CLIENT DATA PROCESSING AGREEMENT
This agreement covers the data Cleverbox process in our role as Data Processor on behalf of our clients (the Data Controller).
Scope
Cleverbox provides design, marketing and website services to schools, Trusts and other education related providers. In order for us to do so, we may have to process Client Personal Data, such as pupil, parent or staff personal data. We have created this Data Processing & Confidentiality Agreement for our clients to allow them to comply with data protection regulations by ensuring lawful processing of any personal data by Cleverbox.
What is data and processing?
The definition of Personal Data is information relating to people who could be identified directly or indirectly by e.g. name, reference number, address, email, phone, gender, age. There is a higher level of data Special Category Personal Information where contents contain information on racial, ethnic origin, political opinions, religious or philosophical beliefs, genetic or biometrics, health, sex life or orientation.
As a data processor Cleverbox can only use our clients’ data for the specific purpose for which it was supplied and must comply with our Data Protection Policy and any relevant security procedures.
This agreement will ensure that Cleverbox:
● Provides the Client with sufficient guarantees we will use appropriate technical and organisational measures to handle data in line with current Data Protection Law and protect individual personal data at all times;
● Guarantees that we will not engage another processor without the Client’s prior specific or general written authorisation;
● Is governed by this signed agreement;
● Only allows authorised persons to have access to Client Personal Data
● Ensures that any person allowed access to Client Personal Data has a strong commitment to confidentiality;
● Deletes or returns all the personal data at the end of the provision of service and provides confirmation of data destruction when necessary
DATA PROCESSING & CONFIDENTIALITY
AGREEMENT
Cleverbox UK Ltd (Cleverbox)
A company incorporated in England and Wales (registration number 03887275) having its registered office at 33 London Road, Bromley, England, BR1 1DG.
ICO reference number ZA359100
Data Protection Lead Karen Pryor
karen@cleverbox.co.uk
T: 0208 466 7222
Nature and purpose of processing (Services)
Duration of Processing
Type of Personal Data and categories of Data Subjects
Included documentation
Cleverbox provides design, marketing, website and hosting services to schools, Trusts and other providers of education related services. Any processing of Personal Data we perform is in order for us to effectively provide these services.
Please see our Data Protection Policy for more information.
We will process any Client Personal Data for the term of the Contract.
Please see our Data Protection Policy for more information.
We may process data relating to our Client’s staff members, parents, website users and pupils. This can include Name, Email Address, Telephone Number, Address or Images.
Please see our Data Protection Policy for more information.
This agreement consists of the following documents:
1. This signed Agreement
2. Annex 1: Sub-Processor Register
and is in addition to our standard Terms and Conditions, and any Service Level Agreement, Contract or Description of Services (such as a signed proposal), on which the Client engaged the Services of Cleverbox.
Supplementary policies: Data Protection Policy and Information Security Policy
Cleverbox have entered into this agreement with the Client in order to set out the parties’ rights and obligations in respect of data protection, confidentiality and information security in connection with the Services provided. By submitting a Purchase Order the Client is commissioning Cleverbox to commence work and by doing so agrees to the terms of this Data Processing Agreement, all relevant Service Agreements and our GeneralTerms & Conditions.
Signed by Karen Pryor
Director
of Operations / Data Protection Lead for and on behalf of Cleverbox UK Ltd
Date: 06/07/2026
Terms and conditions
1. Definitions and rules of interpretation
1.1 The definitions and rules of interpretation in this clause apply in this agreement.
1.2 The definitions are:
Agreement: means this agreement including the signed Cover Sheet, the Terms and Conditions and any supporting documentation.
Cleverbox: means Cleverbox UK Ltd, a company incorporated in England and Wales (registration number 03887275) having its registered office at 33 London Road, Bromley, England, BR1 1DG.
Cleverbox Confidential Information: means (a) any information disclosed by or on behalf of Cleverbox to the Client at any time before the termination of the Contract (whether disclosed in writing, orally or otherwise) that at the time of disclosure was marked or described as “confidential” or should have been understood by the Client (acting reasonably) to be confidential; (b) the financial terms of the Contract; and (c) information relating to the configuration and security of the Hosting Platform.
