Data Processing Agreement

2.1 The College (Data Controller) wishes to use PlumbMate, an online learning platform for plumbing and heating apprentices and learners, provided by Holwell Educational Services Ltd (Data Processor).

2.2 In order to provide the PlumbMate service, the Data Processor will process personal data on behalf of the Data Controller.

2.3 This Agreement sets out the terms on which the Data Processor will process personal data on behalf of the Data Controller in accordance with the UK GDPR and the Data Protection Act 2018.

2.4 This Agreement forms part of, and is subject to, the College Subscription Agreement between the parties. In the event of any conflict between this Agreement and the College Subscription Agreement on matters of data protection, this Agreement shall prevail.

4.1 Categories of Data Subjects

• Learners enrolled by the College on the PlumbMate platform.
• Tutors, assessors, Internal Quality Assurers (IQAs) and other staff assigned by the College to manage learners.
• External Quality Assurers (EQAs) visiting the College, where EQA visit records are recorded in the IQA Module.

4.2 Categories of Personal Data Processed

For all Data Subjects:

• Name and email address.
• Role and college/group assignment.
• Account creation date and subscription status.
• Last active timestamp and session data.

For learners additionally:

• Quiz scores, revision test scores, and learning progress data.

Where the College uses the IQA Module, additional data categories processed include:

• Sampling plans, assessment decisions, and assessor evidence uploads.
• Additional learning needs records (which may constitute Special Category Data under Article 9 UK GDPR).
• Continuing Professional Development (CPD) records for staff.
• Records of EQA visits and outcomes.

4.2a Special Category Data

Where the Controller instructs the Processor to record Special Category Data (for example, health-related information in the form of additional learning needs), the Controller confirms that it has identified an appropriate lawful basis under Article 9 UK GDPR (typically Article 9(2)(g) — substantial public interest, or Article 9(2)(h) — provision of social protection or education) and that Data Subjects have been appropriately informed.

4.3 Nature and Purpose of Processing

The Data Processor will process personal data solely for the purpose of providing the PlumbMate learning platform to the College, including:

• Creating and managing learner, tutor and IQA accounts.
• Recording and displaying learning progress to learners, tutors and IQAs.
• Enabling tutors and IQAs to monitor learner engagement, assessment outcomes and quality assurance activities.
• Providing account management, password reset and progress reset functions.
• Enforcing access controls based on subscription status and role.
• Sending transactional emails (for example, password reset, IQA reminders and EQA visit reminders) where configured.

4.4 Duration of Processing

The Data Processor will process personal data for the duration of the College's active subscription. Upon termination or expiry of the subscription, personal data will be retained for a maximum of 90 days to allow for final data exports or queries, after which it will be automatically and permanently deleted unless the College requests earlier deletion in writing.

The Data Processor agrees to:

• Process personal data only on documented instructions from the Data Controller, unless required to do so by UK law (in which case the Processor will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest).
• Ensure that all personnel authorised to process personal data are subject to appropriate confidentiality obligations and receive appropriate data protection training.
• Implement and maintain appropriate technical and organisational security measures to protect personal data, as described in Section 9 of this Agreement.
• Not engage any sub-processor without the prior written consent of the Data Controller. The Data Controller consents to the sub-processors listed in Schedule 1, and the Data Processor will comply with the objection process in Section 7 before engaging any new or replacement sub-processor.
• Assist the Data Controller in responding to requests from Data Subjects exercising their rights under Data Protection Legislation (including the rights of access, rectification, erasure, restriction, objection and portability), and will respond to such assistance requests within 5 working days of receipt.
• Notify the Data Controller without undue delay, and in any event within 72 hours, upon becoming aware of a personal data breach affecting data processed under this Agreement.
• At the choice of the Data Controller, delete or return all personal data to the Data Controller after the end of the provision of the Services, and delete existing copies unless retention is required by applicable law. Where return of data is requested, data will be provided in a structured, commonly used, machine-readable format (for example, CSV or JSON).
• Assist the Data Controller, taking into account the nature of processing and information available to the Processor, with Data Protection Impact Assessments (DPIAs) and any prior consultation with the Information Commissioner's Office where these are reasonably required.
• Make available to the Data Controller all information necessary to demonstrate compliance with the obligations set out in Article 28 UK GDPR, and allow for and contribute to audits, including inspections, conducted by the Data Controller or an auditor mandated by the Data Controller, on reasonable written notice and not more than once per year, except where a suspected breach or regulatory investigation reasonably requires more frequent audits. The Data Processor may satisfy this obligation by providing independent third-party audit reports (such as ISO 27001 or SOC 2) where these cover the relevant processing.

