Data Processing Agreement

1. Purpose

School Fundraising Company provides fundraising services to schools and other organisations, including services involving children’s artwork.

As part of providing these services, we may receive children’s artwork from the Controller, scan or otherwise digitise that artwork, store and process the resulting digital images, and use the artwork and associated information to provide the products and services requested by the Controller.

Where Printrush Limited processes Personal Data on behalf of the Controller, the Controller acts as the Data Controller and Printrush Limited acts as the Data Processor.

This DPA sets out the terms under which we process that Personal Data and is intended to satisfy the requirements of Article 28 of the UK GDPR.

2. Definitions

For the purposes of this DPA:

• “Controller” means the school, academy, trust, PTA, charity or other organisation which determines the purposes and means of the Processing of Personal Data.
• “Data Protection Laws” means applicable UK legislation relating to privacy and Personal Data, including the UK GDPR and Data Protection Act 2018, together with legislation which amends, replaces or supplements them.
• “Data Subject” means an identified or identifiable individual to whom Personal Data relates.
• “Personal Data” means information relating to an identified or identifiable individual.
• “Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Personal Data.
• “Processing”, “Process” and “Processed” have the meanings given to them under applicable Data Protection Laws.
• “Processor” means an organisation which processes Personal Data on behalf of a Controller.
• “Services” means the fundraising, artwork scanning, digitisation, production, order fulfilment and related services provided by Printrush Limited under the School Fundraising Company trading name.
• “Sub-processor” means another processor engaged by Printrush Limited to process Personal Data on behalf of the Controller.
• “UK GDPR” means the United Kingdom General Data Protection Regulation as incorporated into UK law and amended from time to time.

3. Processing of Children’s Artwork

3.1 As part of the Services, the Controller may provide Printrush Limited with artwork created by children.

3.2 Printrush Limited may:

• (a) receive and handle the original artwork;
• (b) scan, photograph or otherwise digitise the artwork;
• (c) create digital image files of the artwork;
• (d) associate the artwork with identifiers reasonably necessary to provide the Services;
• (e) store the digitised artwork;
• (f) reproduce the artwork for the purpose of producing fundraising products;
• (g) make the artwork available through systems used to administer the fundraising service, where applicable;
• (h) use the artwork to fulfil orders;
• (i) provide relevant artwork or associated information to authorised Sub-processors where necessary to provide the Services; and
• (j) delete the digitised artwork and associated Personal Data in accordance with applicable retention arrangements.

3.3 Where artwork or associated information identifies or can reasonably be linked to an individual child, it will be treated as Personal Data.

3.4 Printrush Limited will process such Personal Data only for the purpose of providing the Services and in accordance with the Controller’s documented instructions, except where otherwise required by law.

3.5 Printrush Limited will not sell children’s Personal Data or use children’s artwork or associated Personal Data for unrelated advertising, profiling or marketing purposes.

4. Details of the Processing

Subject matter

Processing children’s artwork and associated information in order to provide school fundraising, artwork scanning, digitisation, production, ordering and fulfilment services.

Nature of the Processing

Processing may include:

• receiving physical children’s artwork;
• handling and organising artwork;
• scanning or otherwise digitising artwork;
• creating digital image files;
• storing digital artwork;
• associating artwork with identifiers necessary to administer the service;
• retrieving and displaying artwork where required for the service;
• reproducing artwork on products;
• processing orders;
• fulfilling and dispatching products;
• providing customer support;
• backing up relevant systems; and
• deleting Personal Data when no longer required.

Purpose

To operate the School Fundraising Company service and enable schools and other participating organisations to raise funds through products produced using children’s artwork.

Duration

For the period necessary to provide the Services and thereafter for the applicable retention period.

5. Categories of Data Subjects

Personal Data processed through the Services may relate to:

• children and pupils whose artwork is submitted;
• parents and guardians;
• teachers;
• school employees;
• school administrators;
• PTA representatives;
• fundraising organisers; and
• customers purchasing fundraising products.

6. Categories of Personal Data

Depending upon how the Controller uses the Services, Personal Data may include:

• children’s artwork;
• digital scans or images of children’s artwork;
• child’s name or other identifier where supplied;
• school name;
• class or year-group information where supplied;
• reference or artwork identification numbers;
• parent or guardian information where required for the Services;
• teacher or school contact information;
• customer contact information;
• order information;
• delivery information;
• correspondence relating to orders or the Services; and
• other Personal Data reasonably necessary to administer and fulfil the Services.