Client Confidential Information: means (a) any information disclosed by or on behalf of the Client to Cleverbox at any time before the termination of the Contract (whether disclosed in writing, orally or otherwise) that at the time of disclosure was marked or described as “confidential” or should have been understood by Cleverbox (acting reasonably) to be confidential; and (b) the Client Personal Data, excluding Client Personal Data that is published by means of the Hosting Services by: (i) the Client; (ii) any third party; or (iii) Cleverbox on the instructions of the Client.
Client: The Data Controller
Client Personal Data: means (a) any Personal Data concerning any former, current, or prospective pupil, parent, member of staff of the Client or former or current member of the Client’s community; (b) any Personal Data the Client chooses to store on the Client’s website CMS database; or (c) any Client Personal Data otherwise made available to Cleverbox in connection with the Services or this agreement.
Confidential Information: means Cleverbox Confidential Information and the Client Confidential Information.
Contract: means the contract made between the Client and Cleverbox at the time that the Client officially engaged Cleverbox to supply design, marketing, website or hosting services.
Cover Sheet: The first page of this document which, with these terms and conditions and other supporting documentation, constitutes this agreement between the parties.
CMS: means the website content management system used to power Client websites.
Data Breach: any breach of Data Protection Law, including any Personal Data Breach.
Data Controller: any person who falls under the definition of "Data Controller" in the DPA and any person who falls within the definition of "controller" in data protection legislation.
Data Processor: any person who falls under the definition of "Data Processor" in the DPA and any person who falls under the definition of "processor" in data protection legislation.
DPA: the Data Protection Act 2018.
Data Protection Law: (a) the Data Protection Act 2018 (the "DPA"); the UK General Data Protection Regulation as defined by section 3(10) of the DPA (the "UK GDPR"); the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) as retained and amended in UK law; any other applicable law concerning data protection, privacy or confidentiality and any subordinate or related legislation; (b) any guidance, codes of practice or instruction issued by the ICO (or any other relevant supervisory authority) from time to time; (c) any replacement to, or amendment of, any of the foregoing; and (d) any other applicable laws concerning data protection, confidentiality or privacy which may come into force from time to time.
Data Subject: an individual who falls under the definition of data subject in the DPA or GDPR
Effective Date: Date this agreement was signed as shown on the Cover sheet.
GDPR: the UK GDPR, as defined by section 3(10) of the DPA
Personal Data: any information which falls within the definition of "personal data" under the DPA or the UK GDPR
Personal Data Breach: as described in the GDPR.
Processing, Processed and Process: as described in the GDPR
Purpose: providing Services to the Client.
Relevant Occurrence: any of the following: (a) any communication from the Information Commissioner's Office concerning any Processing by Cleverbox of Personal Data or concerning any Processing of Special Category Data; (b) any complaint, enquiry or other communication from a Client Data Subject; (c) any actual or suspected Data Breach concerning Special Category Data.
Services: has the meaning given on the Cover Sheet or outlined in supporting documentation.
Service Charges: has the meaning given to that term in the Contract's General Terms and Conditions, being the charges for the Services set out in the relevant Service Agreement.
Services Description: means (a) the document (if any) supplied by Cleverbox to the Client titled Service Level Agreement and agreed by the parties; (b) the relevant data protection policies supplied by Cleverbox to the Client titled Data Protection Policy and Information Security Policy; (c) any proposal or service description supplied to the client by Cleverbox outlining the website CMS tools that allow the data controller autonomy over the data they collect via their websites; and (d) each written order for Services agreed by the parties.
Special Conditions: any additional terms and conditions as described in supplied and agreed supporting documentation.
Sub-processor: any processor or sub-processor engaged by Cleverbox.
1.3 A person includes a natural person, corporate or unincorporated body (whether or not having a separate legal personality).
1.4 The signed form on page 1 of this document forms part of this agreement and shall have effect as if set out in full in the body of this agreement. Any reference to this agreement includes the Cover Sheet.
