UK Data Processing Addendum

3 October 2026

Dokumentu hau ez dago oraindik itzulita: ingelesa bertsioa erakusten da, eta hori da indarrean dagoena.

UK Data Processing Addendum — Schools in the United Kingdom

Version: 1.1
Last updated: October 2026

This Addendum applies when a school in the United Kingdom uses Kluppy under the Terms of Service for Schools, including during a free trial. It supplements Kluppy's Data Processing Agreement (the "DPA") and adapts it to UK data protection law. As regards personal data subject to UK data protection law, this Addendum prevails over the DPA.

1. Parties and structure

The School is the controller and KLUPPY, S.L. ("Kluppy") is the processor of the personal data of the School's students, teachers and administrators processed to provide the Service ("School Personal Data").

The DPA applies to School Personal Data with the changes set out in this Addendum. Capitalised terms not defined here have the meaning given in the Terms of Service for Schools. Schedule 1 of those Terms, which describes each feature and the personal data it uses, forms part of this Addendum.

2. Applicable law

References to UK data protection law are to the UK GDPR and the Data Protection Act 2018, as amended from time to time, including by the Data (Use and Access) Act 2025. For School Personal Data:

• references in the DPA to the GDPR include the UK GDPR and the Data Protection Act 2018;
• references to the supervisory authority include the Information Commissioner's Office (ICO);
• references to Union or Member State law include the law of the United Kingdom or of a part of it;
• references in clause 12 of the DPA to Article 22 of the GDPR are read, for UK law, as references to Articles 22A to 22D of the UK GDPR;
• the provisions of the DPA that implement only Spanish law (including those on Spanish rules for minors) do not apply. Governing law and jurisdiction are those of the Terms of Service for Schools.

Kluppy is established in Spain. This Addendum does not disapply any obligation under EU data protection law that applies to Kluppy independently.

3. Description of the processing

• Subject matter and duration: provision of the Service during the Subscription Period, including any free trial, and until the School Personal Data is returned or deleted under clause 8.
• Nature and purpose: hosting and operating a typing-learning platform for the School; calculating performance metrics; adapting difficulty; the features described in Schedule 1; producing progress reports and, where the School activates them, evidence reports; technical support.
• Categories of data subjects: students (including children) and the School's teaching and administrative staff.
• Categories of personal data: those listed in Schedule 1: full name, alias or username, email address (where the School provides one), School and groups, typing progress data (speed, accuracy, timings, the letters a student finds difficult), levels and achievements, game results, technical usage data and, where the School activates the assessment module, the period aggregates of the evidence reports and teacher observations. Kluppy does not process students' age or date of birth.
• Special categories of personal data: not processed. The School will not enter them in the Service, including in free-text fields. If they are entered, Kluppy will delete them on the School's instruction without undue delay.

4. Kluppy's obligations

Kluppy shall:

1. process School Personal Data only on the School's documented instructions, which are the Terms of Service for Schools, this Addendum, the DPA and the School's configuration of the Service, and tell the School if, in its opinion, an instruction infringes UK data protection law;
2. ensure that the persons authorised to process School Personal Data are bound by confidentiality;
3. apply the security measures described in Annex II of the DPA;
4. use sub-processors only as set out in clause 6;
5. assist the School, taking into account the nature of the processing, in responding to requests from data subjects to exercise their rights, including through the tools of the administration panel;
6. assist the School in ensuring compliance with its obligations on security, personal data breaches, data protection impact assessments and prior consultation with the ICO;
7. return or delete School Personal Data under clause 8;
8. make available to the School the information necessary to demonstrate compliance with Article 28 of the UK GDPR and allow for and contribute to audits, under clause 8 of the DPA, including where the School has reasonable grounds to suspect a breach of this Addendum.

Kluppy does not use School Personal Data for its own purposes. In particular, School Accounts are never converted into personal accounts (clause 8).

5. Personal data breaches

Kluppy shall notify the School without undue delay after becoming aware of a personal data breach affecting School Personal Data and, in any case, shall send an initial notice within 48 hours, or sooner where the law requires. The initial notice is not delayed until the investigation is complete. It will include the information available at that time: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Kluppy shall send updates as further information becomes available.

The School decides whether to notify the ICO and data subjects. Kluppy will not notify them on the School's behalf unless the School instructs it or the law requires it.

6. Sub-processors

The School gives Kluppy a general written authorisation to engage the sub-processors listed in Schedule 1 of the Terms of Service for Schools and in Annex III of the DPA. Kluppy shall:

• impose on each sub-processor, in writing, data protection obligations equivalent to those of this Addendum;
• remain liable to the School for its sub-processors' performance;
• inform the School of any intended addition or replacement at least 30 days in advance, so that the School may object on reasonable data protection grounds. If it objects, clause 13.5 of the Terms of Service for Schools applies: the parties look for an alternative and, if there is none, the School may terminate the affected part of the Service before the change applies to its data.

7. International transfers

School Personal Data is stored in the European Economic Area (see clause 10 of the DPA). The United Kingdom's adequacy regulations cover transfers of personal data from the United Kingdom to the European Economic Area.

For each restricted transfer subject to UK data protection law, including access from outside the United Kingdom and the European Economic Area, Kluppy shall identify the recipient and the mechanism relied on:

• UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework only where the recipient and the data are covered by it;
• otherwise, an appropriate safeguard recognised under UK law, such as the International Data Transfer Agreement or the European Commission's standard contractual clauses supplemented by the approved UK Addendum, after completing the assessment UK data protection law requires before the transfer.

Kluppy keeps a register of recipients, services, data, countries of processing or access and mechanisms, and gives it to the School on request.

8. Return and deletion

Clause 13.6 of the Terms of Service for Schools and the Data Retention Policy apply to School Personal Data and replace clause 9 of the DPA insofar as that clause is inconsistent with them. In particular:

• a School Account is never converted into a personal account, and School Personal Data is not transferred to any consumer service. A student who wishes to continue outside the School must create a separate personal account (clause 5.3 of the Terms). Only an account that already belonged to the user before joining the School returns to its holder when the School withdraws the licence, as clause 5.2 of the Terms and clause 9.2 of the DPA describe; the School then stops seeing its data;
• the School can permanently delete a student's account and data at any time from the administration panel; the records of the assessment module, and any other School Personal Data, are deleted by Kluppy on the School's request without undue delay and within 30 days. Accounts the School creates with no licence available are created blocked and are deleted if 180 days go by without a licence;
• after a licence withdrawal, the end of a trial or the end of the Service, access is blocked and the data is kept, without being used for any other purpose, for 180 days, unless the School instructs earlier return or deletion. The period follows the school year, so that a school that returns the following year keeps its students' progress. The School may request a complete export in a structured format (JSON) at any time;
• deleted data may remain in encrypted backups for up to 7 days (point-in-time recovery) and up to 35 days (daily backups), used only to recover from incidents;
• data that the law requires Kluppy to keep, such as invoices and invoicing records, is kept only for that purpose.

9. Children's data and the Children's Code

The Service is designed for use by schools with children. Kluppy:

• collects only the data needed to provide the Service and does not process students' age, date of birth or special categories of data;
• does not show advertising, sell School Personal Data or use it to build profiles for non-educational purposes;
• does not use School Personal Data to train artificial intelligence models; students do not use conversational AI (clause 12 of the Terms);
• shows other players in leagues and head-to-head games, including those of other schools, only an alias that is not based on the student's name or email address, does not let students exchange free-text messages, and lets the School switch leagues, head-to-head games and friends off for its students;
• documents and reviews whether the ICO's Age Appropriate Design Code (the Children's Code) applies to each relevant service and processing activity, complies with the obligations that apply to it, and provides the School with the information it reasonably needs for its own assessment.

10. UK representative

Kluppy will assess whether Article 27 of the UK GDPR requires it to designate a representative in the United Kingdom and, if so, will designate one and give the School its contact details.

11. Data for which Kluppy is controller

Kluppy acts as an independent controller, under its Privacy Policy, only for the personal data of the School's staff and payers that it processes for its own purposes: billing and payment, invoicing and tax obligations, contract management and communications about the Service.

12. Liability and order of precedence

Each party's liability under this Addendum is subject to the limits of the Terms of Service for Schools, including the higher limit for data protection and security. As regards School Personal Data subject to UK data protection law, mandatory law and applicable mandatory transfer clauses prevail, followed by this Addendum, Schedule 1 of the Terms of Service for Schools and the DPA. For all other matters, the Terms of Service for Schools prevail.

13. Duration

This Addendum applies for as long as Kluppy processes School Personal Data.

UK Data Processing Addendum — Schools in the United Kingdom · Kluppy · Version 1.1 · October 2026