Skip to main content

Draft — pending legal review. This document is a template. It has not yet been reviewed by a UK-qualified solicitor. Do not rely on it for binding agreements until the final version is published.

← Nine Pebbles

Data Processing Agreement

Last updated: 1 November 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Nine Pebbles (“Nine Pebbles”, “we”) and the organisation that uses Nine Pebbles to run its tuition centre, nursery or club (“the Customer”, “you”). It applies whenever we process personal data on your behalf, and meets the requirements of Article 28 of the UK GDPR.

1. Roles

You are the controller of the personal data you put into Nine Pebbles about your children, families and staff. We are your processor. For our own account data (for example your billing contact), we are a controller under our Privacy Policy.

2. What we process

  • Subject matter and purpose: providing the Service you subscribe to: records, attendance, billing, payments, communications, compliance, reporting and the integrations you choose to switch on.
  • Duration: for as long as your subscription runs, then as set out in section 9.
  • Data subjects: children and young people in your care, their parents, guardians and authorised contacts, your staff and contractors, and enquirers.
  • Types of data: names and contact details; dates of birth and year groups; attendance, lesson, progress and assessment records; invoices and payment records; messages; photos and files you upload; staff employment, training and HR records.
  • Special category and sensitive data, where you record it: health, allergy, medication and dietary information; special educational needs; safeguarding concerns and incidents.

3. Your instructions

We process personal data only on your documented instructions. These are the Terms, this DPA, and how you configure and use the Service. That includes which integrations you connect and which messages you send. If we believe an instruction breaks data protection law we will tell you. If the law requires us to process data in another way, we will tell you first unless the law forbids it.

4. Confidentiality and security

Everyone at Nine Pebbles who can access your data is bound by confidentiality, and access is limited to what their role needs. Our support staff sign in to your account only with your approval, and this is logged. We keep appropriate technical and organisational measures in place, as described on our Security page. These include:

  • separating each customer’s data at database level (row-level security);
  • encryption in transit and at rest;
  • encrypting stored credentials for connected services;
  • two-factor sign-in for privileged roles;
  • audit logs.

5. Sub-processors

You authorise us to use the sub-processors listed on our sub-processors page. Each is bound by written terms that protect your data to the same standard as this DPA, and we remain responsible for them. We will email your account admins at least 30 days before adding a new sub-processor or changing an existing one’s scope. If you object on reasonable data protection grounds and we can’t accommodate the objection, either of us may end the contract on reasonable notice.

Services you connect yourself are not our sub-processors: for example Xero, QuickBooks, Mailchimp, Zapier, Zoom, Microsoft Teams, Google Calendar, or your own Stripe, GoCardless or Square account, or your own Twilio account for WhatsApp. (Text messages, and WhatsApp numbers we provide, go through our Twilio account, which is a sub-processor.) We send data to them because you instruct us to, under your own agreement with that provider.

6. Helping you meet your obligations

Taking into account the nature of the processing, we will help you:

  • respond to requests from people exercising their rights. The Service includes data export, subject access and erasure tools;
  • carry out data protection impact assessments and consult the ICO where needed;
  • meet your security and breach-notification obligations.

7. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay. We will give you the information you need to assess it so that you can, where required, report it to the ICO within 72 hours and tell the people affected. We will take reasonable steps to contain the breach and reduce its effects.

8. International transfers

Your database is hosted in London (UK). Where a sub-processor processes personal data outside the UK, we make sure there is a lawful transfer mechanism. That means UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

9. When your subscription ends

You can export your data at any time from the Service, and we will help you export it when your subscription ends. After it ends, close your account from the Service or ask us in writing, and we will delete your personal data from our live systems within 90 days of that request, unless the law requires us to keep it. Copies in backups are kept for up to 12 months before they are purged, as set out in section 4.3 of the Terms.

10. Audits

We will make available the information you reasonably need to show compliance with Article 28. This includes our security documentation, and summaries of independent security assessments once we have them. On reasonable notice, we will allow audits by you or an auditor you appoint who is bound by confidentiality. These are at your cost and no more than once a year, unless a breach or the ICO requires otherwise.

11. Liability and precedence

Liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict on the processing of personal data, this DPA takes precedence.

Contact

Questions about this DPA, or about how we process your data: [email protected].