The short version: Before any school gives students access to Pekanga, a Data Processing Agreement must be signed. The DPA sets out Pekanga's obligations as a data processor under UK GDPR, including strict limits on how student data can be used, security requirements, breach notification, and deletion on termination. It also names every sub-processor, where each one is located, and the safeguard for the transfer to the USA. This page describes the Data Processing Agreement for Pekanga School. Advisers and consultancies who use Pekanga Advisor have a separate agreement, described on the
Advisor Data Processing Agreement page. Request the School DPA below.
Our commitments
What Pekanga commits to as your data processor
Under UK GDPR Article 28, any organisation that processes personal data on behalf of a school must operate under a formal written agreement. Pekanga's DPA is drafted to comply with UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
✓
Purpose limitation
We process client and student data only to provide the Pekanga platform. We will never use it for AI model training or advertising. Only information that has been genuinely anonymised, so individuals can no longer be identified, may be used for statistics and service improvement.
✓
Clear international transfers
Client data is stored in Ireland (the EEA). Our AI provider (Anthropic), our speech-to-text provider for student voice notes (OpenAI) and our email provider (Resend) process data in the USA, under Standard Contractual Clauses and the UK International Data Transfer Addendum. Vercel's serverless functions also run in the USA, but School student data goes directly from the browser to Supabase and does not pass through them. Each sub-processor, its location and its safeguard is listed below, and we give 30 days' notice before adding a new one.
✓
48-hour breach notification
In the event of a personal data breach, we will notify you without undue delay and, where practicable, within 48 hours of becoming aware, with the details we have of the breach, affected records, and remediation steps.
✓
No sharing with third parties
We will never share student personal data with employers, universities, advertisers, or any commercial third party. Your students' data is not a product. Only the sub-processors listed below handle data, and only to run the service.
✓
Deletion on termination
After termination you have 60 days to ask for your data to be returned or deleted, and we complete it within 30 days of your request. Deletion is carried out by Pekanga on request, not automatically.
✓
Sub-processor transparency
All sub-processors are listed in Schedule 4 of the DPA. We provide 30 days' notice before adding or replacing any sub-processor, with a right to object.
What the DPA covers
Scope of the agreement
DPA sections and schedules
- Definitions and scope of processing
- Processor obligations (confidentiality, security)
- Sub-processor authorisation and change notice
- Data subject rights assistance
- DPIA support and cooperation
- Audit rights (annual, on notice)
- International transfers and safeguards
- Liability, as set out in the Agreement (our Terms of Use)
- Schedule 1: Controller (school) details
- Schedule 2: Description of processing
- Schedule 3: Security measures
- Schedule 4: Approved sub-processors
Sub-processors
Who processes data on our behalf
The following sub-processors are approved under the DPA. Each one's location is shown, along with the safeguard for any transfer to the USA.
Database, authentication and Edge Function processing. Holds client data at rest and in transit. This is where Controller client data is stored. Student and school data is stored in a Supabase database in Ireland (EEA).
Vercel
Functions in the USA
Serves the School web app to the browser. Vercel's serverless functions run in the USA, but School student data goes directly from the browser to Supabase and does not pass through them.
Anthropic (Claude API)
Transfer to the USA
AI content generation through Anthropic's commercial API, sent server-side and limited to what is needed to generate the report, with no persistent client identifiers sent where technically practicable. Inputs and outputs are not used to train Anthropic's models, and are kept by Anthropic only for a limited period before being automatically deleted. The transfer to the USA is made under the EU Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum, as incorporated into our Data Processing Addendum with Anthropic.
OpenAI
Transfer to the USA
Speech-to-text for student voice notes in the chat. Pekanga does not keep the audio or the transcript beyond the message the student sends. According to OpenAI's published API data controls, the audio transcription service is not subject to abuse-monitoring retention and does not store the audio or the transcript as application data. Data sent to the OpenAI API is not used to train its models. The transfer to the USA is made under the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.
Real-time speech-to-text for live session recording by staff and advisers. Live session audio goes from the browser straight to Speechmatics' EU endpoint and is not stored. Training on customer data is disabled on our account and covered by our signed agreement with them.
Resend
Transfer to the USA
Sends reports from the Controller to their clients when the send-to-client feature is used. Also sends staff emails (invitations, password resets and safeguarding alerts). Holds transactional email content only. The transfer to the USA is made under the EU Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum.
Processes the Controller's subscription payment. Holds payment data only and does not process client data.
Age: Pekanga is for students aged 13 and over (Year 9 upwards), used through a school. Under 13 only where the school has agreed it in writing with Pekanga. The platform does not check age: the school is responsible for who it gives access to.
Analytics: Usage records, including the student's name and ID for signed-in students, are stored in our own database and are visible to the school's staff. No student personal data is sent to a third-party analytics service.
Request the DPA
Ready to go live with your school?
Email us and we'll send you the full Data Processing Agreement, pre-populated with Pekanga's details, for your Data Protection Officer or legal team to review. We aim to respond within one working day.
Pekanga Ltd, company number 17216579, ICO registration ZC172552, registered office 66 Paul Street, London EC2A 4NA. The DPA has been drafted to comply with UK GDPR Article 28, the Data Protection Act 2018, and the Data (Use and Access) Act 2025. It should be reviewed by your school's Data Protection Officer or a qualified data protection solicitor before execution. This page does not constitute legal advice. Pekanga Ltd (company number 17216579) is registered with the ICO (registration number ZC172552). Version 2.0, October 2026.