Legal Documentation
SeatPlan School Data Processing Agreement
Version draft-2026-09. Last updated: 10 September 2026
How to use this template
This is the standard agreement under which ZNZ Systems Ltd processes pupil data for schools and teachers on Classroom and School plans. Read it here, download the PDF for your procurement file, or ask us for a signed copy. It sits alongside our Student Data Privacy page and the Classroom and School plan terms.
Download the template
A4 PDF of the full agreement including the subprocessor annex and blank signature blocks.
Download the template (PDF)Request a signed DPA
Email hi@seatplan.io with the subject "DPA request" and include:
- the school's legal name and address;
- the name and title of the person who will sign;
- your licence or order reference;
- any state or UK addendum you need attached.
1. Parties and roles
- Processor: ZNZ Systems Ltd, Magnolia House, 11 Spring Villa Road, Edgware HA8 7EB, United Kingdom. Registered in England & Wales (January 2023). Trading as SeatPlan.io ("SeatPlan").
- Controller: the school, academy trust, district or other education authority named in the signature block (the "School").
- Where an individual teacher holds a Classroom plan in their own name, that teacher is the controller for their own class and this Agreement applies to them as the School.
- SeatPlan acts only as a processor of the personal data described in this Agreement and processes it only on the School's documented instructions.
2. Subject matter and duration
- Subject matter: the provision of SeatPlan's classroom seating chart service, including creating class rosters, arranging seats and printing seating plans.
- Duration: the term of the Classroom or School plan, plus the deletion and return period in section 10.
- Nature and purpose: storing, displaying, arranging and printing class rosters and seating plans on the School's behalf. SeatPlan does not use pupil data for its own purposes, for advertising or to train machine-learning models.
3. Categories of data subjects and personal data
- Data subjects: pupils of the School, and the teachers and staff who hold SeatPlan accounts.
- Pupil data: name or display name, class membership, assigned seat, and any optional tags, notes and keep-apart or sit-together rules the teacher records.
- Pupil data SeatPlan does not ask for and the School should not enter: email address, date of birth, photograph, home address, government identifiers, and login credentials. Pupils never hold accounts.
- Staff data: name, school email address, sign-in records, plan and billing details.
- The School must not enter special category data (for example health, ethnicity or religion) into free-text fields except where the School has decided it is necessary for the seating arrangement and lawful under its own policies.
4. Processing on instructions
- The School's instructions are this Agreement, the SeatPlan Terms of Service, and the configuration choices staff make inside the product.
- SeatPlan will inform the School if, in its opinion, an instruction infringes applicable data protection law.
- SeatPlan will not sell, rent or otherwise disclose pupil data to any third party except the subprocessors listed in the Annex.
5. Confidentiality
- SeatPlan ensures that staff authorised to process pupil data are bound by confidentiality obligations.
- Staff access to School data is possible only through an internal console. Each access must be justified in advance and is written to an audit record that cannot be edited or deleted, kept for 24 months. The School may request the record of who has accessed its account.
6. Security (Article 32)
- SeatPlan applies technical and organisational measures appropriate to the risk, including encryption in transit and at rest, authentication through a dedicated identity provider, and hosting of application data within Amazon Web Services in the Frankfurt region.
- SeatPlan keeps the measures described in its Privacy Policy under review and will not reduce the overall level of protection during the term.
7. Subprocessors
- The School gives general authorisation for the subprocessors listed in the Annex to this Agreement.
- SeatPlan will give the School at least 30 days' notice before adding or replacing a subprocessor that processes pupil data, by updating the published subprocessor list and emailing the School's account holders. The School may object on reasonable data protection grounds within that period, and may terminate the affected plan if the objection cannot be resolved.
- SeatPlan imposes data protection obligations on each subprocessor that are no less protective than those in this Agreement and remains liable for their performance.
