Halomath for Schools — Data Processing Agreement

Version: 1 Effective date: 18 November 2026

This agreement is between the school that accepted the Halomath for Schools Terms ("the School") and HALOMATH LTD (company number 17294004, registered office 2 Washington Road, London, England, SW13 9BE) ("Halomath", "we", "us"). It is part of the Halomath for Schools Terms and applies whenever we process personal data for the School.

Words such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018, as amended from time to time, including by the Data (Use and Access) Act 2025 (together, "Data Protection Law").

1. Roles

1.1 For the personal data of pupils and staff that the School puts into Halomath for Schools, or that is created when they use it, the School is the controller and Halomath is the processor.

1.2 Annex 1 describes the processing: what we do, why, whose data and which data.

1.3 If a parent separately holds their own Halomath family account for the same child, that family account is governed by our family Terms of Service and Privacy Policy, under which Halomath is the controller. This agreement does not cover the family account. Clause 11.4 sets out what happens to such a pupil's learning history from school.

2. Processing only on the School's instructions

2.1 We process the School's personal data only on the School's documented instructions, including about transfers of personal data outside the United Kingdom. The Terms, this agreement, and the School's use of the school admin and teacher areas (for example adding pupils, marking a pupil as having left, or turning off a staff account) are the School's instructions.

2.2 If the law requires us to process the data in any other way, we will tell the School first, unless the law forbids it.

2.3 If we think an instruction breaks Data Protection Law, we will tell the School straight away.

2.4 We do not use the School's personal data for our own purposes. We do not use it for marketing, we do not sell it, and we do not build profiles of pupils or staff for any purpose other than providing the service to the School.

2.5 The School instructs us to create anonymised, aggregated statistics from practice records, which cannot identify any pupil, member of staff or school, and to use them to measure and improve the difficulty and quality of our questions. Anonymised statistics are not personal data and may be kept after this agreement ends.

3. Confidentiality

Everyone at Halomath who can access the School's personal data is bound by a duty of confidentiality and accesses it only as needed to run and support the service.

4. Security

4.1 We keep the School's personal data secure using the measures in Annex 2, and we keep them under review.

5. Sub-processors

5.1 The School agrees to the sub-processors listed in Annex 3.

5.2 We will give the School at least 30 days' notice by email before adding or replacing a sub-processor that will process the School's personal data. If the School objects on reasonable data protection grounds and we cannot resolve the objection, the School may end the agreement and we will refund the fees for the whole months remaining in the paid period.

5.3 We put a written contract in place with each sub-processor that gives the same level of protection as this agreement, and we remain responsible to the School for what our sub-processors do.

6. Where the data is kept, and transfers

6.1 The School's pupil and school records, including pupils' names, are stored in the United Kingdom (London). Sign-in accounts are processed by Google in the United States; for pupils these hold only an account ID, not their name (Annex 3).

6.2 Some sub-processors in Annex 3 process limited data in the United States. Where that happens, we rely on a safeguard approved under UK law: the UK International Data Transfer Agreement or Addendum, or the sub-processor's certification under the UK Extension to the EU–US Data Privacy Framework.

7. Artificial intelligence

7.1 We do not send personal data from the School's Halomath account to any artificial-intelligence service, and we do not use it to train any model.

7.2 If we ever want to change this, we will ask for the School's written agreement first. We will not rely on the sub-processor notice in clause 5.2 for this.

8. Helping the School with people's rights

8.1 The School can see, correct and update its pupils' and staff details in the school admin area, and mark pupils as having left.

8.2 For any other request from a pupil, parent or member of staff (for example a request for a copy of their data, or for deletion), the School can email hello@halomath.net and we will help within 10 working days.

8.3 If someone contacts us directly about data the School controls, we will pass the request to the School and not answer it ourselves, unless the School asks us to.

9. Helping the School meet its obligations

9.1 We will give the School the information it reasonably needs for a data protection impact assessment, or to consult the Information Commissioner's Office.

