Data Processing Agreement

1. Definitions and Interpretation

In this Agreement, unless the context requires otherwise, terms defined in the UK GDPR and Data Protection Act 2018 have the same meanings:

• "Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and (to the extent applicable) the EU General Data Protection Regulation (Regulation (EU) 2016/679).
• "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", and "Processing" have the meanings given in the UK GDPR.
• "Controller Personal Data" means any Personal Data provided or made accessible by or on behalf of Trafalgar Education to SYNQ in connection with the Services.
• "Pseudonymisation" means the processing of Personal Data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information kept separately under technical safeguards.
• "Services" means the social density evaluation, term-over-term cohort retention intelligence, bridge ratio computation, and baseline audit services provided by SYNQ.
• "Sub-processor" means any third-party data processor engaged by SYNQ who agrees to process Controller Personal Data.

2. Scope, Roles and Details of Processing

2.1 Relationship of the Parties: The parties acknowledge and agree that for the purposes of Applicable Data Protection Law, Trafalgar Education is the Data Controller and Synq Intelligence Ltd is the Data Processor in respect of Controller Personal Data.

2.2 Details of Processing: The subject matter, duration, nature, and purpose of the processing, along with the categories of Personal Data and Data Subjects, are specified in Schedule 1 of this Agreement.

3. Processor Obligations

Synq Intelligence Ltd shall:

1. Documented Instructions: Process Controller Personal Data strictly on documented instructions from Trafalgar Education (including with respect to transfers of personal data outside the UK), unless required to do so by applicable law to which SYNQ is subject. In such a case, SYNQ shall inform Trafalgar Education of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
2. Confidentiality: Ensure that persons authorized to process the Controller Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Security Measures (Article 32): Implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as detailed in Schedule 2.
4. Immediate Notification of Infringements: Promptly notify Trafalgar Education if, in SYNQ's reasonable opinion, an instruction from Trafalgar Education infringes Applicable Data Protection Law.

4. Cryptographic Hashing & Pseudonymisation Guarantee

4.1 Point-of-Ingestion Pseudonymisation: SYNQ guarantees that student, parent, and member identifiers ingested from Trafalgar Education's booking platforms, management information systems, or scheduling tools are pseudonymised at the point of ingestion using cryptographic SHA-256 one-way hashing.

4.2 Zero Unencrypted PII Storage: SYNQ shall not store raw, unencrypted direct identifiers (such as full student names, contact telephone numbers, home addresses, or payment card details) within its operational analytics cluster.

4.3 Baseline Hash Fingerprinting: For Phase 0 audits and Phase 1 RCT pilots, baseline churn and density fingerprints are cryptographically locked to ensure scientific verifiability and tamper-evident auditability without exposing individual data subject records.

5. Sub-processors

5.1 General Authorization: Trafalgar Education grants SYNQ general authorization to engage the Sub-processors listed in Schedule 3 of this Agreement.

5.2 Changes to Sub-processors: SYNQ shall give Trafalgar Education at least thirty (30) days' prior written notice of any intended appointment of a new Sub-processor or replacement of an existing Sub-processor, providing Trafalgar Education the opportunity to object to such changes on reasonable data protection grounds.

5.3 Flow-Down Obligations: Where SYNQ engages a Sub-processor, SYNQ shall impose data protection obligations no less onerous than those set out in this DPA by way of a written contract. SYNQ remains fully liable to Trafalgar Education for the performance of each Sub-processor's obligations.

6. Assistance with Data Subject Rights

6.1 Assisting the Controller: Taking into account the nature of the processing, SYNQ shall assist Trafalgar Education by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Trafalgar Education's obligations to respond to requests exercising Data Subject rights under Chapter III of the UK GDPR (including access, rectification, erasure, restriction, objection, and data portability).

6.2 Direct Data Subject Inquiries: If SYNQ receives a request directly from a Data Subject concerning Controller Personal Data, SYNQ shall promptly notify Trafalgar Education and shall not respond directly to the Data Subject without Trafalgar Education's prior written authorization, unless legally compelled to do so.

7. Personal Data Breach Notification

7.1 Notification Window: SYNQ shall notify Trafalgar Education in writing without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a confirmed Personal Data Breach affecting Controller Personal Data.

7.2 Breach Details: The notification shall contain, at a minimum:

• A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned;
• The name and contact details of SYNQ's Data Protection Officer or privacy lead;
• A description of the likely consequences of the Personal Data Breach;
• A description of the remedial measures taken or proposed to be taken by SYNQ to mitigate adverse effects.

7.3 Mitigation & Cooperation: SYNQ shall take immediate commercial and technical steps to mitigate the effects of any Personal Data Breach and provide full reasonable cooperation to Trafalgar Education in investigating and resolving the incident.

8. Data Protection Impact Assessments (DPIA) & Prior Consultation

SYNQ shall provide reasonable assistance to Trafalgar Education with any data protection impact assessments (Article 35 UK GDPR) and prior consultations with supervisory authorities (such as the UK Information Commissioner's Office - ICO, Article 36 UK GDPR) that Trafalgar Education reasonably considers necessary in relation to the Services.

9. Deletion and Return of Personal Data

9.1 End of Services: Upon termination or expiry of the Services or at the written request of Trafalgar Education, SYNQ shall, at the choice of Trafalgar Education, securely delete or return all Controller Personal Data, and delete existing copies unless applicable UK or EU law requires continued retention.

9.2 Certification: Upon request, SYNQ shall provide written certification of the irreversible deletion and cryptographic zeroing of all operational replicas and cache files.

10. Audit and Inspection Rights

10.1 Demonstrating Compliance: SYNQ shall make available to Trafalgar Education all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR.

10.2 Audit Facilitation: SYNQ shall allow for and contribute to audits, including inspections, conducted by Trafalgar Education or an independent certified auditor mandated by Trafalgar Education, upon reasonable prior notice (minimum 14 business days) and during normal business hours, subject to reasonable confidentiality and security procedures.

11. International Data Transfers

11.1 Primary Storage Location: All primary database storage, application nodes, and processing infrastructure utilized for Trafalgar Education are located within the United Kingdom (UK) and the European Economic Area (EEA).

11.2 Safeguards for Restricted Transfers: SYNQ shall not transfer Controller Personal Data to any country outside the UK or EEA that is not recognized as providing an adequate level of protection by the relevant UK authorities unless appropriate safeguards (such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses) are executed.

12. Governing Law and Jurisdiction

This DPA and any non-contractual obligations arising out of or in connection with it shall be governed by and construed in accordance with the laws of England and Wales. The courts of London, England shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this DPA.