Data Processing Agreement
Last updated: September 2026
Summary: This agreement sets out how Sear Education handles personal data on your organisation's behalf when you use Mr Sear's Spelling. Your organisation remains in control of the data at all times. By using the Service, your organisation agrees to the terms of this Data Processing Agreement.
1. Parties
Data Controller ("the Organisation"): The school, tutoring practice, home educator, or other educational organisation or individual using the Service.
Data Processor ("we", "us", "Sear Education"): Daniel Sear trading as Sear Education, the operator of Mr Sear's Spelling and its sister product Mr Sear's MTC.
2. Scope and Purpose
This Data Processing Agreement ("DPA") applies to personal data processed by Sear Education on behalf of the Organisation through the Mr Sear's Spelling service ("the Service"). It supplements our Terms of Service and Privacy Policy.
The purpose of processing is to provide an online live spelling test tool for educational use.
The Service shares one account and pupil system with Mr Sear's MTC. Schools, classes, teachers, pupils, class logins and pupil PINs are the same records in both products. Learning information is kept separate: Spelling does not read or change MTC's maths results.
3. Data Processed
Pupil data:
| Data type | Purpose |
|---|---|
| First names only (no surnames) | Identifying pupils within their class |
| Individual PIN codes (held in a teacher-only store, never on the pupil record) | Secure login to the pupil's account |
| Display alias (e.g., "Star", "Moon") | A friendly generic username, shared with Mr Sear's MTC |
| Seat position on the class seating plan | Showing each pupil in their place on the teacher's seating plan |
| Absent or present mark for the day | Classroom management |
| Display preferences (dyslexia-friendly font, larger text, higher contrast) | Accessibility. Saved so the child's chosen settings stay on for them |
| Seat designs (a background colour and stickers from a fixed set) | Personalisation. No uploads or free text; seen only within the child's own class |
| In-app rewards (tokens) and the sticker packs and colour sets bought with them | Motivation; earned by taking part, also awarded by teachers |
| Spelling session information (words sent in the current test, each pupil's status, what the pupil typed for the current word, whether it was right, when they started typing, whether their screen is connected) | Running the live spelling test. Cleared when the teacher ends or resets the test |
| Pupil group flags (optional): pupil premium, SEND, EAL | Set by the school's own teachers, never shown to pupils. Only group membership is held, no further detail. |
Special category data: Where a school records SEND status, this may count as special category data under UK GDPR. The Organisation (the school) determines the lawful basis and condition for processing it. Sear Education processes it only on the Organisation's instructions, holds only group membership, and never exposes it to pupils.
Teacher/staff data:
| Data type | Purpose |
|---|---|
| Email address | Account login and invitations |
| Display name | Identification within the Service |
| Class and school membership | Showing each teacher the right classes |
Teachers use one shared account across Mr Sear's Spelling and Mr Sear's MTC. The security records kept for that shared account are described in Mr Sear's MTC's privacy policy.
Categories of data subjects: Pupils (typically aged 5-11) and their teachers/staff.
4. Our Obligations as Data Processor
Sear Education shall:
- Process data only on the Organisation's instructions - We will only process personal data for the purposes described in this agreement and as necessary to provide the Service. We will not use the data for any other purpose.
- Ensure confidentiality - Only authorised Sear Education personnel have access to personal data, and only where necessary for operating or supporting the Service.
- Implement appropriate security measures - We use industry-standard security measures including:
- Encrypted data transmission (HTTPS/TLS)
- Secure cloud infrastructure (Google Firebase)
- Individual pupil PIN codes for access control, kept in a teacher-only store
- Pupil screens that show only the child's own name
- Role-based access controls (teachers see their own classes; school leads see the classes in their school)
- No scripts or fonts loaded from outside services while the Service is in use
- Not engage sub-processors without authorisation - We use Google Firebase services for data storage and processing (see Section 6). We will inform the Organisation of any changes to sub-processors.
- Assist the Organisation with data subject requests - We will help the Organisation respond to requests from individuals exercising their rights under UK GDPR (access, rectification, erasure, etc.).
