Arc Pathway Data Protection

We are Arc Pathway Ltd, a company registered in England with company number 11504592 and a registered address of 4th Floor, 58-59 Great Marlborough Street, London, England, W1F 7JY.

You are a childminder, educator, nursery, school or similar educational organisation. This Annex relates to the use of Arc Pathway, our online learning journal. Annex E relates to data in our billing and support system. Annex F relates to data in our discussion forum.

We need to work together to ensure we are compliant with data protection obligations when using Arc Pathway.

This annex should be read in conjunction with our overall contract and, in particular, Annex B which explains our approach to security and Annex D which includes a link to a list of our sub processors.

The legally required terms in a Data Processing Agreement or Contract

The Data Processing Agreement (DPA) is a contract between us detailing how data will be processed and obligations. These include:

• The subject matter, duration, nature and purpose of the processing, types of personal data, and categories of data subject (as set out in Annex C)
• The obligations and rights of the controller (see below)
• Our standard obligations as processor (see below)

Our jurisdiction

We are headquartered in the UK. This contract is under English law. Our supervisory authority for data protection is the UK Information Commissioner’s Office (https://ico.org.uk), registration number ZA518754.

Where is data stored?

All data is processed and stored within the UK except for the specific exceptions listed in Annex D and below. Primary systems and backups are UK-based.

Contractual Agreement on Storage Location

Storage locations are contractual. Changes require mutual agreement and amendment.

Detailed Information

Most storage and processing is through Microsoft Azure (UK data centres only). Azure is contractually bound not to transfer data elsewhere without permission.

Exceptions to UK Data Storage

• Access from outside UK/EU: data may be transmitted internationally to reach users.
• Content delivery via Cloudflare: static files may be temporarily cached worldwide with safeguards (IDTA).
• Push notifications: routed via Apple and Google servers.
• Support/service improvement: accessed with written permission for support or enhancement.

Safeguards for Data Access

• Data stored/processed in UK except exceptions listed
• Access restricted to trained, vetted staff
• Data encrypted and transmitted securely
• Statistical data preferred where possible
• Minimal access granted for support
• Data deleted when no longer needed

What data is placed into Arc Pathway?

Annex C provides full details. In summary:

• Data subjects: typically children, staff, relatives
• Types of data: names, emails, DOBs, postcodes, learning records, care details
• Purpose: provide records of progress, attendance, care
• Duration: contract term plus backup retention

Who is responsible for what?

• You are the data controller.
• We are the data processor.

You must:

• Have a lawful basis to enter data
• Comply with data protection law
• Respond to rights requests
• Keep contact details up to date

We must:

• Only process data on your instructions
• Maintain confidentiality
• Secure processing measures
• Use compliant sub-processors (Annex D)
• Assist with access, breaches, assessments
• Return/delete data as required
• Allow audits
• Provide relevant legal information

What we expect of you

You must determine a lawful basis for your data and comply with the data protection principles outlined by the ICO. You must manage permissions, respond to user requests and keep contact information updated.

We will only process data on your instructions

We do not sell or use your data for advertising. Anonymised data may be used for service improvement unless you opt out.

User permissions and instructions

You control user access and must ensure compliance with restrictions. Instructions should ideally be via Arc Pathway's interface or apps, or verified through email/phone.

Security, Breaches & Compliance Support

Our security is described in Annex B. In case of breach, we will notify and assist you. Breaches are reported to the ICO within 72 hours if required. We support DPIAs but may pass on costs.

End of contract

Data is deleted from live systems 90 days after contract end. Backup data may persist for up to one year. Retrievals may incur cost. We may retain data required by law.

Audits and Information Requests

We support audits and will provide necessary information. Additional or bespoke help may incur cost.

Complaints and Contact

Email complaints to info@arcpathway.com. For unresolved concerns, contact our DPO at dpo@arcpathway.com.

Registered Address: 4th Floor, 58-59 Great Marlborough Street, London, England, W1F 7JY