The Data Controller agrees to:

• Ensure it has a lawful basis under Article 6 UK GDPR (and, where applicable, Article 9) for processing personal data and for sharing it with the Data Processor.
• Ensure that Data Subjects (learners and staff) have been informed, through the College's own privacy notices, that their data will be processed by PlumbMate in accordance with this Agreement.
• Only instruct the Data Processor to process personal data in accordance with Data Protection Legislation.
• Promptly notify the Data Processor of any changes to its instructions that may affect the Data Processor's obligations under this Agreement.
• Configure its use of the IQA Module in a manner consistent with its obligations as Data Controller, including limiting the recording of Special Category Data to what is strictly necessary.

8.1 Where a Data Subject exercises their rights under Data Protection Legislation (including the rights of access, rectification, erasure, restriction, objection and portability), the Data Processor will assist the Data Controller in responding to such requests within the timeframes required by law (normally one calendar month).

8.2 The Data Processor will notify the Data Controller promptly, and in any event within 5 working days, of receiving any direct request from a Data Subject relating to data processed under this Agreement, and will not respond substantively to such requests without the Data Controller's prior written instruction.

The Data Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Firebase Authentication for secure user login and access control.
• Firestore security rules restricting data access to authorised users only, with college-scoped access controls ensuring staff can only access data belonging to their own college.
• HTTPS encryption for all data in transit.
• Single-session enforcement to prevent unauthorised account sharing.
• Restriction of subscription, role and administrative fields to server-side updates only (via Cloud Functions).
• Regular review of user access, with prompt removal of access for users no longer authorised.

The Data Processor will review and update these measures periodically in light of technological developments, the nature of the data being processed, and the state of the art of information security.

Upon termination or expiry of the College's subscription:

• The Data Processor will retain personal data for a maximum of 90 days to allow for any final data exports or queries.
• At any point during that 90-day window, the Data Controller may request return of the data in a structured, commonly used, machine-readable format (typically CSV or JSON), or earlier deletion, by contacting info@plumbmatemastery.co.uk.
• After 90 days, all personal data will be automatically and permanently deleted from the Data Processor's systems.
• The Data Processor will confirm deletion in writing within 14 days of completion.

This retention period applies to College-provisioned accounts and associated Learner Data. Individual learner accounts created directly with PlumbMate outside of a college subscription follow the retention arrangements set out in the PlumbMate Privacy Policy.

13.1 Each party agrees to keep confidential all non-public information received from the other party in connection with this Agreement.

13.2 Confidentiality obligations under this Agreement shall survive termination for a period of three (3) years, except for obligations relating to personal data, which shall continue for as long as such data remains confidential.

14.1 This Agreement is governed by and construed in accordance with the laws of England and Wales. Any disputes arising under this Agreement will be subject to the exclusive jurisdiction of the courts of England and Wales.

14.2 If any provision of this Agreement is found by a court or regulator to be unenforceable, the remaining provisions shall continue in full force and effect, and the parties shall negotiate in good faith to replace the unenforceable provision with one that achieves the same intended effect to the extent permitted by law.

14.3 No variation to this Agreement shall be effective unless agreed in writing and signed by authorised representatives of both parties.

14.4 Notices under this Agreement shall be sent by email to the addresses specified in Section 1 and shall be deemed received on the next working day after sending.

This is the published template of our Data Processing Agreement. The version signed by your College forms part of your College Subscription Agreement — if you need a fresh signed copy, or have any questions about the DPA, please contact us: