Cleverbox Data Protection Policy

Version Date 01/01/2026

DATA PROTECTION POLICY 1. Introduction This Policy sets out the obligations of Cleverbox UK Ltd, a company registered in the United Kingdom under number 03887275, whose registered office is at 33 London Road, Bromley, England, BR1 1DG (“Cleverbox”, “Us”, “We”) regarding data protection and the rights of clients, end users of our clients’ websites, and Cleverbox employees (“data subjects”) in respect of their personal data under the UK’s data protection legislation, including the UK General Data Protection Regulations (UK GDPR).

This Policy outlines Cleverbox’s obligations as a data controller and as a data processor regarding the collection, processing, transfer, storage, and disposal of personal data. The procedures and principles set out within this policy must be followed at all times by Cleverbox, its employees, agents, contractors, or other parties working on behalf of Cleverbox.

Cleverbox UK GDPR compliance programme Building on the technical and organisational security measures we already have in place to to meet our obligations under the UK GDPR. ●​ We have reviewed the data we collect and process and follow guidelines from the ICO and the National Cyber Security Centre to ensure appropriate technical and organisational security measures are in place to protect any personal data we control or process. ●​ We are registered with the ICO (number ZA359100). ●​ Our customer terms and conditions include a data processor clause that will enable us (and you) to comply with the requirements of the UK General Data Protection Regulation, which governs controller-processor contracts. ●​ We have worked with our subcontractors and suppliers to ensure that appropriate security measures and contractual arrangements are in place. ●​ Our other internal procedures relating to personal data have been analysed to ensure that we comply with the UK GDPR’s requirements, including those in respect of: (i) privacy by design and default; (ii) data subject consents; (iii) processing records; (iv) data retention and deletion; (v) data subject rights; (vi) impact assessments and (vii) breach notification. ●​ We have appointed a Data Representative who is responsible for ensuring we comply with our obligations under the UK GDPR. ●​ We ensure our staff are trained in best UK GDPR day-to-day practice and general knowledge. All staff are bound by an employee contract to maintain confidentiality in line with this data protection policy.

We will ensure that staff are informed of any special data protection requirements relevant to their work. Those with access to any client personal data, in order to support our clients with the on-going management of their websites, undergo relevant training in data protection, including how to obtain appropriate verification from a data controller, when instructed to act on their behalf.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

2. The data we collect and process in our role as a Data Controller Cleverbox is a data controller in respect of information such as Cleverbox employee data and client contact data.

The personal data we process Type of data

Examples of data

Purpose

Internal HR data

Employees’ DOB; Passport number & expiry details; NI number; Tax Code and URN

HMRC / employment law requirements

Marketing lists

Headteachers’ and other client work email; work telephone number; work address

Cold, warm and hot leads for marketing

Client data

Name, position, work email, work telephone number

Necessary for operation of business

What we do with the data we process as a Data controller We use the client data we collect to effectively manage projects and ongoing client accounts.

We may, from time to time, contact clients regarding the services we are currently providing or to inform them of related services and offers that may be of interest to them.

If we need to share any personal information with any third-party companies, in order to facilitate mailings or e-shots for example, the information will be sent securely and will only be shared with trusted third-parties with whom we have data protection policies in place. This data may consist of name, position, work address and/or work email address and will never be used by our suppliers for their own marketing purposes.

Cleverbox will never rent, sell or share our clients’ personal information with any other person or non-affiliated company unless we are required to by law.

How long we keep this data We only keep the personal data we collect for as long as we need to in order to fulfil our Terms of Service and/or for as long as we have permission to keep it. On termination of a contract with our clients, we will continue to hold the staff contact details we need for our financial records and legitimate business interests only for as long as is necessary, at which point all electronic records will be deleted and any hard copies will be shredded and disposed of securely.

Under UK GDPR Article 6, Cleverbox relies on the following legal bases for processing personal data in its role as a data controller: Legitimate Interests (Article 6(1)(f)): Processing client contact details and marketing list data for the purpose of managing client relationships, delivering contracted services, and communicating relevant service information.

A Legitimate Interests Assessment (LIA) is maintained to document this reliance.

Legal Obligation (Article 6(1)(c)): Processing employee HR data (including NI numbers, tax codes, and passport details) to fulfil statutory obligations under employment and tax law, including HMRC requirements.

Contract Performance (Article 6(1)(b)): Processing client contact data to the extent necessary to fulfil our contractual obligations to clients.

Where Cleverbox relies on legitimate interests for direct marketing communications, recipients have the right to opt out at any time by contacting team@cleverbox.co.uk. Opt-out requests will be actioned promptly and no later than within 30 days.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

3. The data we process in our role as a Data Processor Cleverbox provides design, marketing and website services to schools and Trusts and acts as a data processor in respect of information such as data transmitted, stored and displayed via our clients’ websites.

What we do with the data we process on behalf of our clients We will only process personal data on our clients’ behalf for the purposes specified in our Terms of Service (or otherwise instructed by our clients in writing and in accordance with data protection law). This processing mainly consists of storing any data the data controller chooses to collect through their website and keeping it secure and confidential. We do not, on our own authority, access, alter, erase or otherwise process any of our clients’ data in our role as a processor.

We will never rent, sell or share personal information that is disclosed to us or that is collected through our clients’ websites with any other person or non-affiliated company for their own marketing purposes. We will only share data with our trusted third-party suppliers when necessary to provide products or services to our clients or with their prior approval. We will not disclose personal data to regional/national institutions and authorities, unless required to by law or other regulations.

The personal data we process on behalf of our clients We will only process on our clients’ behalf the personal data our clients instruct us to in order for us to fulfil the design, marketing and website services we provide to them. This could be personal data supplied to us or that of visitors to our clients’ websites; either supplied via forms or used to manage the website's performance. As a data processor, it is our responsibility to keep this information secure and confidential and to process it only in the ways agreed by our clients when they engage our services.

Data supplied to us by our clients Clients should only supply us with personal data they wish us to process on their behalf that is compliant with their internal data protection policies and necessary for them to share with us in order for us to fulfil our Terms of Service. In the rare instances where personal data is shared with us for these purposes, it usually consists of non-sensitive information such as staff and/or governor names and work email addresses and is used for front-end website population.

Photography When we undertake photography for our clients we store the images on our secure Dropbox account and limit access to only those employees who require it. We only hold these images for as long as is necessary to perform the services commissioned by our clients. We may also supply the files to our clients using WeTransfer which has robust security measures, deletes files within a limited expiry time, is located in the EU and is therefore governed by the EU's data protection laws and is ISO 27001 certified.

Data collected or processed through our clients’ websites The types of information that we may process via our clients’ websites are outlined below: Type of data

Examples of data

Purpose

CMS Users

Essential data on registered CMS users including Name, work email, username, password

Authorising access for CMS users, contacting users regarding website service updates. At no point can we view current or previous passwords which are fully encrypted within the CMS.

CMS Data

All content on the website (eg news items, information, photos, contact details etc) all of which may include personal information depending on what our client (the data

Information displayed on front-end of the website

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

controller) chooses to publish CMS Forms

Any data the data controller chooses to request via their website. The most common form on our clients’ websites is the contact form which consists of Name, telephone number, email address.

