Home/Data Processing Agreement

Data Processing Agreement

Version: 2.1.0 · Effective date: 17 October 2026 · Between: Marvin Lumic Limited, trading as AcademyApp, company number 16005336, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ ("AcademyApp", the processor) and the organisation that has created an academy account ("the Academy", the controller).

This DPA forms part of the AcademyApp Terms of Service. If the two conflict on data protection, this DPA prevails.

1. Definitions

Words such as controller, processor, personal data, special category data, data subject, processing, personal data breach and supervisory authority have the meanings given in the UK GDPR and the Data Protection Act 2018 ("Data Protection Law"). "Academy Data" means the personal data AcademyApp processes for the Academy under this DPA (Annex 1). "Sub-processor" means a third party AcademyApp engages to process Academy Data.

2. Roles

2.1 The Academy is the controller of Academy Data — about its members, families, children, staff, enquirers and website visitors. It decides why and how that data is processed and which features to use.

2.2 AcademyApp is the processor of Academy Data and processes it only to provide the service, on the Academy's documented instructions (this DPA, the Terms, and the Academy's use and settings of the platform).

2.3 AcademyApp is a controller in its own right only for:

  • the Academy's account, billing and contract relationship with AcademyApp;
  • the security of the platform, including fraud and abuse prevention;
  • improving the service, using usage statistics and information about the use of AI features in de-identified form;
  • AcademyApp's own website visitors and marketing.

For these purposes, AcademyApp's Privacy Policy applies.

3. The Academy's responsibilities

The Academy:

  1. has a lawful basis for all processing of Academy Data and, where a child's data is entered, the authority of the child's parent or guardian;
  2. gives its members, parents and children a privacy notice that is accurate for how it uses AcademyApp. AcademyApp provides default notices that the Academy reviews, adapts and is responsible for;
  3. is registered with the ICO where the law requires it;
  4. decides whether to use optional features, including AI features;
  5. obtains and records the consents that features need (for example a parent's consent to public use of a child's image), and does not publish a child's image without that consent;
  6. handles requests from its data subjects;
  7. keeps outside the platform any record it must keep for longer than the platform keeps it (for example safeguarding records, accident books and employment records) — AcademyApp is not the Academy's safeguarding record system;
  8. tells its staff not to enter children's personal information into AI features beyond what a task needs, and to record health information only in the fields provided for it;
  9. keeps its staff's sign-in details secure and removes leavers promptly.

4. Instructions

4.1 AcademyApp processes Academy Data only on the Academy's documented instructions, including with regard to transfers outside the UK, unless the law requires otherwise; in that case AcademyApp tells the Academy first, unless the law forbids it.

4.2 AcademyApp tells the Academy promptly if it considers that an instruction infringes Data Protection Law.

5. AcademyApp's obligations as processor

5.1 Confidentiality. Everyone authorised by AcademyApp to process Academy Data is bound by confidentiality and has access only as far as their role requires.

5.2 Security. AcademyApp implements the measures in Annex 2.

5.3 Sub-processors.

  • The Academy gives general authorisation to the sub-processors on AcademyApp's sub-processor list (Annex 3).
  • AcademyApp gives the Academy at least 30 days' notice of any new or replacement sub-processor. The Academy may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Academy may end the affected service without penalty.
  • AcademyApp imposes data protection obligations on each sub-processor by contract that are no less protective than those in this DPA, and remains responsible to the Academy for them.

5.4 International transfers. AcademyApp transfers Academy Data outside the UK only with a safeguard recognised by Data Protection Law, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any transfer risk assessment the law requires.

5.5 Data subjects' rights. The platform provides tools to help the Academy respond to requests from data subjects, including for access, portability, rectification, erasure and objection. AcademyApp provides reasonable further assistance where those tools are not sufficient.

5.6 The Academy's other obligations. Taking into account the nature of the processing and the information available to it, AcademyApp assists the Academy with security, personal data breach notification, data protection impact assessments and prior consultation with the ICO.

5.7 Personal data breaches. AcademyApp notifies the Academy without undue delay after becoming aware of a personal data breach affecting Academy Data, with the information reasonably available to it at the time, and provides updates as more becomes available. The Academy decides whether to notify the ICO and the people affected.