1.5 Any phrase followed by the terms including, include, in particular or any similar expression shall be construed as illustrative and shall not limit the sense of the words preceding those terms.
1.6 To the extent of any inconsistency, the following order of precedence shall apply:
1.6.1 any Special Conditions;
1.6.2 Clauses 1 through 12; and
1.6.3 any other term or condition of this agreement.
2. Relationship between the parties
2.1 Cleverbox and the Client acknowledge that for the purposes of Data Protection Law the Client is the Data Controller and Cleverbox is the Data Processor
2.2 Cleverbox and the Client acknowledge and agree that this agreement is supplemental to any other agreement between the parties relating to the Services.
2.3 Cleverbox acknowledges and agrees that the Client alone shall determine the purposes for which and the manner in which Personal Data are, or are to be, Processed.
2.4 The Client acknowledges and agrees that by engaging the Services of Cleverbox it has given consent for Cleverbox to process Personal Data in the ways set out in our Services Description.
2.5 Neither party shall do any act, or omit to do any act, that puts the other party in breach of its obligations under Data Protection Law
3. The Client’s obligations
3.1 The Client warrants to Cleverbox that it has the legal right to disclose all Personal Data that it does in fact disclose to Cleverbox under or in connection with the Services, and that the processing of that Personal Data by Cleverbox in accordance with this agreement will not breach the Data Protection Laws.
3.2 The Client shall only supply to Cleverbox, and Cleverbox shall only process, in each case under or in relation to this agreement, the Personal Data of data subjects falling within the categories specified in the Services Description.
3.3 The Client shall only supply to Cleverbox, and Cleverbox shall only process, in each case under or in relation to this agreement, Personal Data of the types specified in the Services Description.
3.4 The Client shall be responsible for ensuring that its passwords relating to the Services are securely constructed, are kept securely and are not disclosed to any unauthorised person; and the Client must notify Cleverbox as soon as practicable if the Client becomes aware that any password relating to the Services has been or may have been compromised or misused.
3.5 The Client acknowledges that the Client is the owner of any website supplied and hosted by Cleverbox and, as the Data Controller, has complete control over the Form Builder tool within the CMS and therefore:
(a) The Client has complete control over what personal data (if any) they collect and process from end users and whether they wish to store it in their website database;
(b) The Client is responsible for the management, retention and deletion of any personal data they choose to collect and store via their website;
(c) The Client shall undergo appropriate and relevant Data Protection Impact Assessments before requesting any sensitive personal data from users of their website and document this in accordance with their obligations as a Data Controller;
(d) Cleverbox will not monitor Client website forms. The specific data subject categories and types of personal data that the Client chooses to collect and process (outside of the standard categories outlined in the Services Description) shall be documented by the Client; and
(e) By creating a form via the Form Builder and setting it live on the website, the Client is instructing Cleverbox to process any data submitted via that form on their behalf
3.6 The Client acknowledges that before undertaking the Cleverbox photography service (a) that the Client will be responsible for obtaining all appropriate consents from individuals who may be photographed; (b) that the consent will cover any and all intended uses of the images; and (c) that Cleverbox will not be held liable if photography is undertaken without appropriate consents having been obtained and therefore the photography fee will still be payable by the Client.
3.7 On receipt of the photography the Client shall notify Cleverbox immediately of any images that do not have the required consent and instruct Cleverbox to permanently delete these images from our internal storage system.
3.8 If a data subject withdraws consent for any image taken by Cleverbox, the Client shall notify Cleverbox promptly, identifying the specific images affected. On receipt of such notice, Cleverbox will remove the affected images from its active image bank and cease all further use of them for marketing or promotional purposes. Cleverbox may retain a copy of the affected images in secure, access-restricted storage solely to prevent their inadvertent reuse in future work. Such copies will be held only for as long as reasonably necessary for that purpose, in line with Cleverbox's data retention policy, and will be permanently deleted thereafter
4. Cleverbox’s obligations
4.1 Cleverbox shall only Process Personal Data for the purposes outlined in the Services and/or on documented instructions from the Client, including with regard to transfers of Personal Data to a third country, a country outside of the EEA, or an international organisation, unless required to do so by applicable law to which the Contractor is subject; in such a case, Cleverbox shall inform the Client of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.