Facilitating communication with users and minimising administration tasks

Online Forms The form builder tool allows our clients to create forms on their websites. Clients control and manage their website forms and Cleverbox does not monitor what information is being asked for. As default, new forms are set to NOT STORE DATA and instead send submissions directly to a school email address. Clients must actively choose to store form submission data for each form they create. It is important that our clients regularly review any forms on their website to ensure the information they are requesting, how they use it and their retention and deletion procedures comply with their obligations under UK GDPR as a data controller. Before instructing Cleverbox to create a bespoke form on their behalf or creating any new forms themselves via the built in form builder, regardless of whether or not they are storing data on their website, clients must ensure they have undergone an appropriate Data Protection Impact Assessment for the information they are requesting. This is essential, especially if a client chooses to collect data via a form that constitutes “special category” data under Article 9 of UK GDPR. This includes children’s ethnic origin, special educational needs (SEN), and health-related information such as dietary requirements. Special category data requires an explicit condition under Article 9(2) in addition to a lawful basis under Article 6. As Cleverbox acts as a data processor in these cases, it is the responsibility of the school or Trust as data controller to identify and document the appropriate Article 9 condition before collecting such data. Cleverbox recommends that clients seek specialist data protection advice before implementing any form that collects special category data.

Below are examples of website forms clients may wish to implement on their websites and the types of data they may collect.

Form

Examples of data collected

Contact/Enquiry Form

Name, email, telephone number, message field (can contain any information the user decides to disclose)

Hire our Facilities Form

Name, email, telephone number, message field (can contain any information the user decides to disclose)

Student Application ​ / Registration Form

Child’s Name, Child’s Date of Birth, Child’s Gender, Child’s Current School, Child’s Ethnic Origin, Child’s Special Educational Needs, Parents’ Names, Parents’ Address, Parents’ Phone (mobile & home), Parents’ Occupations

Bullying Report Form

Student Name, Parent Name, Student year at school, Who is being bullied, Open text fields asking for more information (this can be any type of information the user decides to disclose)

Teacher Event / Course Booking Form

Name, Telephone, Email Address, School, Dietary or Special requirements text field (this can be any type of information the user decides to disclose)

Anonymised data When someone visits one of our clients’ websites, we automatically receive and record information on our server logs from the user’s browser, including IP address, website cookie information, and the page requested.

These logs are used for server analysis, security and debugging and are securely kept for 30 days before being erased.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

Cookies Our clients’ websites do not generate any first-party Targeting cookies. We use session cookies which are essential to the running of our websites and are kept for the duration of a user’s visit. These keep track of things such as the session ID itself and whether the visitor has chosen to view in high visibility mode.

Google Analytics Our websites use Google Analytics to collect information about visitor behaviour. Google Analytics stores information about what pages have been visited, how long a user is on the site, how they arrived at the site, what was clicked and what documents were downloaded. This Analytics data is collected via a JavaScript tag in the pages of our clients’ websites and is not tied to personally identifiable information. We do not collect or store personal information such as name or address and so this information cannot be used to identify an individual. Find out more about Google’s position on privacy as regards its analytics service at https://policies.google.com/privacy Our websites do not serve ads and therefore we have no need to collect our process users’ personal information beyond what is required for the functioning of the website.

Other Third-party Services Cleverbox are not responsible for any cookies set by or data captured through third-party services linked to or integrated with our clients’ websites such as: social media platforms including Facebook, twitter, instagram, LinkedIn, YouTube and vimeo; payment services such as PayPal, ParentPay, SagePay; VLEs; digital publishing platforms such as Issuu; third party form builders such as Zoho Forms and Machform; or any other third party website or service such as blogs, analytics tools or vacancy managers with which a client has a direct contract.

4. Data Retention & Destruction We only keep personal data for as long as we need to in order to fulfil our Terms of Service and/or for as long as we have permission to keep it. On termination of a contract with one of our clients, we will continue to hold the client contact details we need for our financial records and legitimate business interests only for as long as is necessary.

Data destruction of physical media Physical media is defined as any physical materials that can be touched or felt that are used to store or transmit information. This can include paper/printed records such as invoices, meeting notes and extends to computer hard drives, memory sticks, or entire devices such as mobile phones, laptops etc.

Paper based or printed media All print based personal data must be securely stored within the company and only kept for as long as is necessary. All sensitive personal data will be classified as confidential and must be treated as such in it’s destruction. Up until the point of complete media destruction the document(s) must remain secure from disclosure to unauthorised persons.

