Legal Documentation
SeatPlan.io School Data Processing Agreement
Version draft-2026-11. Last updated: 4 November 2026
How to use this template
This is the standard agreement under which ZNZ Systems Ltd processes pupil data for schools and teachers on Classroom and School plans. Read it here, download the PDF for your procurement file, or ask us for a signed copy. It sits alongside our Student Data Privacy page and the Classroom and School plan terms.
Download the template
A4 PDF of the full agreement including the subprocessor annex and blank signature blocks.
Download the template (PDF)Request a signed DPA
Email hi@seatplan.io with the subject "DPA request" and include:
- the school's legal name and address;
- the name and title of the person who will sign;
- your licence or order reference;
- any state or UK addendum you need attached.
1. Parties and roles
- Processor: ZNZ Systems Ltd, Magnolia House, 11 Spring Villa Road, Edgware HA8 7EB, United Kingdom. Registered in England & Wales (January 2023). Trading as "SeatPlan.io".
- Controller: the school, academy trust, district or other education authority named in the signature block (the "School").
- Where an individual teacher holds a Classroom plan in their own name, that teacher is the controller for their own class and this Agreement applies to them as the School.
- SeatPlan.io acts only as a processor of the personal data described in this Agreement and processes it only on the School's documented instructions.
- For Schools in the European Union, SeatPlan.io's representative under Article 27 GDPR is JYNP Ltd (registration number HE 462775), 15 Athalassis Street, 2221 Latsia, Nicosia, Cyprus. The representative's email address is eu-representative@seatplan.io.
2. Subject matter and duration
- Subject matter: the provision of SeatPlan.io's classroom seating chart service, including creating class rosters, arranging seats and printing seating plans.
- Duration: the term of the Classroom or School plan, plus the deletion and return period in section 10.
- Nature and purpose: storing, displaying, arranging and printing class rosters and seating plans on the School's behalf. SeatPlan.io does not use pupil data for its own purposes, for advertising or to train machine-learning models.
- SeatPlan.io excludes Classroom and School accounts, their classes and the staff who use them from the separate analytics store it builds from its own database, and from the service statistics described in the Terms of Service. The PostHog entry in the Annex describes the usage analytics that still apply to staff accounts.
3. Categories of data subjects and personal data
- Data subjects: pupils of the School, and the teachers and staff who hold SeatPlan.io accounts.
- Pupil data: name or display name, class membership, assigned seat, and any optional tags, notes and keep-apart or sit-together rules the teacher records.
- Pupil data SeatPlan.io does not ask for and the School should not enter: email address, date of birth, photograph, home address, government identifiers, and login credentials. Pupils never hold accounts.
- Staff data: name, school email address, sign-in records, plan and billing details.
- The School must not enter special category data (for example health, ethnicity or religion) into free-text fields except where the School has decided it is necessary for the seating arrangement and lawful under its own policies.
4. Processing on instructions
- The School's instructions are this Agreement, the SeatPlan.io Terms of Service, and the configuration choices staff make inside the product.
- SeatPlan.io will inform the School if, in its opinion, an instruction infringes applicable data protection law.
- SeatPlan.io will not sell, rent or otherwise disclose pupil data to any third party except the subprocessors listed in the Annex.
5. Confidentiality
- SeatPlan.io ensures that staff authorised to process pupil data are bound by confidentiality obligations.
- Staff access to School data is possible only through an internal console. Each access must be justified in advance and is written to an audit record that cannot be edited or deleted, kept for 24 months. The School may request the record of who has accessed its account.
6. Security (Article 32)
- SeatPlan.io applies technical and organisational measures appropriate to the risk, including encryption in transit and at rest, authentication through a dedicated identity provider, and hosting of application data within Amazon Web Services in the Frankfurt region, with encrypted backup copies in its Oregon region in the United States as described in section 12.
- SeatPlan.io keeps the measures described in its Privacy Policy under review and will not reduce the overall level of protection during the term.
7. Subprocessors
- The School gives general authorisation for the subprocessors listed in the Annex to this Agreement.
- SeatPlan.io will give the School at least 30 days' notice before adding or replacing a subprocessor that processes pupil data, by updating the published subprocessor list and emailing the School's account holders. The School may object on reasonable data protection grounds within that period, and may terminate the affected plan if the objection cannot be resolved.
- SeatPlan.io imposes data protection obligations on each subprocessor that are no less protective than those in this Agreement and remains liable for their performance.
