Data Processing Addendum

1 Roles

For personal data entered into the platform (students, parents, staff), the school is the Data Controller (it decides what data is collected and why) and CoreAxis is the Data Processor (it processes that data only to provide the service on the school’s instructions).

2 Scope of processing

• Subject matter: provision of the CoreAxis school-management service.
• Data subjects: students, parents/guardians, teaching and non-teaching staff.
• Categories: identity & contact details, academic records, attendance, fees/financial records, and account credentials.
• Duration: for the term of the school’s subscription plus any legally required retention.

3 Processor obligations

• Process personal data only on the school’s documented instructions.
• Keep data confidential and ensure staff are bound by confidentiality.
• Apply appropriate technical & organisational security measures (see our Security page).
• Assist the school with data-subject requests and breach notifications.
• Delete or return personal data at the end of the engagement, on request.

4 Sub-processors

We use a limited set of sub-processors strictly to run the service (for example payment and messaging gateways). They are bound by equivalent data-protection obligations. A current list is available on request.

5 Children’s data

Because schools hold data about minors, the school is responsible for obtaining any parental/guardian consent required by law. We process such data only to provide the service and apply the same protections described above.

6 International transfers & grievances

Data is hosted as configured for your deployment. For data-protection queries or to raise a grievance, contact our data contact at softcoreaxis@gmail.com.