5.8 End of the service. When the service ends, AcademyApp returns Academy Data (by export) or deletes it, at the Academy's choice, within a reasonable period, unless the law requires it to be kept. The Academy has a period to export its data (currently 30 days). Backup copies are deleted in the normal backup cycle and remain protected until then.

5.9 Records, information and audits.

  • AcademyApp keeps a record of its processing activities as a processor and makes available to the Academy the information reasonably necessary to demonstrate compliance with this DPA.
  • AcademyApp will first answer the Academy's audit requests through documentation, questionnaires and any certifications or reports it holds.
  • Where those are not sufficient, AcademyApp allows an inspection by the Academy or an independent auditor appointed by it: on at least 30 days' written notice, during business hours, within an agreed scope, no more than once a year (unless a personal data breach or the ICO requires otherwise), and at the Academy's cost.
  • Any auditor must be bound by confidentiality and must not be a competitor of AcademyApp. Audits do not extend to other customers' data or to information whose disclosure would compromise the security of the platform.

6. AI features

6.1 AcademyApp provides AI features to the Academy's staff, within their permissions. More information: How we use AI.

6.2 AcademyApp applies safeguards designed to minimise children's personal data in AI features and to keep children's health information out of AI processing.

6.3 AI providers are engaged as sub-processors under terms that prohibit the use of Academy Data to train their models.

6.4 AI features are not used to make decisions about children, families or members that have legal or similarly significant effects, or to profile children.

6.5 The Academy can switch AcademyApp's AI assistant off, and can choose whether to use AI features on its website.

7. Children

7.1 AcademyApp designs the platform with the ICO's Age Appropriate Design Code (the Children's Code) in mind, including privacy-protective defaults, no profiling of children for analytics or marketing, and no marketing to children.

7.2 Children's health and safety information is collected with the explicit consent the Academy obtains through the platform, is restricted to those who need it, and access to it is logged.

8. Liability and term

8.1 Each party's liability under this DPA is as set out in the Terms, except that nothing limits liability that cannot be limited by law.

8.2 This DPA lasts for as long as AcademyApp processes Academy Data.

Annex 1 — Details of processing
Subject matter Providing the AcademyApp platform: academy management, bookings, payments, communications, engagement, coaching tools, websites and AI assistance
Duration The life of the Academy's account, and afterwards as described in section 5.8
Nature Collection, recording, organisation, storage, retrieval, use, disclosure by transmission, restriction and erasure
Purposes Running the Academy's activities, including members and families, classes and sessions, bookings and payments, attendance, coaching and progress, safety information, communications, the Academy's website and enquiries, and staff tools
Data subjects Children taking part; parents, guardians and family members; the Academy's owners, managers and coaches; enquirers; visitors to the Academy's website
Categories of personal data Identity and contact details; children's age and school information; family relationships and emergency contacts; bookings, orders and payment records (no full card numbers); attendance, participation and progress records; communications and content, including photos and videos; consents and policy acceptances; account, device and activity information; enquiry details; website visitor activity (with consent); information about the use of AI features
Special category data Children's health and safety information, collected with explicit consent; other special category data where the Academy or its users enter it
Criminal offence data None

Annex 2 — Security measures

AcademyApp applies technical and organisational measures appropriate to the risk, as Article 32 of the UK GDPR requires, taking into account the nature of the data — including children's information and health information — and keeps them under regular review. They include:

  • Confidentiality. Personal data is encrypted in transit and at rest. Access is limited by role and to what each person needs, and each academy's data is logically separated from every other academy's. Everyone at AcademyApp and its sub-processors who can access personal data is bound by confidentiality.
  • Integrity. Access and changes are authenticated, and significant actions are logged.
  • Availability and resilience. The service runs on established hosting providers, and data is backed up regularly so that it can be restored in a timely manner after an incident.
  • Children's and health information. Additional protections apply, including stricter access controls.
  • Payments. Card details are handled by the payment provider and do not reach AcademyApp.
  • Testing and review. The measures are tested, assessed and improved regularly, and security updates are applied.
  • Incidents. AcademyApp notifies the Academy without undue delay after becoming aware of a personal data breach affecting its data, and helps it meet its own obligations.

AcademyApp may provide further information about its security measures under confidentiality where reasonably required.

Annex 3 — Sub-processors

AcademyApp's sub-processor list is published at https://academyapp.co.uk/sub-processors. Changes are notified under section 5.3.