Data Processing Terms

Version 2026-09-24.1

These terms apply when an institution enters personal information about students, staff or other people into Engineering HA Assure.

1. Instructions

We process personal information only to provide the service and on the institution's documented instructions, which are the service configuration and these terms.

2. Confidentiality

Anyone we authorise to process the information is bound by confidentiality.

3. Security

We maintain the security measures described in the Privacy Policy and review them regularly.

4. Sub-processors

Cloudflare (hosting, database and file storage) and Stripe (payments, for billing contacts only). We will give 30 days' notice before adding a sub-processor that handles student information.

5. Breach notification

We will notify the institution without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting its data, with the information it needs to meet its own obligations.

6. Assistance

We will help the institution respond to access and correction requests, and to audits by regulators, including by exporting records.

7. Return and deletion

At the end of the subscription the institution may export all data for 60 days; we then delete it.

8. Audit trail

Every change and every auditor view or export is logged in an append-only audit trail the institution can read.

Document fingerprint (SHA-256): ff2924d0bb8a59b72423d40537aa9fcf5e260ec5a2db1aa9073f9e14abd4019e