Any printed media containing personal data that has been marked for destruction must be securely shredded on-site within 24 hours and not be able to be reconstituted after destruction.

Computer Hardware Cleverbox has identified the following computer hardware that falls under this policy; ●​ Hard Drives (desktop, laptop or external) ●​ USB based storage / Data Sticks / thumb drives etc ●​ Copiers and Scanners (where the device contains memory or storage) ●​ Mobile Phones, Tablets

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

When marked for destruction, any hardware containing personal data will be restored to factory settings and if required, outsourced to a specialist destruction agency.

Data destruction of digital media Digital media is defined as information that you cannot physically touch and is held on one or more physical devices (such as a file on a computer, or a record in a database). Once this media type has been classified as to be destroyed it must be done so in 24 hours.

For the secure erasure of all digital media from a device containing personal data (such as the data erasure or formatting of a hard drive or memory stick) data internally undergoes strict erasure conforming to the standards as set out by the UK government.

For any media containing personal data rated sensitive, Cleverbox holds an audit log recording the destruction title, date of destruction and party responsible.

The data we process on behalf of our clients Data supplied directly to us We will only keep data that is supplied to us for as long as is necessary to fulfil our contractual obligations and will delete or dispose of any supplied personal data after completion of a project.

Data collected via forms on our clients’ websites It is the responsibility of the school/Trust as the data controller to manage and delete any data collected and stored via forms on their website. The CMS has tools as standard to facilitate the downloading, managing and deletion of any stored data as the data controller chooses. Cleverbox recommends that any data collected via a website form is sent directly to a client email and not stored within the website database. Cleverbox cannot, on our own authority, delete data that the data controller has chosen to store in the CMS. Termination of your website contract On termination of your website contract, we may hold a backup of your website for up to 30 days before deleting it, including any personal data that may be stored within the website’s database.

5. Storing of data and sub-processors Where the data we process on our clients’ behalf is stored All data that Cleverbox stores on our clients’ behalf is held and processed in one of three physical EU locations.

Hosting Environment: The websites that Cleverbox provide are hosted by Amazon Web Services near Dublin within the Republic of Ireland; and for Wordpress, by CloudNext in the United Kingdom.

Development Environment: Our ‘Development’ environment stores a complete copy of our clients’ websites and data. This environment is used to make additional developments and changes to your website and provide testing before it is deployed to the live environment/website. The development environment is also used for ‘debugging’ purposes, that is to find, replicate and patch problems reported to our websites. Our development environment is located in the UK. Cleverbox Offices: Any personal data that our clients may supply to us in order to populate their website or to fulfil other design and marketing services may be kept on our secure servers in the Cleverbox offices in Bromley, UK. We restrict access to any supplied data and only retain it for the life of the project.

Backup and recovery procedures Cleverbox have technical security measures in place to allow for access to and recovery of essential data in the event of a disruption to critical IT services or damage to IT equipment or data. These processes will ensure that

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

those assets are recoverable to the right level and within the right timeframe to deliver a return to normal operations, with minimal impact on the business and our ability to service our clients.

All our clients’ websites are backed-up nightly for a period of 1 week. Backups older than 1 week are automatically deleted.

Our trusted sub-processors For Cleverbox to operate and provide the support for the delivery of our services we engage and use other data processors to collect, hold, and process data. The purpose of this processing is either to assist in the running of our business in our role as a data controller, or to assist in providing services to our clients in our role as a data processor (each defined as a sub-processor).

Cleverbox will not engage any sub-processor which cannot demonstrate compliance with UK GDPR and other applicable data legislation including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses for any data transferred outside of the EU or EEA . Our sub-processors are given access to only the personal data that is necessary and are bound by the principles of this Policy and relevant Data Protection law. We regularly review contracts and performance regarding data protection.

Cleverbox will not engage any new sub-processors for the handling of personal data that we process on our clients’ behalf without the consent of the data controller and will never transfer the data we process on our clients’ behalf outside of the EU or EEA without prior consent of the data controller.

The following sub-processors are used by Cleverbox in our role as a data controller in order to perform our business requirements (i.e. managing our client contact information).

Sub processor

Processing activities

Location

Pipedrive

Cloud-based customer relationship management software​ Type of data: Client contact details

AWS Servers EU/Global

Quickbooks

Cloud-based accounting software Type of data: Client contact details

AWS Servers EU/Global

Zendesk

Cloud-based customer support service Type of data: Client contact details

AWS Servers EU/Global

Adobe Sign

Online approval system Type of data: Client name and email address

AWS Servers EU/Global

Dropbox

File storage and backup Type of data: Client estimates with contact details

United States

123 Reg Inc

Domain Registration Type of data: Client contact details

United Kingdom

The SSL Store

SSL Intermediary Type of data: Client contact details

AWS Servers US

WeTransfer

Secure file transfer service Type of data: Photography, confidential data

EU/US

The following sub-processors are used by Cleverbox in our role as a data processor. (i.e. managing the data our clients may collect or share with us to deliver the website services we provide).

Amazon Web Services Cloud service hosting provider Type of data: Website data

EU

Pax 8

United Kingdom

AWS Server infrastructure support Type of data: Website data

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

CloudNext

Cloud service hosting provider Type of data: Website data

United Kingdom

Evo

Development backup and AWS server infrastructure support Type of data: Website data

United Kingdom

Squid40

Wordpress website support Type of data: Website data

UK/EU

Rackspace Inc

Cloud Service Provider Type of data: Website data

United Kingdom

Google Analytics

Cloud-based analytics platform Type of data: Website visitor behaviour data

Global

Dropbox

File storage and backup Type of data: Website content

United States

6. Data Subject Access Rights Subject access request procedure Unless otherwise specified you have the following rights as a data subject or data controller working with Cleverbox in accordance with data protection laws and regulations.

1.​ 2.​ 3.​ 4.​ 5.​

The right to request a copy of any personal data we hold directly about you in a universally accessible format The right to request that any personal data stored be corrected if it is found to be inaccurate or out of date.

The right to request that any personal data stored is erased when it is no longer necessary for Cleverbox to retain The right to withdraw consent for personal data to be stored where consent was the legal basis for storing data The right to object to the processing of personal data

To enable us to trace any of your personal data that we may be holding, we may need to request further information from you. On receipt of a request, Cleverbox will follow our Subject Access Request Procedure which includes the following steps: verify the identity of the data subject, review the impact releasing any data may have on other individuals and record the request and decisions made throughout the process. Once deemed to be appropriate, Cleverbox will provide the data in a secure digital format in accordance with our Information Security Policy.

The General Data Protection Regulation limits our response time to all requests to one month (or 30 days) from the date received. If you have a complaint about how we have used your information, you have the right to complain to the Information Commissioner’s Office (ICO).

Subject access requests for the data we process on our clients’ behalf If we receive a subject access request directly from one of our clients’ end users, we will pass this request on to the school or Trust without delay. We will take all appropriate measures to assist them with fulfilling their obligations to respond to such requests. We cannot provide, rectify or delete any data that we store on behalf of our users or customers without their permission.

7. Data Portability All digital personal data held and processed by Cleverbox must be easily exportable in an open supported format that allows for easy transfer to another digital platform.

On receipt of a Data Portability Request (DPR), once the request has been verified and authorised, Cleverbox will provide the requested information in an open format. We can provide the data in a specific format if that format is provided to us and it is a format we support. We support file types such as json, xml and csv.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

Our website CMS contains an ‘export’ button by default that allows our clients to filter and export their own data subjects’ data in a portable manner. For more custom requests our clients can contact us (Their data processor) and we will assist where possible.

