Data Processing Agreement

1. Parties and roles

The School is the data controller of personal data processed through the Services. AlonyoCloud is the data processor acting on the School's documented instructions.

Where AlonyoCloud processes personal data for its own purposes (for example, to bill the School or to comply with tax law), AlonyoCloud acts as a controller and its privacy obligations are set out in the Privacy Policy.

This DPA applies to all personal data that the School enters into, uploads to, or asks AlonyoCloud to process through the Services.

2. Definitions

Capitalized terms not otherwise defined here have the meanings given in the Terms of Service, the Privacy Policy, or the GDPR. In case of conflict between this DPA and the Terms, this DPA prevails with respect to data protection.

• "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation) and any equivalent UK legislation (UK GDPR).
• "Data Protection Law" means GDPR, Uganda's Data Protection and Privacy Act 2019, the UK Data Protection Act 2018, CCPA/CPRA, and any other applicable data protection legislation.
• "Personal Data" means any information relating to an identified or identifiable natural person processed by AlonyoCloud on behalf of the School.
• "Student Data" means Personal Data concerning a student enrolled at the School.
• "Processing" has the meaning given in GDPR Article 4(2) — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Sub-processor" means any third party engaged by AlonyoCloud to process Personal Data on its behalf.
• "Standard Contractual Clauses" or "SCCs" means the European Commission's Standard Contractual Clauses approved by Decision 2021/914.
• "Supervisory Authority" means the data protection authority in the relevant jurisdiction — including the Personal Data Protection Office (Uganda), the ICO (UK), and the relevant national DPA (EU).

3. Scope and purpose of processing

Subject matter: provision of the AlonyoCloud Services — the school management platform, managed website hosting, and AI tools as purchased by the School.

Duration: for the term of the School's subscription plus the retention period specified in the Privacy Policy and this DPA.

Nature: collection, storage, retrieval, use, disclosure to Sub-processors, backup, and deletion — all in accordance with the School's documented instructions.

Purpose: to provide the Services to the School and its Authorized Users.

Categories of data subjects: students, parents/guardians, teachers, staff, and other Authorized Users of the School.

Categories of Personal Data: name, contact details, date of birth, gender, student ID, class/grade, attendance, grades, fee and payment records, staff employment data, and any other data the School chooses to enter — as further described in Annex 1.

4. Obligations of the School (Controller)

The School represents and warrants that:

• It has a lawful basis for the processing of Personal Data (including Student Data) and has provided any required notices to data subjects.
• It has obtained all necessary parental or guardian consents for students whose data is entered into the Services, as required by COPPA, GDPR-K, or other applicable law.
• Its instructions to AlonyoCloud comply with Data Protection Law.
• It will not instruct AlonyoCloud to process Personal Data in any way that violates Data Protection Law.
• It will keep its access credentials secure and limit access to Authorized Users who need it for their role.
• It will notify AlonyoCloud promptly if it becomes aware of any issue affecting the lawfulness of processing.

5. Obligations of AlonyoCloud (Processor)

AlonyoCloud shall:

• (a) Process Personal Data only on the documented instructions of the School, unless required to do so by law (in which case it shall inform the School unless legally prohibited).
• (b) Ensure that personnel authorized to process Personal Data are bound by confidentiality obligations.
• (c) Implement appropriate technical and organizational security measures — described in Annex 2 — to protect Personal Data against accidental or unlawful destruction, loss, alteration, or disclosure.
• (d) Assist the School in responding to data subject rights requests (access, correction, deletion, portability, objection) as described in Section 7.
• (e) Assist the School in ensuring compliance with GDPR Articles 32–36 (security, breach notification, data protection impact assessments, prior consultation) — taking into account the nature of the processing.
• (f) Notify the School without undue delay upon becoming aware of a personal data breach, as described in Section 9.
• (g) At the School's choice, delete or return all Personal Data at the end of the provision of the Services, as described in Section 10.
• (h) Make available all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits as described in Section 11.
• (i) Not engage a new Sub-processor without the School's prior authorization, as described in Section 6.
• (j) Not transfer Personal Data to a country outside the EEA/UK without appropriate safeguards, as described in Section 8.

6. Sub-processors

The School provides general written authorization for AlonyoCloud to engage Sub-processors to assist in providing the Services. A current list of Sub-processors is set out in Annex 3 and maintained at https://alonyocloud.com/dpa/annex-3.

