This Data Processing Agreement governs the processing of personal data when an organisation uses Total Track. It forms part of the agreement between the parties and is made under Article 28 of the UK GDPR.
Processor: Malachi Jack Burnett trading as Wiizard Software ("Wiizard Software").
Controller: the organisation or provision using Total Track ("the organisation"), unless another written agreement says otherwise.
Where this agreement conflicts with any other term between the parties, this agreement takes precedence on matters of data protection.
1. Subject Matter And Duration
Subject matter. Wiizard Software processes personal data to provide, host, maintain, secure, support and administer the Total Track platform for the organisation.
Duration. Processing begins when the organisation starts using Total Track and continues for as long as it does. After the service ends, processing continues only for the period needed to complete export or deletion, for backups to expire, and for any legal obligation or dispute. That period will not exceed 90 days from the end of the service, other than for data retained under a legal obligation.
2. Nature And Purpose Of Processing
Processing includes collecting, storing, organising, displaying, updating, transmitting, exporting, backing up, restricting and deleting personal data as needed to run the platform. The purpose is to let the organisation record and manage young person information, staff accounts, parent/carer links, permissions, media, exports, retention and deletion, and related provision administration.
3. Categories Of Data Subjects
Young people; parent/carers and others with parental responsibility; staff and admin users; organisation contacts; Wiizard Software support and business contacts.
4. Categories Of Personal Data
- Names, nicknames, dates of birth, pronouns, contact details, usernames, roles and account information.
- Celebrations, session notes, milestones, termly targets and EHCP outcomes.
- Staff notes about a young person, including interests, regulation strategies and known triggers.
- Photographs and other uploaded media.
- Parent/carer links to young people.
- Email verification, password reset, login email code and protected admin action records.
- Export files and deletion workflow records.
- Security and system logs.
- Support, onboarding and invoicing correspondence.
Special category data (Article 9). The platform processes data concerning health and, by inference, disability and SEND status: medical and accident logs including injury descriptions and first aid given; medication records including name, dose, who administered and who witnessed; allergy and other health-related consent alert tags; EHCP outcomes and the fact a young person has an EHCP.
No criminal offence data is processed by design. The organisation must not record criminal offence data in free-text fields.
5. Controller Instructions
Wiizard Software processes personal data only on the organisation's documented instructions, including on international transfers, unless required to do otherwise by law. Where the law requires processing without instruction, Wiizard Software will inform the organisation first unless the law prohibits that.
The organisation's documented instructions are: this agreement, the Total Track documentation, the configuration the organisation sets in the platform, and any further written instruction the parties agree.
Wiizard Software will tell the organisation promptly if, in its opinion, an instruction infringes data protection law.
6. Confidentiality
Wiizard Software ensures that every person authorised to process the organisation's personal data is bound by an appropriate duty of confidentiality that survives the end of their engagement, and understands their data protection responsibilities.
Wiizard Software will tell the organisation, on request, who holds administrative access to the production environment.
7. Security
Wiizard Software implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to individuals. The measures in place are set out in Annex B. Wiizard Software will not reduce the overall level of security during the term.
8. Sub-processors
The organisation gives general written authorisation for Wiizard Software to engage sub-processors, subject to this clause. Current sub-processors are listed in Annex A.
Wiizard Software will give the organisation at least 30 days' notice before adding or replacing a sub-processor. The organisation may object on reasonable data protection grounds within that period. If the parties cannot resolve an objection, the organisation may terminate the affected part of the service without penalty and receive a pro-rata refund of any prepaid fees.
Wiizard Software will impose data protection obligations on each sub-processor that are no less protective than those in this agreement, and remains fully liable to the organisation for its sub-processors' performance.
9. International Transfers
Wiizard Software keeps the Total Track deployment, its database and its backups within the United Kingdom.
Some sub-processor activity, specifically email delivery and network routing, involves transfers outside the UK. Those transfers are listed in Annex A with the safeguard relied on for each. Wiizard Software maintains a transfer risk assessment for each transfer and will make it available to the organisation on request.
Wiizard Software will not transfer the organisation's personal data outside the UK except in accordance with Annex A or on the organisation's written instruction.
10. Assistance With Data Subject Rights
Wiizard Software will, taking into account the nature of the processing, assist the organisation by appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise data subject rights.
If Wiizard Software receives a request directly from a data subject relating to the organisation's data, it will not respond to it itself. It will forward the request to the organisation within 3 working days and assist as asked.
The platform provides self-service tools for access, portability and erasure. Where a request needs work beyond those tools, Wiizard Software will respond to the organisation within 5 working days, so the organisation can meet its own one-month deadline.
11. Personal Data Breaches
Wiizard Software will notify the organisation without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the organisation's personal data.
The notification will include, so far as known at the time and supplemented without undue delay as more becomes known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for further information.
Wiizard Software will not make any public statement, or notify any data subject or regulator, about a breach affecting the organisation's data without the organisation's prior written agreement, unless required by law.
Wiizard Software keeps a record of all personal data breaches and will make it available to the organisation on request.