The Services are not intended to require Special Category Personal Data.

The Controller must not intentionally include Special Category Personal Data within information or artwork supplied to Printrush Limited unless this has been expressly agreed in writing and an appropriate lawful basis and safeguards have been established.

7. Responsibilities of the Controller

The Controller is responsible for:

• (a) ensuring it has an appropriate lawful basis for collecting and providing Personal Data to Printrush Limited;
• (b) ensuring that children, parents or guardians receive appropriate privacy information where required;
• (c) ensuring that the submission of children’s artwork and associated information to Printrush Limited complies with applicable Data Protection Laws;
• (d) providing only Personal Data reasonably necessary for the Services;
• (e) ensuring its instructions to Printrush Limited comply with applicable Data Protection Laws; and
• (f) informing Printrush Limited of relevant restrictions relating to Personal Data supplied for Processing.

The Controller determines the purposes for which Personal Data is processed and remains responsible for the lawfulness of its instructions.

8. Obligations of Printrush Limited

Printrush Limited will:

• (a) process Personal Data only on documented instructions from the Controller unless otherwise required by applicable law;
• (b) inform the Controller if, in our reasonable opinion, an instruction infringes applicable Data Protection Laws;
• (c) ensure that people authorised to process Personal Data are subject to appropriate confidentiality obligations;
• (d) implement appropriate technical and organisational security measures;
• (e) assist the Controller with relevant Data Subject requests;
• (f) assist the Controller with its applicable security, breach notification and Data Protection Impact Assessment obligations;
• (g) maintain appropriate records where required by law; and
• (h) make information reasonably necessary to demonstrate compliance with applicable Processor obligations available to the Controller.

The Agreement, orders submitted by the Controller, this DPA and other written instructions agreed between the Parties constitute the Controller’s documented instructions.

9. Security

Printrush Limited will implement and maintain appropriate technical and organisational measures having regard to the nature of the Processing and the particular importance of protecting children’s Personal Data.

Measures may include, where appropriate:

• access controls;
• authentication and password controls;
• limiting access to authorised personnel;
• confidentiality obligations;
• appropriate computer and network security;
• malware protection;
• security updates;
• secure storage;
• appropriate backup and recovery arrangements;
• appropriate controls for transmitting Personal Data;
• physical security;
• staff data-protection procedures;
• security incident procedures; and
• periodic review of relevant security measures.

Access to digitised children’s artwork and associated Personal Data will be limited to persons who reasonably require access for the provision, administration, support or security of the Services.

10. Sub-processors

The Controller gives Printrush Limited general authorisation to engage Sub-processors where reasonably necessary to provide the Services.

Sub-processors may include providers of:

• website and application hosting;
• cloud storage;
• IT infrastructure;
• email and communications;
• payment processing;
• printing and product production;
• order-management services;
• delivery and courier services; and
• technical support.

Where a Sub-processor processes Personal Data on behalf of the Controller, Printrush Limited will enter into appropriate contractual arrangements requiring the Sub-processor to protect the Personal Data in accordance with applicable Data Protection Laws.

Printrush Limited will remain responsible to the Controller for the performance of its Sub-processors’ applicable data-protection obligations.

Information regarding material Sub-processors will be made available to the Controller on reasonable request or through a Sub-processor list published by Printrush Limited.

Where required by applicable Data Protection Laws, the Controller will be given a reasonable opportunity to object to material changes to Sub-processors on legitimate data-protection grounds.

11. International Transfers

Printrush Limited will ensure that Personal Data processed on behalf of the Controller is not transferred outside the United Kingdom unless the transfer complies with applicable Data Protection Laws.

Where required, appropriate safeguards will be used, which may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved Standard Contractual Clauses; or
• another legally recognised transfer mechanism.

12. Data Subject Rights

Taking into account the nature of the Processing, Printrush Limited will provide reasonable assistance to enable the Controller to respond to requests from individuals exercising their rights under Data Protection Laws.

If Printrush Limited receives a request directly from a Data Subject relating to Personal Data processed on behalf of the Controller, we will, where appropriate:

• (a) notify the Controller without undue delay; and
• (b) not respond substantively except on the Controller’s instructions or where required by law.

13. Personal Data Breaches

Printrush Limited will notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Controller.

Where reasonably available, the notification will include:

• (a) the nature of the breach;
• (b) the categories of Personal Data and Data Subjects affected;
• (c) the approximate number of individuals and records affected, where reasonably possible;
• (d) the likely consequences of the breach;
• (e) measures taken or proposed to address the breach; and
• (f) measures taken or proposed to mitigate possible adverse effects.

Where information cannot be provided at the same time, it may be provided in phases without undue further delay.

14. Deletion and Return of Personal Data

On completion or termination of the Services, Printrush Limited will, at the Controller’s choice where reasonably practicable, delete or return Personal Data processed on behalf of the Controller unless applicable law requires its retention.

Personal Data may remain temporarily within secure backup systems following deletion from active systems until it is removed through the applicable backup-retention cycle.

During this period, the Personal Data will remain protected and will not be used for unrelated purposes.

Where Personal Data must be retained by law, it will remain protected in accordance with this DPA.

15. Audits and Compliance

Printrush Limited will make available to the Controller information reasonably necessary to demonstrate compliance with applicable Article 28 UK GDPR obligations.

Printrush Limited will allow for and contribute to reasonable audits and inspections conducted by the Controller or an independent auditor appointed by the Controller.

Except following a Personal Data Breach or reasonably suspected material non-compliance:

• (a) reasonable advance notice must be provided;
• (b) audits should normally take place during normal business hours;
• (c) audits must not unreasonably disrupt Printrush Limited’s operations;
• (d) appropriate confidentiality obligations must apply; and
• (e) an audit must not compromise information belonging to another customer or the security of Printrush Limited’s systems.

16. Confidentiality

Personal Data processed under this DPA will be treated as confidential.

Printrush Limited will ensure that personnel authorised to access children’s artwork or other Personal Data:

• (a) access it only where reasonably necessary;
• (b) understand its confidential nature; and
• (c) are subject to appropriate confidentiality obligations.

17. Liability

Each Party’s liability under this DPA will be subject to applicable limitations of liability contained in the Agreement, except where such limitation is prohibited by law.

Nothing in this DPA relieves either Party from responsibilities or liabilities imposed directly upon it under applicable Data Protection Laws.

18. Term

This DPA applies from the date on which the Controller begins using Services which involve Printrush Limited processing Personal Data on its behalf.

It continues for as long as Printrush Limited processes that Personal Data.

Obligations relating to confidentiality, security and deletion continue for as long as relevant Personal Data remains in Printrush Limited’s possession or control.

19. Changes to this DPA

Printrush Limited may update this DPA where reasonably necessary to reflect changes to:

• Data Protection Laws;
• regulatory requirements;
• the Services;
• Processing activities; or
• security and operational arrangements.

Where an amendment materially affects the Processing of Personal Data on behalf of a Controller, appropriate notice will be provided.

20. Governing Law

This DPA is governed by the laws of England and Wales.

The courts of England and Wales will have exclusive jurisdiction, subject to any mandatory jurisdiction imposed by applicable law.

Schedule 1 — Processing Summary

Schedule 2 — Technical and Organisational Measures

Printrush Limited will maintain appropriate measures which may include:

• access to children’s artwork and associated data limited to authorised personnel;
• appropriate user authentication;
• password and access-control procedures;
• confidentiality obligations for staff;
• data-protection and security awareness;
• computer, server and network security;
• malware protection and security updates;
• appropriate storage security;
• appropriate backup and recovery procedures;
• appropriate methods of transferring Personal Data;
• physical security for original artwork and relevant equipment;
• security incident and Personal Data Breach procedures;
• appropriate Sub-processor due diligence;
• appropriate retention and secure-deletion procedures; and
• periodic review of relevant security measures.

Schedule 3 — Sub-Processors

Printrush Limited may use appropriately contracted service providers to support the School Fundraising Company service.

A current list of material Sub-processors that process Personal Data on behalf of participating organisations will be maintained by Printrush Limited and made available on request or through the School Fundraising Company website.

Contact Details