AlonyoCloud shall:

• Impose on each Sub-processor data protection obligations equivalent to those in this DPA, by written contract.
• Remain fully liable to the School for the performance of each Sub-processor's obligations.
• Notify the School at least 30 days before adding or replacing any Sub-processor.
• Allow the School to object to a new Sub-processor within 30 days. If the School objects on reasonable data protection grounds, AlonyoCloud will work in good faith to find an alternative, or the School may terminate the affected Services without penalty.

7. Assistance with data subject rights

Taking into account the nature of the processing, AlonyoCloud shall assist the School by appropriate technical and organizational measures — insofar as possible — in fulfilling the School's obligation to respond to requests from data subjects (including parents, guardians, and students) exercising their rights under Data Protection Law.

If AlonyoCloud receives a request directly from a data subject relating to Personal Data processed on behalf of the School, AlonyoCloud shall:

• Not respond to the request directly, unless legally required or authorized by the School.
• Forward the request to the School without undue delay.
• Provide reasonable assistance to the School in responding to the request.

8. International transfers

Where AlonyoCloud transfers Personal Data outside the European Economic Area, the United Kingdom, or any other jurisdiction with restrictions on international transfers (including Uganda), it shall ensure that such transfers are subject to appropriate safeguards as required by Chapter V of the GDPR.

The following transfer mechanisms apply:

• Transfers to Sub-processors in the United States are governed by the 2021 Standard Contractual Clauses (Module 2: Controller to Processor), incorporated by reference into this DPA.
• Where the School is in the UK, the UK International Data Transfer Addendum (IDTA) or the UK Addendum to the SCCs applies.
• Transfers to countries covered by an EU adequacy decision rely on that decision.
• The technical and organizational measures described in Annex 2 serve as supplementary measures to ensure an essentially equivalent level of protection.

9. Personal data breach notification

AlonyoCloud shall notify the School without undue delay — and in any event within 48 hours — after becoming aware of a personal data breach affecting Personal Data processed on behalf of the School.

The notification shall include, to the extent available at the time:

• A description of the nature of the breach, including categories and approximate number of data subjects and records concerned.
• The name and contact details of the AlonyoCloud point of contact from whom more information can be obtained.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach and mitigate its effects.

10. Return and deletion of data

On termination or expiry of the Services, the School may export all Personal Data through the Services for 30 days. After that period, AlonyoCloud shall delete all Personal Data, including backups, unless retention is required by law.

If the School requests earlier deletion, AlonyoCloud shall comply within 30 days of the written request.

11. Audits and compliance

AlonyoCloud shall make available all information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits — including inspections — conducted by the School or by an auditor mandated by the School.

To balance audit rights with the security of other customers:

• Audits shall be conducted no more than once per 12-month period, unless required by a Supervisory Authority following a specific incident.
• The School shall give at least 30 days' written notice.
• The School shall bear the cost of the audit.
• The auditor shall sign a confidentiality agreement.
• The audit shall not compromise the security or confidentiality of other schools' data.

12. Liability

Each party's liability under or in connection with this DPA is subject to the limitations of liability set out in the Terms of Service, except as otherwise required by Data Protection Law.

Where Data Protection Law imposes liability that cannot be limited or excluded, that statutory liability applies notwithstanding the Terms.

13. Duration

This DPA enters into force when the School accepts the Terms of Service and remains in effect for as long as AlonyoCloud processes Personal Data on behalf of the School.

Sections 9 (Breach notification), 10 (Return and deletion), 11 (Audits), and 12 (Liability) survive termination to the extent necessary to give them effect.

14. Order of precedence

In the event of a conflict between this DPA and the Terms of Service, this DPA prevails with respect to data protection. In the event of a conflict between this DPA and the Standard Contractual Clauses, the SCCs prevail.

15. Governing law and jurisdiction

This DPA is governed by the laws of the Republic of Uganda, without regard to its conflict-of-law principles. For schools in the EEA, the law of an EU Member State shall apply in accordance with the SCCs.

16. Annexes

The following annexes form part of this DPA:

• Annex 1 — Details of processing (subject matter, duration, nature, purpose, data categories, data subjects).
• Annex 2 — Technical and organizational security measures.
• Annex 3 — Authorized Sub-processors.

17. Contact

For DPA questions or to request a signed copy:

• Legal: [email protected]
• Privacy: [email protected]
• Mail: Kampala, Uganda (full address to be published upon completion of registration)