Online training logo

Improving learner outcomes

Data Processing Agreement

This Data Processing Agreement ("DPA") is between OnLineTraining Ltd, a company registered in England and Wales under company number 06586629, whose registered office is at 17 Hove Park Villas, Hove, BN3 6HH ("OLT"), and each school, local authority or other organisation whose staff use OLT's platform under a licence or subscription held by that organisation (the "Customer").

This DPA forms part of the agreement between the Customer and OLT for the Customer's use of OLT's online training platform, including OLT's Terms and Conditions (the "Agreement"). If this DPA and the Agreement conflict on the processing of Customer Personal Data, this DPA prevails. A Customer that needs a signed copy can request one from enquiries@oltinternational.net.

1. Definitions

In this DPA:

  • "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, and any other law on the processing of personal data that applies to the Customer or OLT. For Customers in Australia it also includes the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
  • "Customer Personal Data" means the personal data described in Annex 1, which the Customer's staff enter into the Planning Tools and which OLT processes on the Customer's behalf.
  • "Planning Tools" means the GAP Workbook and every other page of OLT's platform where goals and interventions are entered, including the goal helper and the related AI goal suggestions and review.
  • "Sub-processor" means a third party engaged by OLT to process Customer Personal Data.
  • "Personal Data Breach", "controller", "processor", "data subject" and "processing" have the meanings given in the UK GDPR.

2. Roles and scope

2.1 For Customer Personal Data, the Customer is the controller and OLT is the processor.

2.2 OLT is an independent controller of the account and learning data of the Customer's staff who use the platform (their names, contact details, course progress, certificates and similar). It processes that data under its privacy notice, published in our Privacy Policy, and it is outside the scope of this DPA. This includes the progress reports OLT makes available to the Customer's leads and administrators.

2.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3. Customer obligations

3.1 The Customer is responsible for having a lawful basis, and where needed a condition under Article 9 UK GDPR (for Customers in Australia, the requirements of the Australian Privacy Principles for sensitive information), for its staff to record Customer Personal Data in the Planning Tools.

3.2 The Customer will instruct its staff to identify pupils in the Planning Tools only by initials or a pseudonym, and not to enter names, dates of birth, addresses or any other information that directly identifies a pupil or their family. OLT displays this instruction wherever pupil information is recorded.

3.3 The Customer is responsible for its own privacy information to pupils and parents about the use of the Planning Tools.

4. OLT's obligations

OLT will:

4.1 Instructions. Process Customer Personal Data only on the Customer's documented instructions. These instructions are given by this DPA, the Agreement and the Customer's use of the Planning Tools, unless the law requires otherwise. If the law requires otherwise, OLT will tell the Customer before processing, unless the law prohibits that. OLT will tell the Customer immediately if it thinks an instruction breaks Data Protection Law.

4.2 Confidentiality. Make sure that everyone OLT authorises to process Customer Personal Data is bound by a duty of confidentiality.

4.3 Security. Take the technical and organisational measures required by Article 32 UK GDPR, including those set out in Annex 2.

4.4 Sub-processors. Use Sub-processors only as set out in clause 5.

4.5 Data subject requests. Help the Customer, as far as reasonably possible, to respond to requests from data subjects exercising their rights. If OLT receives such a request directly, it will pass it to the Customer without undue delay and will not respond itself except on the Customer's instructions.

4.6 Assistance. Help the Customer meet its obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to OLT.

4.7 Personal Data Breaches. Notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include, as far as OLT then knows:

  • the nature of the breach;
  • the categories and approximate number of data subjects and records concerned;
  • the likely consequences;
  • the measures taken or proposed.

OLT will provide further information as it becomes available, and will take reasonable steps to contain and remedy the breach.

4.8 Deletion or return. At the end of the Agreement, at the Customer's choice, delete or return all Customer Personal Data within 90 days. OLT may keep a copy only where the law requires it. Copies in OLT's database backups are deleted automatically as those backups expire under OLT's normal backup cycle, and are not restored except to recover the service.

4.9 Audit. Make available to the Customer all the information needed to show compliance with this DPA. OLT will allow for and contribute to audits, including inspections, by the Customer or an auditor it appoints, on these terms:

  • at least 30 days' written notice;
  • no more than once a year, unless a Personal Data Breach has occurred or a regulator requires an audit;
  • during normal business hours, and subject to reasonable confidentiality obligations;
  • at the Customer's cost.

OLT may first answer the audit by providing written information, such as completed security questionnaires.

4.10 No automated decisions. Not make any decision about a pupil based solely on automated processing that produces legal or similarly significant effects (Article 22 UK GDPR). AI output in the Planning Tools is a suggestion for the Customer's staff to review, edit or reject.

5. Sub-processors

5.1 The Customer gives OLT general authorisation to engage Sub-processors. The Sub-processors in use at the date of this DPA are listed in Annex 3.