Annex: authorised subprocessors
| Provider | Purpose | Region | Transfer mechanism | Pupil data |
|---|---|---|---|---|
| Amazon Web Services | Hosting, compute, the application database, file storage and the real-time collaboration server. | Frankfurt (EU) | none | Yes |
| Clerk | Sign-in and account management for teacher and school staff accounts. | United States | UK IDTA + SCCs | No. Only teachers and school staff hold accounts. Pupils are never account holders, so no pupil data reaches Clerk. |
| Stripe | Payment processing and invoicing for Classroom and School plans. | United States | UK IDTA + SCCs | No. Stripe receives the billing contact and payment details of the school or teacher, never roster content. |
| Resend | Transactional email such as sign-in links, invoices and collaboration invitations. | United States | UK IDTA + SCCs | No. SeatPlan does not ask for pupil email addresses and schools should not enter them, so school-related email is addressed to teacher and staff accounts only. |
| PostHog | Product analytics and, with consent, anonymised session replay. | United States | UK IDTA + SCCs | No. Names, guest details and other personal data are stripped before any event is sent, and on-screen text is masked in replays. |
| Sentry | Error monitoring for the application. | Germany (EU) | none | No. Error reports are scrubbed of personal data before they leave our servers and never include roster content. |
| Upstash | Redis for request rate limiting and a short-lived cache of visitor region. | Global (multi-region) | UK IDTA + SCCs | No. Holds rate-limit counters and region lookups keyed on an anonymised IP address, nothing from a class roster. |
| Country.is | Country lookup from IP address for regional pricing and consent defaults. | Not stated by the provider | UK IDTA + SCCs | No. Receives only the visitor's IP address when a page or checkout loads, never roster content. |
| Amazon Bedrock | AI extraction of tables and seats from an uploaded floor-plan image or PDF. | Frankfurt (EU) | none | No. Only the uploaded floor-plan image or PDF is sent for extraction. Pupil names and class rosters are never part of that upload. |
8. Assistance with data subject rights
- Taking into account the nature of the processing, SeatPlan assists the School in responding to requests from pupils, parents and staff to exercise their rights, including access, rectification, erasure and portability.
- The School can obtain a machine-readable JSON archive of everything SeatPlan holds for its account, and can ask SeatPlan to delete pupil data. SeatPlan acts on a verified request within 30 days.
- SeatPlan will forward to the School, without responding, any request it receives directly from a pupil or parent.
9. Personal data breach notification
- SeatPlan will notify the School of a personal data breach affecting School data without undue delay, and in any case within 72 hours of confirming the breach.
- The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.
- SeatPlan will cooperate with the School in any notification the School is required to make to a supervisory authority or to data subjects.
10. Deletion and return
- Class rosters and seating plans are deleted when the School plan ends, after the grace period described in the Terms of Service, or earlier on the School's written request. A School administrator can also run the year-end rollover from Organization settings at any time: it archives every class and deletes the pupil rows (names, seat positions, notes and tags) by default, keeping room layouts and templates; the administrator may choose to keep the rosters when running it. SeatPlan reminds the School by email on 1 July of each licence year.
- Before the plan ends, and during the 7-day grace period described in the Terms of Service, the School can export its data. On a written request made within 30 days of the end of the plan, SeatPlan will return any School data it still holds and confirm deletion of the rest.
- Invoices and payment records are retained as required by accounting law. The audit record of a deletion is kept for 24 months.
11. Audit and information
- SeatPlan makes available the information necessary to demonstrate compliance with this Agreement, including the subprocessor list, the security description in its Privacy Policy, and its staff-access audit record for the School's account.
- Where that information is insufficient, the School may conduct an audit once in any 12-month period on 30 days' written notice, at reasonable times and without disrupting the service. SeatPlan may require an independent auditor bound by confidentiality.
12. International transfers
- Application data, including pupil data, is stored in the European Union (Frankfurt).
- Where a subprocessor in the Annex processes data outside the UK or EEA, SeatPlan relies on the transfer mechanism stated in the Annex (the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum).
- For US Schools, the parties acknowledge that pupil data is hosted outside the United States and that the School has considered this in its procurement decision.
13. FERPA school official terms (US Schools)
- The School designates SeatPlan as a "school official" with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B). SeatPlan performs an institutional service for which the School would otherwise use its own employees, is under the School's direct control with respect to the use and maintenance of education records, and uses education records only for the purposes authorised in this Agreement.
- SeatPlan will not re-disclose personally identifiable information from education records except to the subprocessors in the Annex or as the School directs.
- The School remains responsible for its own annual FERPA notice to parents and for determining that its use of SeatPlan is consistent with that notice.
14. US state student privacy addendum (placeholder)
- Several states require additional contract terms for operators of school services, for example New York Education Law 2-d, the Illinois Student Online Personal Protection Act and California SOPIPA.
- Where the School is subject to such a law, the parties will attach the corresponding state addendum before signature. The addendum takes precedence over this Agreement to the extent of any conflict.
- State addendum attached: ______________________ (leave blank if none).
15. UK addendum (placeholder)
- For Schools in the United Kingdom, this Agreement operates under UK GDPR and the Data Protection Act 2018, and references to Articles are to the corresponding UK GDPR provisions.
- SeatPlan will provide the information the School needs to complete the Department for Education data protection toolkit for schools on request.
- UK addendum attached: ______________________ (leave blank if none).
16. Signature blocks
- For the School. Legal name: ______________________________
- Address: ______________________________
- Signatory name and title: ______________________________
- Signature and date (School): ______________________________
- For ZNZ Systems Ltd. Signatory name and title: ______________________________
- Signature and date (ZNZ Systems Ltd): ______________________________
- Order or licence reference: ______________________________
- Questions about this Agreement: hi@seatplan.io