4.2 Cleverbox shall ensure that persons authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
4.3 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Cleverbox shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including among other things as appropriate:
4.3.1 the pseudonymisation and encryption of Personal Data;
4.3.2 the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
4.3.3 the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
4.3.4 a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
4.4 In assessing the appropriate level of security referred to in paragraph 4.3 above, account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.
4.5 Cleverbox shall take steps to ensure that any natural person acting under the authority of Cleverbox who has access to Personal Data does not process them except on instructions from the Client, unless he or she is required to do so by applicable law
4.6 Cleverbox shall not engage any sub-processor to process the Client Personal Data without the prior specific or general written authorisation of the Client. Cleverbox is hereby authorised by the Client, as at the Effective Date, to engage those third parties identified in Annex 1: Sub-processor Register, or falling within the sub-processor categories specified in the
Services Description and to process the Client Personal Data. In the case of a general written authorisation, Cleverbox shall inform the Client in advance of any intended changes concerning the addition or replacement of any third party processor, giving the Client reasonable opportunity to object to any such changes. Cleverbox shall ensure that each third party processor is subject to equivalent legal obligations to those imposed on Cleverbox.
4.7 Where Cleverbox engages another Data Processor for carrying out specific Processing activities on behalf of the Client, the same data protection obligations as set out in this agreement shall be imposed on that other Data Processor by way of a contract or other legal act under applicable law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the Processing will meet the requirements of Data Protection Law Where that other Data Processor fails to fulfil its data protection obligations, Cleverbox shall remain fully liable to the Client for the performance of that other Data Processor’s obligations.
4.8 Taking into account the nature of the Processing, Cleverbox shall assist the Client by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Client’s obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR
4.9 Cleverbox shall, taking into account the nature of the processing, assist the Client by appropriate technical and organisational measures, insofar as this is possible, with the fulfilment of the Client’s obligation to respond to requests for exercising a data subject’s rights under the Data Protection Laws.
4.10 Cleverbox shall assist the Client in ensuring compliance with all obligations relating to the security of processing, the notification of personal data breaches to the supervisory authority, the communication of personal data breaches to the data subject, data protection impact assessments and prior consultation in relation to high risk processing under the Data Protection Laws.
4.11 Cleverbox shall only retain personal data given to them by the Client for as long as their data retention policy or other legal requirements dictate.
4.12 Cleverbox shall make available to the Client all information necessary to demonstrate compliance with the obligations laid down in the GDPR and this agreement.
4.13 With regard to clause 4.12, Cleverbox shall as soon as is reasonably practicable inform the Client if, in its opinion, an instruction infringes the GDPR or other applicable data protection provisions.
4.14 Cleverbox shall delete or return all Client Personal Data to the Client after the provision of services relating to the processing, and shall delete existing copies save to the extent that applicable law requires storage of the relevant Personal Data.
4.15 Cleverbox shall allow for and contribute, on a paid time and materials basis, to audits (including inspections) conducted by the Client or another auditor mandated by the Client in respect of the compliance of Cleverbox’s processing of Client Personal Data with the Data Protection Laws and this Clause 4.
5. Cleverbox’s employees
5.1 Cleverbox shall ensure, and if so requested provide written evidence to the Client, that all Authorised Employees:
5.1.1 are informed of the confidential nature of Client Personal Data;
5.1.2 have undertaken training in the laws relating to handling Personal Data; and
5.1.3 are aware of both Cleverbox’s duties and their personal duties and obligations under such laws and this agreement.
5.2 Cleverbox shall take all reasonable steps to ensure the reliability and suitability for the task of any of the Cleverbox’s employees who have access to Client Personal Data.
5.3 Cleverbox shall not disclose Client Personal Data, to any person other than authorised Cleverbox employees unless provided for in this agreement or otherwise authorised in writing by the Client.
6. Rights of the Data Subject and reporting requirements
6.1 In addition to the requirements set out in clause 4.8, Cleverbox shall notify the Client without undue delay if it is contacted by a Data Subject seeking to exercise one or more of the Data Subject's rights in their Personal Data laid down in the DPA or Chapter III of the GDPR Cleverbox shall provide the Client with full cooperation and assistance in relation to any request made by a Data Subject regarding the Data Subject's rights in their Personal Data laid down under Data Protection Law
6.2 Cleverbox shall notify the Client without undue delay if a Data Subject raises any concern or complaint about how Cleverbox and/or the Client has handled their Personal Data. Cleverbox shall provide full co-operation and assistance in relation to any concern or complaint raised.
6.3 Save as expressly provided for in this agreement, Cleverbox shall not disclose Client Personal Data to any Data Subject or to any other person without the prior written consent of the Client.
6.4 The Client will assume responsibility for obtaining appropriate verification of the identity of any Data Subject who makes a request for their data before instructing Cleverbox to provide this data.
6.5 If a Relevant Occurrence happens Cleverbox shall notify the Client without undue delay, and in any event within 72 hours of becoming aware, and provide full cooperation in relation to any questions raised by the Client about the Relevant Occurrence.
7. The Client’s rights
7.1 Cleverbox shall, provided that the Client has given at least 14 days' notice to Cleverbox, allow the Client such access to enable the Client to interview employees, to inspect or appoint representatives to inspect all facilities, equipment, documents and electronic data relating to Cleverbox’s provision of the Services. Cleverbox’s obligations in this clause are in addition to its obligations in clause 4.12 above.
7.2 The requirement under clause 7.1 to give notice will not apply if the Client believes that Cleverbox is in breach of any of its obligations under this agreement.
8. Warranties and liability
8.1 Each party warrants to the other that it has the legal right and authority to enter into the Agreement and to perform its obligations under the Services.
8.2 Cleverbox warrants that:
8.2.1 it will Process Client Personal Data in compliance with all applicable laws, enactments, regulations, orders, standards and other similar instruments;
8.2.2 it will comply with any instruction from the Client regarding the Processing of Client Personal Data as long as that request is in compliance with applicable data protection laws and standards;
8.2.3 it will take appropriate technical and organisational measures against the unauthorised or unlawful Processing of Client Personal Data and against the accidental loss or destruction of, or damage to, Personal Data to ensure the Client’s compliance with Data Protection Law
8.3 Subject to clause 8.4, Cleverbox shall be liable to the Client for any costs, claims, damages or expenses incurred by the Client to the extent they arise directly from a failure by Cleverbox, its employees, agents or sub-processors, to comply with its obligations under this agreement or Data Protection Law
8.4 Cleverbox's total liability to the Client arising out of or in connection with this agreement and the Contract combined, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the amount specified in Clause 24 in force at the time of the event giving rise to the claim.
Nothing in this clause 8.4 limits Cleverbox's liability for fraud, fraudulent misrepresentation, death or personal injury caused by Cleverbox's negligence, breach of the terms implied by Section 2 of the Supply of Goods and Services Act 1982, or any other matter that cannot be limited or excluded by applicable law
9. Confidentiality
9.1 The Client must:
9.1.1 keep Cleverbox Confidential Information strictly confidential;
9.1.2 not disclose Cleverbox Confidential Information to any person without Cleverbox’s prior written consent, and then only under conditions of confidentiality no less onerous than those contained in the Agreement;
9.1.3 use the same degree of care to protect the confidentiality of Cleverbox Confidential Information as the Client uses to protect the Client’s own confidential information of a similar nature, being at least a reasonable degree of care; and
9.1.4 act in good faith at all times in relation to Cleverbox Confidential Information.
9.2 Cleverbox must:
9.1.1 keep the Client Confidential Information strictly confidential;
9.1.2 not disclose the Client Confidential Information to any person without the Client’s prior written consent, and then only under conditions of confidentiality no less onerous than those contained in the Agreement;
9.1.3 use the same degree of care to protect the confidentiality of the Client Confidential Information as Cleverbox uses to protect Cleverbox’s own confidential information of a similar nature, being at least a reasonable degree of care;
9.1.4 act in good faith at all times in relation to the Client Confidential Information;
9.1.5 restrict disclosure of Confidential Information to such of its employees as need to know it for the purpose of providing the Services, and shall ensure that all such employees are subject to enforceable obligations of confidentiality corresponding to those set out in this clause 9;
9.1.6 use Confidential Information only for the purposes of performing the Services;
9.1.7 take all necessary precautions to ensure that all Confidential Information is treated as confidential and not disclosed (save as aforesaid) or used other than as permitted by this clause 9.
9.3 Notwithstanding Clauses 9.1 and 9.2, a party's Confidential Information may be disclosed by the other party to that other party's officers, employees, professional advisers, insurers, agents and subcontractors who have a need to access the Confidential Information that is disclosed for the performance of their work and who are bound by a written agreement or professional obligation to protect the confidentiality of the Confidential Information that is disclosed.
9.4 No obligations are imposed by this Clause 9 with respect to a party's Confidential Information if that Confidential Information:
9.4.1 is known to the other party before disclosure under the Contract and is not subject to any other obligation of confidentiality;
9.4.1 is or becomes publicly known through no act or default of the other party; or
9.4.1 is obtained by the other party from a third party in circumstances where the other party has no reason to believe that there has been a breach of an obligation of confidentiality
9.5 The restrictions in this Clause 9 do not apply to the extent that any Confidential Information is required to be disclosed by any law or regulation, by any judicial or governmental order or request, or pursuant to disclosure requirements relating to the listing of the stock of either party on any recognised stock exchange.
9.6 The Client must not, without the prior written consent of Cleverbox, either during the Term or within the period of 12 months following the end of the Term, engage, employ or solicit for engagement or employment any employee of Cleverbox who has been involved in any way in the negotiation or performance of the Contract.
9.7 The Client must not, without the prior written consent of Cleverbox, either during the Term or within the period of 12 months following the end of the Term, engage or solicit any officers, employees, professional advisers, insurers, agents or sub-processors engaged by Cleverbox who have been involved in any way in the negotiation or performance of the Contract.
9.8 The provisions of this Clause 9 shall continue in force indefinitely following the termination of the Contract.
10. Relationship with the services
10.1 The terms of this agreement shall apply to any Services and shall apply to any access, or use, by Cleverbox of the Client’s IT systems or the Client’s website database.
10.2 To the extent of any inconsistency between this agreement on the one hand and any other agreement between the parties, this agreement shall prevail.
10.3 Nothing in any other agreement between the parties shall in any way reduce Cleverbox's obligations under this agreement, save that this shall not affect any limitation or cap on liability expressly agreed between the parties in this agreement or the General Terms and Conditions.
10.4 This agreement supersedes all previous agreements between the parties relating to data protection and information security
11. Term and termination
11.1 This agreement shall continue for so long as Cleverbox provides Services to the Client.
11.2 The Client may terminate this agreement where Cleverbox is in breach of this agreement and, where capable of remedy, fails to remedy that breach within 30 days of written notice from the Client.
11.3 The Client may terminate this agreement immediately where:
11.3.1 the security of any Client Personal Data has been compromised by the actions or omissions of Cleverbox in breach of this agreement; or
11.3.2 Cleverbox has breached this agreement and such breach has, or could, in the Client’s reasonable opinion, put the Client in breach of Data Protection Law
12. General
12.1 Nothing in this agreement shall limit or exclude any liability for fraud or for death or personal injury caused by negligence.
12.2 This agreement and any dispute or claim arising out of or in connection with it or its subject matter shall be governed by and construed in accordance with the law of England and Wales and the parties irrevocably agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim that arises out of or in connection with this agreement or its subject matter
12.3 This agreement is entered into upon the client commissioning Cleverbox to provide Services to the client and shall continue for so long as Cleverbox provides those Services to the Client.
12.4 This agreement may be updated only when necessary to reflect any changes to our obligations under UK GDPR or other relevant legislation.