authorised leaders to review learning evidence;
  • record teacher professional judgements or notes where entered by authorised users;
  • record names or descriptions associated with authorised groups or interventions;
  • provide optional first-language scaffolding where enabled by the Controller;
  • provide account, technical and implementation support;
  • maintain the security and operation of the service;
  • investigate and resolve technical faults or security issues;
  • send necessary transactional emails to authorised staff users;
  • support authorised return, recovery and deletion of customer personal data.

ALTA does not sell pupil personal data or use pupil personal data for advertising.

Categories of data subjects

  • pupils authorised to use ACEL-Pro;
  • teachers;
  • school leaders;
  • other authorised staff users.

Types of personal data

Pupil data

ACEL-Pro may process:

  • first name and last name, or a pseudonymised identifier where chosen by the Controller;
  • username or other login identifier;
  • password stored in hashed form;
  • school;
  • year group;
  • class;
  • intervention or other authorised group membership;
  • responses to mathematical tasks;
  • task-session information;
  • timestamps and limited activity information relevant to learning evidence;
  • system-generated curriculum-linked evidence indicators and summaries;
  • teacher professional judgements or notes entered in relation to learning evidence;
  • names or descriptions associated with authorised groups or interventions;
  • first language where the Controller chooses to enable native-language scaffolding.

ACEL-Pro is not designed routinely to collect pupil:

  • dates of birth;
  • home addresses;
  • parent or carer contact details;
  • demographic or socioeconomic categories such as FSM or ASN;
  • health or medical information;
  • disability or diagnostic information;
  • safeguarding information;
  • ethnicity;
  • religious beliefs;
  • biometric data; or
  • other special category personal data.

Staff data

ACEL-Pro may process:

  • name;
  • username or other login identifier;
  • email address;
  • password stored in hashed form;
  • two-factor authentication credentials where the role requires them, comprising an authenticator secret and backup codes, both stored in encrypted form;
  • remembered-device records where a user chooses to trust a browser, comprising a hashed token, a short device description such as Chrome on Windows, and related timestamps;
  • organisational association, including school, local authority, trust or school group;
  • user role;
  • display language preference;
  • limited account, sign-in and activity information relevant to use and security.

Technical and security data

ACEL-Pro may process limited technical, sign-in, security and diagnostic information necessary to operate, secure and troubleshoot the service.

This may include:

  • timestamps;
  • account and sign-in activity;
  • technical request information;
  • security logs;
  • server or application diagnostic logs; and
  • network or technical identifiers where generated as part of security, hosting or diagnostic logs.

This information is processed for service operation, security, maintenance and troubleshooting rather than for educational profiling.

Frequency of processing

Processing may occur routinely while authorised users access and use ACEL-Pro and during the agreed retention and offboarding period.

Controller rights and obligations

The Controller retains control over the purposes for which its personal data is used and may, subject to applicable law and the Service Agreement:

  • issue documented processing instructions;
  • determine which authorised users and pupils are included;
  • request information about ALTA's processing;
  • request correction of relevant personal data;
  • choose return or deletion of personal data at the end of the service;
  • exercise its audit rights under this DPA; and
  • withdraw or amend instructions where appropriate.

Schedule 2: Technical and organisational security measures

ACEL-Pro currently uses measures including:

  • encryption of data in transit using TLS/HTTPS;
  • passwords stored in hashed form rather than retrievable plain text;
  • role-based access controls;
  • organisational and school-level access boundaries;
  • technical controls limiting administrative and support access;
  • restricted access to production systems;
  • authorised ALTA support access only where reasonably necessary for account support, technical support, security, maintenance or troubleshooting;
  • limited technical, sign-in, security and diagnostic logging to support operation, security and troubleshooting;
  • no advertising cookies within the ACEL-Pro platform;
  • staff password creation and reset rules including minimum-length requirements and checks against known compromised passwords;
  • controlled preparation and reset of pupil credentials, with only password hashes retained after distribution;
  • multi-factor authentication required for organisation-level administrator accounts (local authority, trust or school group) and ALTA platform administrator accounts with access to the Controller's personal data;
  • where a user chooses to remember a browser, that choice skips only the additional authentication step and never the password, lasts for a limited period, and is cancelled automatically whenever the account password changes;
  • automatic hosting backups to support service continuity and disaster recovery;
  • rolling automatic backup retention of up to 14 days;
  • temporary manual database safety backups where required for higher-risk maintenance, system changes or recovery, subject to restricted access and deletion when their operational purpose has ended.

ALTA will maintain appropriate technical and organisational security measures having regard to the nature of the personal data processed, the purposes of the processing and the risks to data subjects.

Schedule 3: Authorised subprocessors

The Controller authorises the following subprocessors as at the effective date of this DPA.

IONOS Cloud Ltd

Purpose: Application hosting, database hosting and backups.

Current location: European infrastructure. For the relevant hosting arrangement, IONOS has identified Germany as the typical location.

Personal data involved: Personal data stored within or generated through the ACEL-Pro application and database, together with associated backups and technical hosting information.

Scaleway S.A.S

Purpose: Transactional email, including password setup, password resets, security codes and service notifications.

Current location: European Union. Scaleway identifies the Transactional Email service region used for this purpose as Paris.

Personal data involved: Staff email addresses, message content necessary to deliver the relevant transactional email, delivery metadata and associated technical logs.

ALTA does not use these services for advertising or marketing based on pupil personal data.