Data processing agreement

1. Parties

This agreement is between [School name] (MoE institution number [number]) ("the School") and the operator of Heapso ("Heapso"). It forms part of the School's subscription agreement and the Heapso terms of use. If they conflict, this agreement wins on matters of personal information.

2. Roles

The School controls the personal information of its staff that is processed through its Heapso account ("School Data"). Heapso holds and processes School Data as the School's agent under section 11 of the Privacy Act 2020, only for the purpose of providing the service, and doesn't use or disclose it for its own purposes except as described in this agreement.

3. Categories of information

• Staff account details: name, school email address, role, seat assignment and sign-in records.
• Content created by staff: prompts, plans, worksheets, slides, uploaded teaching resources and shared library items.
• Usage data: generation counts, credit use, audit logs of admin actions.

Student information is out of scope. The service is for staff only. The School will instruct staff not to enter information that identifies a student. Heapso provides in-product warnings to support this but doesn't guarantee detection.

4. Heapso's obligations

1. Process School Data only on the School's documented instructions, including the settings the School chooses in the admin dashboard.
2. Keep School Data confidential and ensure staff and contractors with access are bound by confidentiality.
3. Apply reasonable security safeguards (IPP 5), including encryption in transit, role-based access control, row-level database security and audit logging of admin actions. [Encryption at rest and two-factor authentication for Heapso staff: to confirm before launch.]
4. Not sell School Data, use it for advertising, or use it to train AI models. Heapso uses its AI sub-processors' business APIs, whose standard terms say they don't train on that content (see our privacy statement).
5. Help the School respond to access and correction requests (IPPs 6 and 7) within 10 working days of being asked.
6. Keep a record of processing and make information reasonably needed to show compliance available to the School.

5. Location and sub-processors

School Data is stored in [database region: to confirm before launch]. The School authorises these sub-processors:

Heapso will give the School at least 30 days' notice of a new sub-processor. The School may object on reasonable privacy grounds and, if the objection can't be resolved, end the subscription with a pro-rata refund. Heapso will impose obligations on each sub-processor that provide comparable safeguards to the Privacy Act (IPP 12) and remains responsible for their performance.

6. Privacy breaches

Heapso will notify the School without undue delay, and in any case within 72 hours, after becoming aware of a privacy breach affecting School Data. The notice will describe what happened, the information involved, likely consequences and steps taken. Heapso will assess whether the breach is notifiable and, where it is, notify the Office of the Privacy Commissioner and affected individuals in coordination with the School.

7. Retention, return and deletion

• The School can set retention periods for school content and export shared content at any time from the admin dashboard.
• When the subscription ends, School Data remains available for export for 90 days and is then deleted, with backups rolling off within a further 35 days, unless the law requires us to keep it (for example, billing records).
• On request, Heapso will confirm deletion in writing.

8. Audits and assurance

Heapso will answer reasonable security and privacy questionnaires once a year, or after a breach. Heapso has not had a Safer Technology for Schools (ST4S) assessment.

9. Term and law

This agreement runs for as long as Heapso processes School Data. It is governed by New Zealand law. Clauses 4.2, 6 and 7 survive termination.

Signed