5.2 OLT will tell the Customer at least 30 days before adding or replacing a Sub-processor. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may stop using the affected Planning Tools, or end the Agreement for those services.

5.3 OLT will put a written contract in place with each Sub-processor that imposes data protection obligations no less protective than those in this DPA. OLT remains responsible to the Customer for each Sub-processor's performance of those obligations.

6. International transfers

6.1 OLT hosts Customer Personal Data in Microsoft Azure: in the UK (UK South region) for UK Customers, and in Australia (Australia East region) for Australian Customers.

6.2 Where a Sub-processor processes Customer Personal Data outside the UK, OLT will make sure the transfer is covered by one of the following:

  • UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the Sub-processor is certified;
  • the International Data Transfer Agreement or Addendum issued by the Information Commissioner;
  • another safeguard permitted by Data Protection Law.

7. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

8. Term

This DPA continues for as long as OLT processes Customer Personal Data. Clause 4.8 survives termination.

9. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. This matches OLT's terms and conditions on both sites.

10. Contact

OLT's data protection contact is Nick Maloney, Director, enquiries@oltinternational.net. OnLineTraining Ltd is registered with the Information Commissioner's Office (registration no. Z1799910).

Annex 1: Details of the processing

  • Subject matter: hosting and processing of the information the Customer's staff record in the Planning Tools to plan support for pupils.
  • Duration: the term of the Agreement, plus the deletion period in clause 4.8.
  • Nature of processing: collection, storage, organisation, display, retrieval, analysis by AI to suggest goals and improvements to goals, and to update the pupil's profile from information staff provide, printing and export, and deletion.
  • Purpose: to let the Customer's staff record pupils' strengths, difficulties, triggers and needs; set SMART goals and plan interventions for them; and receive AI suggestions of goals, AI reviews of their goals, and AI updates to the pupil's profile from information they provide.
  • Categories of data subjects: pupils supported by the Customer's staff. Staff are instructed to identify pupils only by initials or a pseudonym (clause 3.2).
  • Types of personal data: a label for the pupil or group (initials or a pseudonym); year group and attainment levels; areas of need; descriptions of the pupil's strengths, difficulties, triggers, sensitivities and learning needs; goals, interventions, and monitoring and review notes.
  • Special category data: the descriptions of a pupil's needs may include information about health, including special educational needs or disabilities.
  • Frequency: continuous, while the Customer's staff use the Planning Tools.

Annex 2: Technical and organisational security measures

Hosting and encryption

  • Hosted in Microsoft Azure (App Service, Azure SQL Database and Azure Storage) in the UK or Australia, as set out in clause 6.1.
  • All data encrypted in transit (TLS, with HTTPS enforced) and at rest (Azure platform encryption).

Access control

  • Role-based access control. Customer Personal Data is visible only to:
    • the staff member who recorded it;
    • the Customer's own leads and administrators;
    • tutors assigned to that staff member's course;
    • authorised OLT staff.
  • Access to production systems and databases is limited to OLT's authorised development staff.

Authentication

  • An email address must be confirmed before an account can sign in.
  • Passwords are salted and hashed (PBKDF2-HMAC-SHA512, 100,000 iterations).
  • Accounts lock after 8 failed sign-in attempts.

Application security

  • All user-entered content and AI output is sanitised before it is displayed.
  • Database access uses parameterised queries.
  • Cross-origin requests are restricted to OLT's own domains.

Minimisation

  • The Planning Tools ask for initials or a pseudonym only, and show a privacy notice wherever pupil information is recorded.
  • Data sent to AI Sub-processors is limited to what is needed for the AI goal suggestions and review.
  • AI Sub-processors do not use it to train their models.

AI features

  • OLT uses Anthropic's and OpenAI's commercial APIs only, not their consumer products.
  • Under their commercial terms, the providers keep API inputs and outputs for up to 30 days, only to detect and prevent misuse.
  • AI output is a suggestion for staff to review, edit or reject (clause 4.10).
  • OLT's approach follows the Department for Education's guidance on generative AI in education.

Resilience

  • Automated database backups, with point-in-time restore and geo-redundant backup storage.
  • Separate databases for UK and Australian Customers.

Monitoring

  • Application and error logging, and Azure's built-in platform metrics for App Service and Azure SQL.

Annex 3: Authorised Sub-processors

  • Microsoft Ireland Operations Ltd (Microsoft Azure): hosting, database and file storage. Location: UK (UK Customers); Australia (Australian Customers). Transfer safeguard: not applicable for UK Customers.
  • OpenAI: AI goal suggestions and review. Location: USA. Transfer safeguard: OpenAI Data Processing Addendum (signed).
  • Anthropic: AI goal suggestions and review. Location: USA. Transfer safeguard: Anthropic Data Processing Addendum (signed).

Version 1.0, last updated 30 October 2026

Back to Top