C3NTR Data Processing Agreement

Version 1.2 — Effective 30 September 2026 (first published 10 June 2026)

Changes in this version: clause 2.4 (Controller warranties), clauses 5.3, 6.1 and 10.1, clause 11 (Return and Deletion), clause 12 (Liability), and Annexes I to IV. Previous versions are available on request from info@c3ntr.app.

Source (markdown)  ·  Press ⌘P to save this page as a signable PDF.

This Data Processing Agreement (“DPA”) forms part of the agreement between andBeyond.digital Ltd, a company registered in England & Wales, which provides the C3NTR service (“Processor”, “C3NTR”), and the customer school identified in the C3NTR portal (“Controller”, “School”), governing the processing of Personal Data by C3NTR on the School’s behalf in connection with the C3NTR service.

This DPA reflects the parties’ agreement on the processing of Personal Data in accordance with the requirements of the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), and, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”). Together these are referred to as “Data Protection Laws”.

1. Definitions

Terms used in this DPA that are defined in the Data Protection Laws (including Personal Data, Processing, Data Subject, Controller, Processor, Sub-processor, Personal Data Breach, Supervisory Authority) have the meanings given in those laws.

Services means the C3NTR mobile application, web portal, and supporting infrastructure made available by the Processor to the Controller under the C3NTR subscription agreement.

School Personal Data means Personal Data Processed by the Processor on behalf of the Controller in the course of providing the Services.

2. Roles and Responsibilities

2.1 The parties acknowledge that, for the purposes of the Data Protection Laws, in respect of School Personal Data:

• the Controller is the School; and
• the Processor is C3NTR.

2.2 The Controller determines the purposes and means of the Processing of School Personal Data. The Processor processes School Personal Data only on the documented instructions of the Controller, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by applicable law.

2.3 Each party will comply with its respective obligations under the Data Protection Laws.

2.4 Controller warranties. The Controller warrants and undertakes that:

(a) it has a lawful basis under the Data Protection Laws for the Processing of the Personal Data of every member it enrols in the Services and of every person it invites;

(b) it has given the privacy information required by the Data Protection Laws to its members and, for any member under 18, to that member’s parent or guardian;

(c) it has the authority of a parent or guardian to enrol anyone under 18, and will not enrol anyone under 18 without that authority. The Processor does not verify a member’s age and relies on this warranty;

(d) it will not upload or enter special-category data (including health, injury or medical information) into the Services without first telling the Processor in writing at info@c3ntr.app. The Services are not designed to hold such data, and the Processor may decline to Process it; and

(e) it is responsible for the accuracy of the invitation data (names and phone numbers) it uploads, including for anyone it invites who never joins, and for telling those people that their details have been shared with the Processor. An invited person has no relationship with the Processor until they join.

3. Subject Matter and Duration

3.1 Subject matter: the provision of the C3NTR mobile application and web portal as a school knowledge platform to the Controller’s students, instructors, and administrators.

3.2 Duration: this DPA remains in effect for as long as the Processor processes School Personal Data on behalf of the Controller under the C3NTR subscription agreement, and survives termination to the extent necessary for the Processor to comply with its obligations under clause 11 (Return and Deletion).

3.3 Nature and purpose of Processing: hosting, storing, displaying, indexing, and delivering the Controller’s curriculum content and roster to the Controller’s school members; processing aggregate engagement analytics for the Controller’s own use; sending in-app and push notifications on the Controller’s behalf; recording event attendance responses and grade progression on the Controller’s instructions; and supporting authentication and access control.

3.4 Types of Personal Data: the categories set out in Annex I, including identification data (name, phone number, email), school-membership data (role, grade level, status), behavioural data (reading progress, favourites, last login, notification preferences, event attendance responses, grade progression and grading history), invitation data (names and phone numbers of people the Controller invites), eligibility data (the age band the Controller sets for each member and, for a member under 13, the name and phone number or email address of a parent or guardian and whether the Controller has recorded telling them), and any Personal Data the Controller chooses to include in its curriculum content, media or roster import.

3.5 Categories of Data Subjects: the Controller’s school members, including students (who may be under 18, including under 13), instructors, assistant instructors, school administrators, and school leaders; and people the Controller invites who have not yet joined or never join.