9.2 We will answer the School's reasonable data protection and security questionnaires.

9.3 When the School marks a pupil as having left, we keep that pupil's data for as long as this agreement continues, so the School can still see their history. The School can ask us to delete any pupil's data at any time by emailing hello@halomath.net, and we will delete it within 30 days. When the agreement ends, clause 11 applies.

10. Personal data breaches

10.1 If we become aware of a personal data breach affecting the School's personal data, we will tell the School's school admin without undue delay and in any case within 48 hours of becoming aware of it.

10.2 We will tell the School what happened, which data and roughly how many people are affected, the likely consequences, and what we have done and will do about it. If we do not know everything at first, we will send what we know and add to it as we learn more.

10.3 We will help the School with its own obligations, including any report to the Information Commissioner's Office and any communication with the people affected.

11. When the agreement ends

11.1 For 30 days after the agreement ends, the School can download its pupil list and practice summaries from the school admin area. If the School asks us by email, we will also send a full copy of its data, including every answer each pupil has given, within 10 working days. At the School's choice, we will return the data in these ways, delete it, or both.

11.2 After those 30 days we delete the School's personal data, unless the law requires us to keep it. Any backups containing it are overwritten within a further 90 days. We will email the School to confirm when deletion is complete.

11.3 Invoices and the related billing contact details are kept for six years, because UK tax law requires it.

11.4 If a pupil's parent has their own Halomath family account for the child, the School instructs us that, when this agreement ends or the School marks the pupil as having left, the pupil's learning history may stay with that family account rather than be deleted. From then on we hold it as controller under our family Terms of Service and Privacy Policy, and the School no longer has access to it. The School can instead tell us, by emailing hello@halomath.net, to delete the learning history created through the School, and we will do so within 30 days.

12. Information and audits

12.1 We will make available to the School the information reasonably needed to show that we meet this agreement, including a description of our security measures and our list of sub-processors.

12.2 If that information is not enough, the School (or an auditor it appoints who is bound by confidentiality) may audit our compliance with this agreement, with at least 30 days' notice, no more than once a year, at the School's own cost.

13. Liability

Each party's liability under this agreement is subject to clause 11 of the Halomath for Schools Terms.

Annex 1 — Details of the processing

Subject matter and duration. Providing Halomath for Schools to the School, for as long as the agreement lasts and the 30-day export period afterwards (clause 11).

Nature and purpose. Storing, organising, displaying and deleting personal data so that pupils can practise Mental Maths, staff can see how each pupil is getting on and set practice, and the School can manage its classes, staff, pupils and subscription.

People whose data is processed.

• Pupils at the School who are added to Halomath.
• Members of staff who are given a Halomath account, and the School's finance contact.

Personal data.

• Pupils: first name, surname, preferred name if given, gender if the School provides it, year group, class, an optional pupil number from the School's management information system, whether the pupil is on roll or has left, when their login card was issued and printed, and their practice records (questions answered, answers given, time taken, and accuracy on each learning objective).
• Staff: first name, surname, school email address, role (school admin or teacher), the classes they teach, and records of changes they make in the school admin area. For the person who opened a free trial, the job role they chose (for example "Teacher").
• Billing: the finance contact's email address, the School's billing address and any purchase order number.

Not processed. Special category data. Pupils' dates of birth, home addresses, photographs, voice recordings or contact details.

Annex 2 — Security measures

• All data is encrypted in transit (HTTPS) and at rest.
• School and pupil records are written only by our server code, which checks on every request who is signed in and what their role allows. No browser can write to the database or read anyone else's records, and school, class and staff records can be read only by our server code.
• Teachers see only the classes they teach. School admins see only their own school.
• Pupils sign in with a login card. We store only a one-way hash of each card's code, never the code itself. Repeated wrong codes are temporarily blocked.
• Staff set their own password through a single-use link that expires after seven days. Sign-in sessions use secure, HTTP-only cookies.
• Every change to the School's classes, staff and pupils is recorded with who made it and when, and the School can see this record.
• Access by Halomath staff is limited to the people who run and support the service.

Annex 3 — Sub-processors