- Notify the Organisation of data breaches - In the event of a personal data breach, we will notify the Organisation without undue delay (and in any event within 72 hours of becoming aware).
- Delete or return data on termination - When the Organisation stops using the Service, we will delete all personal data in accordance with our data retention schedule (see Section 8).
5. The Organisation's Obligations as Data Controller
The Organisation shall:
- Ensure there is a lawful basis for processing pupil data through the Service (typically "public task" under UK GDPR Article 6(1)(e) for schools, or "legitimate interests" under Article 6(1)(f) for tutors and other educational settings)
- Where applicable, inform parents/carers about the use of the Service (e.g., through the school's privacy notice or by other appropriate means)
- Ensure that only appropriate data is entered into the Service (first names only, no surnames or sensitive data)
- Keep class logins and pupil PINs confidential and only share them with authorised users
- Notify Sear Education promptly if a teacher leaves or should have their access revoked
6. Sub-processors
We use the following sub-processors to provide the Service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Firebase Firestore | Main database | London, UK |
| Google Firebase Realtime Database | Checking the connection is live | Belgium, EU |
| Google Firebase Authentication | Teacher and pupil sign-in | May involve processing outside UK/EU with appropriate safeguards |
| Google Firebase Hosting | Serving the website | Google's hosting network |
| Google Cloud Functions | Checking class logins and PINs, signing devices out | May involve processing outside UK/EU with appropriate safeguards |
| Zoho Mail | Sending invitation emails to teachers, through the shared account system | Teacher email addresses only |
7. International Transfers
The primary storage of pupil data is in the UK and EU (London and Belgium). Some processing may occur outside the UK/EU through Google's infrastructure. Where this happens, appropriate safeguards are in place.
8. Data Retention and Deletion
Retention periods:
| Data type | Retention period |
|---|---|
| Spelling session information | Cleared when the teacher ends or resets the test. No long-term history of spelling results is kept on the Service's servers |
| Downloaded test results (Excel file) | Saved to the teacher's own computer, not kept by the Service |
| Pupil names and other shared pupil details | Duration of school's active subscription |
| Teacher accounts | Until deleted by organisation lead or account holder |
Soft deletion (30-day recovery period):
Schools, classes and pupils are shared with Mr Sear's MTC, so these steps apply to the shared records in both products. When an organisation lead deletes a class through the Service:
- The class is immediately hidden from view
- All associated data is retained securely for 30 days to allow recovery in case of accidental deletion
- After 30 days, all data is permanently and irreversibly deleted by an automated process
- Organisations may request early permanent deletion by contacting info@mrsearmtc.uk
Teacher account deletion:
When an organisation lead removes a teacher, the teacher's account and access are deleted immediately and permanently.
On termination:
When an organisation's subscription ends or is not renewed, the school account is deleted by the service administrator. The school and all its classes are immediately hidden from view. Teachers are unassigned from the school but their accounts are retained. All associated data (classes and pupils) is retained securely for 30 days to allow recovery in case of error, after which it is permanently and irreversibly deleted by an automated process.
9. Data Breach Notification
In the event of a personal data breach affecting the Organisation's data:
- We will notify the Organisation's designated contact without undue delay and within 72 hours of becoming aware of the breach
- We will provide details of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken to address it
- We will cooperate with the Organisation and the ICO (Information Commissioner's Office) as needed
10. Audit and Compliance
We will:
- Make available to the Organisation all information necessary to demonstrate compliance with this DPA
- Allow for and contribute to audits or inspections conducted by the Organisation or an auditor mandated by the Organisation (with reasonable notice)
- Maintain records of processing activities as required by UK GDPR Article 30
11. Duration and Termination
This DPA applies for as long as the Organisation uses the Service. It will automatically terminate when:
- The Organisation stops using the Service and all data has been deleted
- The Service is discontinued (with at least 30 days' notice)
Sections relating to data deletion, confidentiality, and breach notification survive termination.
12. Governing Law
This DPA is governed by the laws of England and Wales and is subject to the jurisdiction of the courts of England and Wales.
13. Contact
For any questions about this Data Processing Agreement or to report a data concern:
Sear Education
Email: info@mrsearmtc.uk