# Terms and school data processing agreement

Document version: 2026-10-26-claude-beta
Operator: Karl Todd, trading as Tumble | tumble.tools@gmail.com

## 1. Service and parties

Karl Todd, trading as Tumble, provides tumble.tools for adults preparing and presenting teaching resources. Contact [tumble.tools@gmail.com](mailto:tumble.tools@gmail.com) for enquiries. Keep account credentials private and use a school-approved device and process. Pupils must not create accounts or use the AI independently. A supervised classroom display is controlled by the teacher.

These terms describe the available service. School adoption is not currently approved: supplier agreements, registration, security/deployment evidence and independent document review remain pending. The school agreement below takes effect only when an authorised school representative and Karl accept a completed adoption record, with the exact document version and an effective date, after those gates are resolved. An individual sign-in, completed request or downloaded document is not school acceptance.

## 2. Appropriate use and content

Use only content you are entitled to use. **Do not send any pupil personal data to Tumble's servers or AI**, including names, images, individual attainment, health/SEND information or identifiable examples. The restriction continues after school adoption. Do not upload unlawful content, interfere with security or use the service to make decisions about individual children. Previously downloaded pupil reports must not be fed into cloud or AI features.

You retain your rights in your teaching content and grant only the permissions needed to store, display, process and export it as you request. If you publish or share work, you are responsible for permissions and recipients. Public resource removal uses the catalogue/contact process. Deleting an account removes author attribution but does not automatically withdraw published teaching material or copies already downloaded. Third-party image licences and credits continue to apply.

## Testing feedback

Designated adult testers are informed before automatic feedback copying to the private GitHub repository is enabled for their new submissions. Use generic testing examples and do not submit personal information about yourself or anyone else. Ratings, comments, context and included item setup can be copied as described in the [privacy notice](/privacy). GitHub Free has no agreed DPA for this arrangement; supplier and transfer risks remain unresolved. The testing policy does not waive rights, establish legal compliance, accept a school agreement or authorise pupil-data processing.

## 3. AI, availability and ending use

Review AI text and pictures for accuracy, suitability, bias, copyright and safeguarding before teaching. Generated content can be wrong or incomplete; it does not replace professional judgement. The [AI statement](/trust/ai) explains the provider and limits. Save/export work you need; availability and recovery are subject to the service's documented limits. We may suspend access for a security threat or serious misuse, giving reasons and a route to contact us where lawful and practicable. You can stop using the service and use Account export/erasure. We do not exclude liability or statutory rights that cannot lawfully be excluded.

## 4. Article 28 processor schedule — scope and instructions

This schedule forms part of an accepted school agreement. The controller is the school, trust or other legal entity named in the adoption record; the processor is Karl Todd. The school specifies its authorised contacts, users, instructions and lawful basis, informs affected people and is responsible for the lawfulness and accuracy of information it instructs us to handle. The school retains all controller rights and obligations.

**Subject and duration:** providing the agreed teacher service for the term in the adoption record, including return/deletion and lawful residual retention after termination. **Purpose and nature:** receive, organise, store, retrieve, display, transmit on instruction, secure, export and erase teaching work and associated service records. Ordinary teaching content should contain no pupil data. Permitted school personal data is limited to staff names, work contact details, account identifiers and incidental staff references needed for the service. If prohibited information accidentally arrives, the instruction is to restrict access, notify the school and arrange removal; not to analyse, repurpose or train on it. Potential affected people include staff and, only in such an incident, pupils/parents or others mentioned. Special-category or criminal-offence data is not an authorised routine input.

We process school personal data only on documented school instructions, including transfers, unless UK law requires otherwise. In that case we inform the school before processing unless legally prohibited. We immediately tell the school if an instruction appears to infringe data protection law and pause the affected processing while it is resolved. We do not use school personal data for advertising, our own model training, profiling or other independent purposes. Separate controller processing for teacher account administration is explained in the privacy notice, not silently added to this schedule.

## 5. Confidentiality and security

People authorised to handle school data must be bound by confidentiality and have access only as necessary for their role. Before acceptance, the agreed security annex records the deployed measures and evidence: authenticated access, owner access policies, private file delivery, encrypted transport, restricted privileged credentials, data minimisation, deletion procedures, incident response and tested backup/recovery arrangements. We maintain measures appropriate to risk under Article 32 and periodically review their effectiveness. Unverified backup, MFA, audit or certification claims must not be entered as completed controls. Changes must not materially reduce the agreed protection.

## 6. Subprocessors and transfers

The school gives general written authorisation only for the subprocessors and purposes in the supplier annex attached to its accepted record. We use written contracts imposing equivalent relevant data protection obligations and remain responsible to the school for our subprocessors' performance. The public supplier register is disclosure, not evidence that all contracts are already executed.

We give the school's recorded privacy contact at least 30 days' advance notice of a proposed addition or replacement, its purpose, locations, safeguards and effective date. The school can object on data protection grounds during that period. We discuss a suitable alternative, suspend the affected processing, or allow termination and return/deletion of affected data before introducing the disputed supplier. A website edit or silence after an undelivered email is not authorisation. If an urgent security or legal change cannot wait, we first seek specific written authorisation or suspend the affected service.

We make restricted international transfers only on the school's documented instructions with an applicable UK transfer mechanism and assessment, recorded in the annex. Regional hosting alone is insufficient. We supply relevant safeguards information to the school and do not substitute an unapproved provider or region.

## 7. Assistance, incidents and reviews

Taking account of the processing and information available, we assist the school with individual rights requests and its obligations concerning security, breaches, DPIAs and prior consultation under Articles 32–36. We promptly forward school-data requests and do not independently answer or disclose school records without instruction unless law requires it.

We notify the school's designated contact of a personal data breach **without undue delay** after becoming aware, with an operational aim of an initial notice within 24 hours. That aim does not permit avoidable delay. We share known facts, affected categories/approximate numbers where known, likely consequences, mitigation and a contact, with timely follow-up as information emerges. We preserve relevant evidence and support the school's decisions about regulators and affected people; we do not assume its reporting decision.

We make information needed to demonstrate compliance available and allow and contribute to audits and inspections by the school or its mandated auditor. Coordinate routine access reasonably to protect others' data and service security; that does not remove statutory or urgent audit rights. Independent assurance reports can assist but do not replace those rights.

## 8. Return, deletion and termination

At the school's choice we return or delete school personal data when services end and delete remaining copies unless UK law requires retention. Account export and erasure support this process; manual assistance covers agreed school records and published content. Agree the return format and completion date on termination. We confirm completion and identify any lawful residual category, purpose, access restriction and expiry. Supplier backups must expire under the verified annex, remain inaccessible for ordinary use and have deletions reapplied before a restoration is reopened. Unknown backup periods cannot be presented as agreed.

Downloaded files and recipients' independent copies are controlled by their holders; we assist with information about disclosures but cannot recall those copies. Duties of confidentiality, restricted residual processing and deletion survive termination.

## 9. Adoption record and changes

The signed record attaches this full version, the supplier/security/retention annexes, school legal name and address, controller privacy contact, authorised representative and teacher accounts, effective date and any agreed instructions. Karl's acceptance confirms the readiness evidence; no form can bypass it. Request a record through [School adoption](/trust/school). The parties retain a copy. A conflicting service term does not override this processor schedule, and nothing restricts data subjects' rights or the regulator's powers. Material contractual changes require notice and any necessary written agreement.

This schedule is prepared for review against [Article 28](https://www.legislation.gov.uk/eur/2016/679/article/28) and the [ICO contract guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/). Independent DPO/legal review remains a school launch requirement.