Data processing agreement

This agreement forms part of the terms for every teacher account. When you keep records about your students in Sangha, you are the controller of that data and Sangha (Tim Framp trading as Sangha, 55 Sutherland Boulevard, 3 Toby Way, Surbiton, KT5 9PA; ICO registration ZC261996; hello@sangha.fit) is your processor, as described in Article 28 of the UK GDPR.

Student names, contact details, bookings, passes, payments, messages, and — where you use them — waiver signatures and health (PAR-Q) answers, which are special category data. We process it only for as long as your account is open, to run the service you use.

We will:

• act only on your documented instructions, which are the settings and actions you take in Sangha;
• make sure anyone with access is bound by confidentiality;
• keep data secure: encryption in transit and at rest, account-by-account separation enforced in the database, and automatic sign-out;
• help you respond to student requests to see, correct, export or delete their data;
• tell you without undue delay, and within 48 hours where possible, if we become aware of a breach affecting your data;
• help with impact assessments and regulator enquiries where reasonable;
• delete or return your data when your account closes, except records the law requires us to keep;
• give you the information needed to show we meet these duties.

You confirm you have a lawful basis for the student data you hold, that you give students your own privacy information, and that you collect health answers only with their explicit consent — Sangha's waiver forms record this for you.

You authorise us to use the suppliers below. Each is bound by a contract giving at least the protection in this agreement. We'll update this list, with at least 14 days' notice by email, before adding or replacing a supplier; you may object and close your account.

Where data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement (or the UK Addendum to the EU clauses).

When you take card payments, Stripe acts as an independent controller for payment and identity checks on your Stripe account, under its own terms. Sangha never sees or stores full card numbers.