12. Data Protection Impact Assessments
Wiizard Software will provide reasonable assistance to the organisation with any data protection impact assessment and any prior consultation with the Information Commissioner, as required by Articles 35 and 36, taking into account the nature of the processing and the information available to Wiizard Software.
Wiizard Software makes available a template data protection impact assessment and a description of the processing to support this.
13. Audit And Information
Wiizard Software will make available to the organisation all information necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, conducted by the organisation or an auditor it mandates. In practice:
- Wiizard Software will respond to a written security questionnaire once per year at no charge, and on any material change to the service.
- The organisation may request an audit on 30 days' written notice, no more than once in any 12 months — unless a breach has occurred or a regulator requires it, in which case there is no limit.
- Audits take place during business hours, must not unreasonably disrupt the service, and are subject to confidentiality.
Nothing in this clause limits the audit rights the organisation has under Article 28(3)(h).
14. Return And Deletion
At the organisation's choice, at the end of the service Wiizard Software will either return the personal data or delete it, and delete existing copies, unless the law requires it to be kept.
- The organisation may export its data at any time during the term using the platform's export tools.
- Wiizard Software will act on a written instruction to return or delete within 30 days of the end of the service.
- If the organisation gives no instruction within 30 days, Wiizard Software will delete the data and confirm in writing.
- Deleted data may remain in backups until those backups expire, which is up to 30 days. Backups are not restored except for disaster recovery, and data restored from backup is re-deleted.
- Wiizard Software will provide written confirmation of deletion on request.
15. Controller Obligations
The organisation will:
- Give lawful, clear and appropriate processing instructions.
- Establish and record a lawful basis under Article 6, and an Article 9 condition for the special category data described in clause 4, together with any Appropriate Policy Document that condition requires.
- Complete a data protection impact assessment before using the platform.
- Provide privacy information to young people, parent/carers and staff.
- Determine who holds the young person's rights, particularly for post-16 young people with an EHCP, and configure parent/carer links accordingly.
- Manage user accounts and parent/carer links accurately and promptly, including removing access when someone leaves.
- Obtain and record photo consent, and act on withdrawal.
- Set an archive retention period consistent with its own retention schedule, and decide before confirming a deletion whether a copy of the record is needed and who may receive it.
- Keep its own devices, email accounts and internal processes secure.
- Tell Wiizard Software promptly about suspected incorrect access, security incidents or data protection concerns.
16. Liability
Each party's liability under this agreement is subject to the limitations and exclusions of liability set out in the main agreement between the parties.
Nothing in this agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited or excluded. Nothing in this agreement limits a data subject's rights under Article 82 of the UK GDPR.
17. Governing Law
This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Annex A — Sub-processors
| Sub-processor | Service | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Resend | Transactional email delivery | Recipient name and email address, subject line, email body. Email bodies exclude record content: no celebration or session note wording, no medical detail, no photographs. | Outside the UK | The transfer safeguards in the provider's data processing terms, with a transfer risk assessment held by Wiizard Software and available on request |
| Cloudflare | Tunnel, DNS and network protection | IP addresses, connection metadata, requested URLs | Global network | The transfer safeguards in the provider's data processing terms, with a transfer risk assessment held by Wiizard Software and available on request |
Hosting and backup infrastructure is operated by Wiizard Software and is not sub-processed to a third party.
Annex B — Technical And Organisational Measures
Access control
- Role-based access, with every permission decision enforced server-side. Checks in the browser are treated as convenience only.
- Parent/carers can access only young people linked to their account, and cannot see draft records.
- Photo visibility is recalculated against stored consent on every request, including for direct media requests.
- Administrative access to the production environment requires a private network connection and key-based authentication. Password authentication is disabled.
Authentication
- Passwords are hashed with a per-password salt using a slow hashing function. Plain-text passwords are not stored.
- Configurable password complexity rules, enforced server-side.
- Rate limiting and temporary account lockout after repeated failed logins.
- Optional email login codes, configurable for admins, all staff or all users.
- Session cookies are HTTP-only, site-restricted and sent only over HTTPS.
Separation of duties
- High-risk administrative actions require confirmation by the requester and approval by a second admin where one exists. These include creating or changing admin accounts, setting temporary passwords, deleting a parent/carer account, running a full data export, and changing password or login security rules.
- All admins are notified of the outcome.
Data minimisation in transit
- All traffic between users and the platform is encrypted in transit using TLS.
- Notification emails exclude record content. Medical and accident emails exclude the injury description, medication and dose.
- Exports exclude password hashes and single-use security tokens.
- Deletion of an archived young person does not transmit their record to anyone.
Resilience and backup
- Up to 30 daily off-site backups on separate infrastructure under the same access controls.
Logging
- Application request logging and security event logging, with single-use security tokens redacted.
Further detail on these measures, including storage encryption and backup testing, is available to organisations on request under a confidentiality agreement.
Contact
Malachi Jack Burnett trading as Wiizard Software
Email: [email protected]
Website: wiizardsoftware.uk