1. DBS will not make any other Restricted Transfer of Client Personal Data without a safeguard recognised under Data Protection Law, and will tell the Client before doing so.

2. On request, DBS will give the Client a copy or summary of the relevant transfer safeguards. Commercial terms may be removed.

8. Data subject rights

1. If DBS receives a request from a parent, student, staff member or anyone else exercising their data protection rights about Client Personal Data, we will pass it to the Client within [7] working days. We will not respond ourselves unless the Client tells us to.

2. DBS will help the Client respond to such requests, as far as reasonably possible. This includes finding, exporting, correcting or deleting records in the platform.

9. Personal data breaches

1. DBS will tell the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data. This includes a breach notified to us by HighLevel or another sub-processor.

2. DBS will aim to notify the Client within [24] hours of becoming aware, so the Client can meet its own 72-hour deadline to report to the Information Commissioner's Office where required.

3. The notice will describe, as far as known at the time: what happened; the categories and approximate number of people and records affected; the likely consequences; and what has been done or proposed to deal with it. DBS will add further information as it becomes available.

4. DBS will take reasonable steps to contain the breach, reduce harm and prevent it recurring. We will help the Client with any notification to the ICO or to the people affected. The decision to notify rests with the Client.

10. Assessments, records and audits

1. DBS will give the Client reasonable help with data protection impact assessments and any prior consultation with the ICO that relate to the Services.

2. DBS will keep a record of the processing it carries out on the Client's behalf, as Data Protection Law requires.

3. DBS will make available the information reasonably needed to show that it complies with this Agreement. This includes HighLevel's published security information and SOC 2 Type II assurance.

4. The Client, or an independent auditor it appoints, may audit DBS's compliance with this Agreement. Audits require at least [30] days' notice, may take place no more than once a year unless there has been a Personal Data Breach or the ICO requires one, and must be carried out remotely where practical. The Client will pay DBS's reasonable costs of any audit.

11. The Client's responsibilities

As controller, the Client is responsible for:

1. having a lawful basis for collecting and using the personal data it puts into the platform, including any consent needed for marketing emails and texts;

2. telling parents, students and staff how their data is used, through its own privacy notice. This should mention that the Client uses DBS and HighLevel, and that data is accessed from outside the UK;

3. taking particular care with children's personal data, and with any health or medical information (such as allergies or medical conditions). The Client should only record such information in the platform where it is necessary and lawful;

4. managing its own users' access to the platform, including removing staff who leave and switching on two-factor authentication;

5. making sure its instructions to DBS comply with Data Protection Law.

Where the Client uses its own staff or contractors, such as its own virtual assistant, to access the platform, the Client is responsible for their agreements and any international transfer safeguards. DBS is not responsible for them.

12. End of the Services, liability and law

1. Return and deletion. When the Services end, the Client may export its data from the platform. DBS can help with this on request. Within [30] days of the end of the Services, DBS will delete Client Personal Data from the Client's account, and ask HighLevel to do the same, unless the law requires us to keep it. Copies held in routine backups will be deleted in line with HighLevel's normal backup cycle and protected until then.

2. Duration. This Agreement lasts for as long as DBS processes Client Personal Data for the Client.

3. Liability. Each party's liability under this Agreement is subject to the limits in the Main Terms [or: is limited to the fees paid by the Client in the 12 months before the claim]. Nothing limits liability that cannot be limited by law.

4. Changes. DBS may update this Agreement to reflect changes in the law, ICO guidance or our sub-processors' terms. We will email the Client at least [30] days' notice of any material change and publish the new version with its date. If the Client objects, it may end the Services before the change takes effect; otherwise the new version applies from that date.

5. Law. This Agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

13. Acceptance

1. The Client accepts this Agreement electronically by ticking the box at checkout or sign-up that confirms agreement to the Main Terms and this Agreement. No signature is needed.

2. DBS keeps a record of each acceptance, including the date, time and version accepted.

3. Clients who signed up before this Agreement was published accept it by confirming in writing,

including by email or by clicking an acceptance link DBS sends them.

4. A Client who prefers a signed copy may ask DBS for one. A signed copy has the same effect as

electronic acceptance.

Optional signed copy (only for Clients who request one)

Schedule 1 – Details of processing