4. Processor Obligations

The Processor shall:

(a) Process School Personal Data only on the documented instructions of the Controller, including with regard to transfers to a third country, unless required to do otherwise by applicable law (in which case the Processor will inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest);

(b) Ensure that persons authorised to Process School Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) Implement the technical and organisational security measures described in Annex II to protect School Personal Data;

(d) Respect the conditions set out in clauses 5 and 6 of this DPA for engaging Sub-processors;

(e) Taking into account the nature of the Processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller’s obligation to respond to requests for exercising Data Subjects’ rights under Chapter III of the UK GDPR;

(f) Assist the Controller in ensuring compliance with the obligations pursuant to UK GDPR Articles 32 to 36 (security of Processing, notification of Personal Data Breaches, data protection impact assessments, and prior consultation), taking into account the nature of Processing and the information available to the Processor;

(g) At the choice of the Controller, delete or return all School Personal Data to the Controller after the end of the provision of Services relating to Processing, and delete existing copies unless applicable law requires storage of the Personal Data (see clause 11);

(h) Make available to the Controller all information necessary to demonstrate compliance with this DPA and the Processor’s obligations under UK GDPR Article 28, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller (see clause 10).

5. Sub-processors

5.1 General authorisation. The Controller provides general authorisation for the Processor to engage Sub-processors to process School Personal Data, subject to the requirements of this clause.

5.2 Current Sub-processors. The current list of Sub-processors is published at c3ntr.app/subprocessors and forms Annex III of this DPA.

5.3 Change notification. The Processor will give the Controller not less than 30 days’ prior written notice of any intended addition or replacement of a Sub-processor by updating the published Sub-processor list and by email to the Controller’s designated point of contact (clause 8.1). The Controller may object to the change on reasonable data-protection grounds within that 30-day window. If the parties cannot resolve the objection, the Controller may terminate the affected portion of the Services without penalty.

5.4 Processor obligations. The Processor will impose written terms on each Sub-processor that provide at least the same level of protection for School Personal Data as those required by this DPA, and remains fully liable to the Controller for the performance of each Sub-processor’s obligations.

6. International Transfers

6.1 School Personal Data is hosted in Google Cloud region europe-west2 (London, United Kingdom) and processed by Cloud Functions in the same region. The web portal is served from Google Cloud region europe-west4 (Netherlands, EEA). School Personal Data is stored and processed in the United Kingdom and the EEA. Push-notification delivery and crash reporting use Google’s global infrastructure under the safeguards in clause 6.2.

6.2 Where any ancillary infrastructure operated by a Sub-processor incidentally processes Personal Data outside the United Kingdom or the EEA, the Processor relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or equivalent valid transfer mechanism in force at the relevant time) to ensure an essentially equivalent level of protection.

7. Security of Processing

7.1 The Processor implements the technical and organisational measures described in Annex II to ensure a level of security appropriate to the risk, taking into account the state of the art, the cost of implementation, the nature, scope, context, and purposes of Processing, and the risk to the rights and freedoms of Data Subjects.

7.2 The Processor regularly reviews and updates those measures.

8. Personal Data Breaches

8.1 Notification to Controller. The Processor will notify the Controller’s designated point of contact (the email associated with the schoolLeader account in the C3NTR portal) without undue delay and in any event within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting School Personal Data, providing such information as is reasonably available to the Processor at the time of notification (including the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed).

8.2 Assistance. The Processor will provide reasonable assistance to the Controller, taking into account the nature of the Processing and the information available to the Processor, in:

• Notifying the Supervisory Authority (UK GDPR Art. 33), where the Controller is required to do so;
• Communicating the breach to affected Data Subjects (UK GDPR Art. 34), where required;
• Documenting the breach in accordance with UK GDPR Art. 33(5).

8.3 No admission of fault. Notification of a Personal Data Breach under this clause does not constitute an acknowledgement by the Processor of any fault or liability.

9. Data Subject Rights

9.1 The Processor will assist the Controller, by appropriate technical and organisational measures and insofar as possible, in responding to requests by Data Subjects to exercise their rights under UK GDPR Articles 15 to 22 (access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making and profiling).

9.2 The Processor will promptly notify the Controller of any request received directly from a Data Subject relating to School Personal Data and will not respond to that request itself except on the documented instructions of the Controller, unless required to do so by applicable law.

10. Audits

10.1 The Processor will make available to the Controller, upon reasonable written request and no more than once in any twelve-month period (unless required more frequently by a Supervisory Authority), the information reasonably necessary to demonstrate compliance with the Processor’s obligations under this DPA, including the Processor’s privacy and security policies and, where they exist, independent security audit reports and penetration-test summaries.

10.2 The Controller may, at its own expense and on at least thirty (30) days’ written notice, request to inspect the Processor’s data-processing facilities or commission an independent third-party auditor (subject to confidentiality undertakings) to conduct an inspection. Inspections shall be conducted during normal business hours, with minimum disruption to the Processor’s business operations, and shall not extend to confidential information of other customers of the Processor.

11. Return and Deletion

11.1 Request. Within thirty (30) days following the termination or expiry of the C3NTR subscription agreement, the Controller may request in writing (to info@c3ntr.app) the return of School Personal Data, its deletion, or both. The Processor will also act on a request made after that window, for as long as it still holds the data.

11.2 Return. On request, the Processor will provide an export of the School Personal Data in a structured, commonly used, and machine-readable format within thirty (30) days of the request. While the School’s account is open, a School leader can also download that export directly from School details in the mobile app, after confirming a code sent to their phone.

11.3 Deletion. On request, the Processor will delete the School Personal Data from its live systems within thirty (30) days of the request and confirm the deletion to the Controller in writing. Any backup copy expires within ninety (90) days of that deletion.

11.4 Deletion without a request. The Processor does not delete School Personal Data automatically on termination or expiry. Unless and until the Controller requests deletion under this clause or deletes the School from within the Services, School Personal Data remains in the Processor’s systems and continues to be protected under this DPA. Independently of the Controller, the Processor applies the retention schedule published in its Privacy Policy: a member account with no sign-in for twenty-four (24) months is deleted automatically (the member is warned at twenty-one (21) months), invitation records are deleted thirty (30) days after use or twelve (12) months if unused, and operational logs are deleted within the periods stated there. An individual member can delete their own account from within the app at any time; this removes their account, profile, memberships, invitation entries, favourites, reading progress, event responses, grading history, feedback and device push registration, and removes their account id from content they authored. A School leader can delete the whole School from within the app; this deletes the School Personal Data from the Processor’s live systems at once (Stripe billing records excepted, kept only as long as accounting law requires) and is treated as a deletion request under clause 11.3.

11.5 Payment suspension. If access to the Services is suspended for non-payment, School Personal Data is retained, not deleted, during the suspension.

11.6 Legal retention. The Processor may retain School Personal Data to the extent and for the period required by applicable law, in which case the Processor will continue to ensure the confidentiality of that data and will Process it only as necessary for the purposes specified in that applicable law.

12. Liability

12.1 The liability of each party under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the C3NTR Terms of Service (the “Terms”, being the C3NTR subscription agreement referred to in this DPA).

12.2 Subject to the Terms, the total aggregate liability of each party under or in connection with this DPA, for all claims in any twelve-month period, shall not exceed the greater of (a) the fees paid by the Controller to the Processor in the twelve (12) months preceding the first claim and (b) £100,000. This DPA does not increase or vary the aggregate liability of the parties beyond the cap in the Terms.

12.3 Nothing in this DPA excludes or limits either party’s liability for fraud, for death or personal injury caused by its negligence, or for any other liability that cannot be excluded or limited by law.

13. General

13.1 Order of precedence. In the event of a conflict between this DPA and the C3NTR subscription agreement, this DPA prevails to the extent of the conflict, but only in relation to the Processing of School Personal Data.

13.2 Governing law. This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with this DPA.

13.3 Amendments. Any amendment to this DPA must be in writing and signed by an authorised representative of each party.

Annex I — Description of Processing

Annex II — Technical and Organisational Security Measures

The Processor implements the following measures. Where a measure is described as planned, it is not yet in place and the Processor does not represent that it is.

1. Encryption. All data in transit between user devices and C3NTR servers is encrypted using TLS 1.2 or higher. All data at rest in Cloud Firestore and Cloud Storage is encrypted by Google Cloud’s default encryption (AES-256).

2. Authentication. End users sign in with a phone-number one-time code (mobile app) or a magic-link email (web portal). There are no passwords. Every request to the Processor’s backend must carry a valid Firebase App Check token, and authentication is rate-limited. Role checks are enforced server-side, and a staff member’s role claims are revoked when they are removed from a school. Administrative access to the Processor’s cloud infrastructure is restricted to named andBeyond.digital staff accounts. Multi-factor authentication is enforced on the Google Workspace, Google Cloud and Stripe accounts used to administer the Service.

3. Access control. Role-based access control enforced in Firestore security rules prevents members from reading records outside their role and school; students cannot read other members’ records. Uploaded media, logos and cover images are readable only by active members of the School (and by any signed-in user for starter-template schools); profile photos only by the member, staff of a school they belong to, and the Processor. Direct file links carry an unguessable key and remain usable by anyone holding the exact link until the file is deleted. Internal access is limited to the named staff accounts in measure 2.

4. Audit logs. Privileged platform-administration actions performed by the Processor’s staff (such as changing a member’s role claims, overriding a school’s plan, or creating a school) are written by Cloud Functions to an append-only audit log. Roster, content and grading records carry the identifier of the user who made the change. Cloud Function execution logs are held in Google Cloud Logging at Google’s default retention. A leader-facing audit view in the portal is planned.

5. Sub-processor management. Each Sub-processor is engaged under its published data-processing terms with a valid transfer mechanism (listed in Annex III). The Sub-processor list is published and versioned, and changes are notified under clause 5.3.

6. Data residency. Firestore, Cloud Storage and Cloud Functions run in Google Cloud europe-west2 (London). The web portal is served from europe-west4 (Netherlands). Where ancillary processing occurs outside the UK or EEA, the UK IDTA / EU SCCs apply.

7. Vulnerability management. The Processor applies security patches to its own code and its dependencies without undue delay once it becomes aware of them. Automated dependency vulnerability scanning is planned.

8. Backup and recovery. Firestore and Cloud Storage replicate data across multiple zones within the europe-west2 region as part of Google Cloud’s managed service. The Processor does not currently run a separate scheduled backup; scheduled backups with point-in-time recovery are planned. Any backup copy that is created will be encrypted, held in the same region as the primary data, and expire within ninety (90) days (clause 11.3).

9. Breach detection. Cloud Function errors and security-relevant events are written to Google Cloud Logging, and privileged actions to the audit log in measure 4. Firebase App Check rejects requests that do not come from a genuine C3NTR app or portal, and rate limiting applies to authentication and public endpoints. Automated alerting on anomalous patterns is planned. Breaches are handled under clause 8.

10. Personnel. All personnel with access to School Personal Data are bound by confidentiality obligations. Access is limited to the named andBeyond.digital staff accounts in measure 2.

Annex III — Sub-processors

The current list of Sub-processors engaged by the Processor for the Processing of School Personal Data is published at c3ntr.app/subprocessors (Version 1.1, as of 28 September 2026). That published list, with its location and transfer-mechanism columns, forms part of this DPA. Changes to the list are notified in accordance with clause 5.3. As of this version the list is:

• Google LLC / Google Cloud (Firebase) — authentication, database, storage, serverless compute, push notifications, crash reporting and web hosting. UK (europe-west2) and EU (europe-west4).
• Stripe Payments Europe Ltd — payment processing for school subscriptions. Ireland.
• Pexels GmbH — stock image and video search from the media picker; receives the search query only. Germany.
• Cloudflare, Inc. — bot protection on the marketing site’s public forms (Turnstile). United States, with EU-region edge handling.
• Anthropic, PBC and OpenAI, L.L.C. — optional AI writing assistant, engaged only when the Controller’s school leader turns the feature on with their own API key; receives the notes the leader chooses to send, not member data, sent straight from the leader’s browser or device without passing through the Processor. Listed for transparency: the provider acts on the leader’s own account. United States.
• Google Workspace (Gmail) — Google LLC — transactional email sent by the Processor’s Cloud Functions, such as billing notices to school leaders. EU/UK data regions where available.

Change note, 28 September 2026 (v1.1): Anthropic, OpenAI and Google Workspace (Gmail) were in use before the list was first published on 10 June 2026 but were omitted from it. They were added on 28 September 2026. A Controller that accepted this DPA before that date may object under clause 5.3 as if this were a notified change.

Annex IV — Signature

This DPA is entered into between the Controller and the Processor and is effective from the date the school’s leader accepts it through the C3NTR portal, or from the date of countersignature below.

The Processor will record, for each School, the version of this DPA that was accepted and the date of acceptance, and will provide that record and any previous version of this DPA to the Controller on request (info@c3ntr.app).

Controller (School)

Processor (C3NTR)

Questions about this DPA: info@c3ntr.app.