8. Data Security Incidents We take great care with any data we process and follow strict organisational and technical security measures to help ensure we keep it confidential and secure in order to avoid destruction, loss, alteration, disclosure or unauthorised access. Cleverbox employees are educated in data breach awareness. In the event of a security incident or breach, Cleverbox will follow our Data Breach Incident Response Plan which includes immediately reporting a suspected breach, containment of the breach, assessment of any risks, reporting the incident when necessary to the ICO and appropriate parties within statutory time frames, documenting decisions, evaluating the response and mitigating the risk of any future incidents.

Risks to data subjects’ rights and freedoms for the types of data we process In our role as a data controller: As a company we process very little sensitive personal data on our employees and only the necessary work contact details of our clients, all of which is in our legitimate business interests to process.

The table below outlines the data we process regarding our clients and the potential risks to data subjects’ rights and freedoms: Client data: Held on Cleverbox Servers or Cloud-based CRM and project management software Type of data

Data Incident

Name Destroyed/​ Work email address Lost Work telephone Altered Disclosed/​ Accessed

Risks to Data Subjects

Likelihood Severity

Overall

Client may experience a delay in communication Remote from Cleverbox until details are recovered

Minimal

Low

Client may experience a delay in communication Remote from Cleverbox until details are recovered

Minimal

Low

Client could receive unwanted communications to their work telephone or email

Significant Medium

Remote

CMS User Information: Held on AWS /CloudNext servers Type of data

Data Incident

Name Destroyed/​ Work email address Lost Username Altered Password Disclosed/​ Accessed

Risks to Data Subjects

Likelihood Severity

Overall

User will not be able to login and will need to reset password

Remote

Minimal

Low

User will not be able to login and will need to reset password

Remote

Minimal

Low

User may be held accountable for any results of unauthorised access until issue is resolved

Remote

Significant Medium

In our role as a data processor: As standard our client websites use forms that send information directly to a client email and do not store data. If the client (data controller) chooses to store the data they collect via forms on their website, this could consist of any data they choose to request. In most cases this consists of Name, Email and Contact details and does not include any sensitive or special category personal data. If a client chooses to request any sensitive data via their website, it is their responsibility to document this. The risks to individuals if this information were to be destroyed, lost, altered, disclosed or accessed without authority should be outlined in the Data Protection Impact Assessment performed by the data controller before such information is collected.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

The table below outlines the standard types of data requested via the most common forms on our clients’ websites and the potential risks to data subjects’ rights and freedoms: CMS Forms: Held on AWS/CloudNext servers We recommend that clients do not store form submission data on their website. If they choose to do so, this can be data captured through any form the data controller chooses to implement on their website. ​ This example is for a common Enquiry Form Type of data

Data Incident

Risks to Data Subjects

Likelihood Severity

Overall

Name Telephone number Email address Enquiry message

Destroyed/​ Lost

End user may not receive answer to their enquiry in a timely manner and be required to make contact again

Possible

Minimal

Low

Altered

End user may not receive answer to their enquiry in a timely manner and be required to make contact again

Possible

Minimal

Low

Disclosed/​ Accessed

End user could receive unwanted communications via telephone or email

Possible

Significant Medium

Ratings are based on the following scale Likelihood Severity

Remote

Possible

Probable

Minimal

Low

Low

Medium

Significant

Low

Medium

High

Severe

Medium

High

High

9. Data assurance and our obligations We take our obligations under the UK GDPR extremely seriously and have assessed our processing activities to establish the reasonable and appropriate safeguards we need to implement in order to protect any personal data we process. We do not perform large scale, regular and/or systematic monitoring of individuals; nor do we perform large scale processing of special categories of data or data relating to criminal convictions and offences. As a small company with fewer than 250 employees we have appointed a member of staff who will perform such duties that will move towards and keep our compliance in line with the requirements of UK GDPR. The Data Representative, Karen Pryor, can be contacted in regards to any exercise of your rights, queries or complaints via email at karen@cleverbox.co.uk or via telephone 0208 466 7222.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk