Data Processing Agreement
Contents
1. Parties and roles
This agreement is between the school, college, university, trust or other organisation using OctoDecks (the "Controller") and Objects and Concepts Limited, company number 13746187, 71-75 Shelton Street, London, England, WC2H 9JQ (the "Processor", "we").
The Controller decides why student data is processed in OctoDecks lessons. We process it only on the Controller’s behalf. Words such as personal data, processing, controller, processor and personal data breach have the meanings given in the UK GDPR.
For teachers’ own account and billing data we are an independent controller, as described in our Privacy Policy.
2. Details of the processing
| Subject matter | Running live OctoDecks lessons that students join with a room code |
| Duration | For the length of each live lesson. All lesson data is deleted when the teacher ends the lesson, and automatically within 72 hours at the latest. |
| Nature and purpose | Showing slides on students’ devices, collecting their answers and showing results to the teacher and class; temporarily hosting slide images and Visualiser recordings for the lesson |
| Data subjects | Students taking part in a lesson; teachers running it; anyone visible or audible in a Visualiser recording |
| Personal data | An automatically assigned student number for the lesson; activity answers including free text; device connection data (IP address, processed by Google); any personal data that students type into answers or that appears in Visualiser recordings or slide images |
| Special category data | Not intended. Students are not asked for any. Screen reader mode, if switched on, is remembered only on the student’s own device. Teachers should not ask students to submit special category data in free-text activities. |
3. Our obligations as processor
We will:
- process the personal data only on the Controller’s documented instructions, which are these terms and the Controller’s use of OctoDecks’ features, unless the law requires otherwise (in which case we will tell the Controller first, unless the law forbids it);
- make sure everyone authorised to process the data is bound by confidentiality;
- take the security measures in section 6;
- use subprocessors only as set out in section 4;
- help the Controller respond to requests from data subjects exercising their rights, taking into account that lesson data is deleted when the lesson ends;
- help the Controller meet its obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO;
- delete the data as set out in section 8;
- give the Controller the information it needs to show compliance with Article 28, and allow audits as set out in section 9;
- tell the Controller immediately if we think an instruction breaks data protection law.
4. Subprocessors
The Controller gives general authorisation for us to use the subprocessors below. We have a written contract with each that gives the same level of data protection as this agreement, and we remain responsible to the Controller for them.
| Subprocessor | What it does | Student data? | Location |
|---|---|---|---|
| Google Ireland Ltd / Google LLC (Firebase, Google Cloud) | Realtime Database and Storage for live lessons; Authentication; Hosting; sign-in emails | Yes, during the lesson only | Database and Storage: EU (Belgium). Authentication and Hosting: global, including the US. |
| Stripe Payments UK Ltd / Stripe, Inc. | Payments, invoices and the billing portal | No | EU, UK and US |
| Zapier, Inc. | Adds new free-trial teachers to our trial email list | No | US |
| Google Ireland Ltd (Google Workspace) | Sends trial tips and service emails to teachers | No | EU |
Videos on slides: when a teacher adds a YouTube or Vimeo video to a slide, students’ devices load that video directly from YouTube or Vimeo, which receive the device’s IP address under their own privacy policies. YouTube videos play in privacy-enhanced mode, so YouTube sets no cookies before a student presses play. The teacher chooses whether to include videos; YouTube and Vimeo are not our subprocessors.
Changes: we will update this list at least 30 days before adding or replacing a subprocessor that handles student data, and change the date at the top of this page. Organisations can ask to be emailed about changes by writing to hello@octodecks.com. The Controller may object on reasonable data protection grounds; if we cannot resolve the objection, the Controller may end its subscription and receive a refund of fees paid for the remaining period.
5. International transfers
Student lesson data is stored in the EU, which the UK recognises as adequate. Where a subprocessor processes data outside the UK and EU (see the table above), the transfer is protected by the UK Extension to the EU-US Data Privacy Framework and/or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in that subprocessor’s terms.
6. Security measures
- Data minimisation: no student accounts, names or contact details; students are identified only by a number assigned for the lesson.
- Short retention: lesson data is deleted when the lesson ends, with an automatic clean-up within 72 hours.
- Encryption: TLS for all data in transit; Google encrypts data at rest.
- Access control: a device can read a live lesson only by entering its room code. Students’ devices can see classmates’ answers where an activity shows them to the class (for example word clouds). Only the teacher who started a lesson can change or end it, and teachers can lock a lesson so no new devices can join.
- Code integrity: code loaded from third-party servers is checked against a fingerprint before it runs, and our pages restrict where scripts can be loaded from.
- Our access: only authorised staff can access production systems, using accounts protected by two-step verification.
- Safeguarding: an automatic profanity filter on word clouds and free-text answers, and teacher controls to freeze submissions.
7. Personal data breaches
We will notify the Controller without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting its data. We will give the information the Controller needs to meet its own obligations, including the likely consequences and the steps we are taking, and we will update it as we learn more.
8. Deletion and return
Lesson data is deleted automatically when each lesson ends (and within 72 hours at the latest), so no student data remains with us at the end of the service. Teachers can download Visualiser recordings before the lesson ends; after that, those copies are the Controller’s responsibility. We do not keep backups of lesson data.
9. Audits and information
We will answer reasonable written questions and security questionnaires about our processing. If those are not enough to show compliance, the Controller (or an independent auditor bound by confidentiality) may audit our compliance with this agreement once a year, on 30 days’ notice, at the Controller’s cost.
10. Your obligations as controller
- Have a lawful basis for using OctoDecks with students, and include OctoDecks in your privacy notice to pupils and parents.
- Tell students not to type personal details into free-text answers, and avoid activities that ask for special category data.
- If you use a Visualiser, make sure what it records is appropriate, and handle any recordings you download under your own policies.
- Make sure teachers follow your safeguarding and data protection policies.
11. General
This agreement lasts as long as we process personal data for the Controller. If it conflicts with the Terms of Service, this agreement wins on data protection matters. Liability under this agreement is subject to the limits in section 14 of the Terms of Service, except where the law does not allow it. It is governed by the law of England and Wales.
Version 1.1, last updated 23 October 2026.