Annex: authorised subprocessors
| Provider | Purpose | Region | Transfer mechanism | Pupil data |
|---|---|---|---|---|
| Amazon Web Services | Hosting, compute, the application database, file storage, the real-time collaboration server and encrypted backups. | Frankfurt (EU), with backup copies in Oregon (United States) | UK IDTA + SCCs | Yes |
| Clerk | Sign-in and account management for teacher and school staff accounts. | United States | UK IDTA + SCCs | No. Only teachers and school staff hold accounts. Pupils are never account holders, so no pupil data reaches Clerk. |
| Stripe | Payment processing and invoicing for Classroom and School plans. | United States | UK IDTA + SCCs | No. Stripe receives the billing contact and payment details of the school or teacher, never roster content. |
| Resend | Transactional email such as sign-in links, invoices and collaboration invitations. | United States | UK IDTA + SCCs | No. SeatPlan.io does not ask for pupil email addresses and schools should not enter them, so school-related email is addressed to teacher and staff accounts only. |
| PostHog | Product analytics, warnings and errors from server logs and, with consent, session replay with on-screen text masked. | United States | UK IDTA + SCCs | No. SeatPlan.io's analytics events never carry pupil names, rosters or other chart content. PostHog identifies events from signed-in teacher and staff accounts by the account's email address, and replays mask on-screen text. Warnings and errors from server logs also go to PostHog, with email addresses removed. |
| Cloudflare | Private storage (R2) for the photos and videos guests share into Guest Photos albums, reached only through short-lived signed links. | United States | UK IDTA + SCCs | No. Guest Photos is not offered on Classroom or School plans, so no pupil data or roster content reaches Cloudflare. |
| Sentry | Error monitoring for the application. | Germany (EU) | none | No. Error reports have email addresses and guest details removed before they leave our servers, and never include roster content. A report can carry the internal id of the signed-in staff account. |
| Upstash | Redis for request rate limiting and a short-lived cache of visitor region. | Global (multi-region) | UK IDTA + SCCs | No. Holds rate-limit counters, some keyed on the visitor's IP address, and a 24-hour cache of visitor region keyed on a shortened IP address. Nothing from a class roster reaches it. |
| Country.is | Country lookup from IP address for regional pricing and consent defaults. | Not stated by the provider | UK IDTA + SCCs | No. Receives only the visitor's IP address when a page or checkout loads, never roster content. |
| Amazon Bedrock | AI extraction of tables and seats from an uploaded floor-plan image or PDF. | Frankfurt (EU) | none | No. Only the uploaded floor-plan image or PDF is sent for extraction. Pupil names and class rosters are never part of that upload. |
8. Assistance with data subject rights
- Taking into account the nature of the processing, SeatPlan.io assists the School in responding to requests from pupils, parents and staff to exercise their rights, including access, rectification, erasure and portability.
- The School can obtain a machine-readable JSON archive of everything SeatPlan.io holds for its account, and can ask SeatPlan.io to delete pupil data. SeatPlan.io acts on a verified request within 30 days.
- SeatPlan.io will forward to the School, without responding, any request it receives directly from a pupil or parent.
9. Personal data breach notification
- SeatPlan.io will notify the School of a personal data breach affecting School data without undue delay, and in any case within 72 hours of confirming the breach.
- The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.
- SeatPlan.io will cooperate with the School in any notification the School is required to make to a supervisory authority or to data subjects.
10. Deletion and return
- Class rosters and seating plans are deleted when the School plan ends, after the grace period described in the Terms of Service, or earlier on the School's written request. A School administrator can also run the year-end rollover from Organization settings at any time: it archives every class and deletes the pupil rows (names, seat positions, notes and tags) by default, keeping room layouts and templates; the administrator may choose to keep the rosters when running it. SeatPlan.io reminds the School by email on 1 July of each licence year.
- Before the plan ends, and during the 7-day grace period described in the Terms of Service, the School can export its data. On a written request made within 30 days of the end of the plan, SeatPlan.io will return any School data it still holds and confirm deletion of the rest.
- Invoices and payment records are retained as required by accounting law. The audit record of a deletion is kept for 24 months.
- Deleted data remains in SeatPlan.io's encrypted backups until they expire, at most 35 days after deletion. SeatPlan.io uses backups only to recover from a failure or to restore data lost by mistake.
11. Audit and information
- SeatPlan.io makes available the information necessary to demonstrate compliance with this Agreement, including the subprocessor list, the security description in its Privacy Policy, and its staff-access audit record for the School's account.
- Where that information is insufficient, the School may conduct an audit once in any 12-month period on 30 days' written notice, at reasonable times and without disrupting the service. SeatPlan.io may require an independent auditor bound by confidentiality.
12. International transfers
- Application data, including pupil data, is stored in the European Union (Frankfurt).
- So that the service can be restored if the Frankfurt region fails, Amazon Web Services keeps encrypted backup copies of that data, including pupil data, in its Oregon region in the United States, for at most 35 days. This is a transfer to the United States, under the mechanism stated for Amazon Web Services in the Annex.
- Where a subprocessor in the Annex processes data outside the UK or EEA, SeatPlan.io relies on the transfer mechanism stated in the Annex (the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum).
- For US Schools, the parties acknowledge that pupil data is hosted in the European Union, apart from the backup copies described in this section, and that the School has considered this in its procurement decision.
13. FERPA school official terms (US Schools)
- The School designates SeatPlan.io as a "school official" with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B). SeatPlan.io performs an institutional service for which the School would otherwise use its own employees, is under the School's direct control with respect to the use and maintenance of education records, and uses education records only for the purposes authorised in this Agreement.
- SeatPlan.io will not re-disclose personally identifiable information from education records except to the subprocessors in the Annex or as the School directs.
- The School remains responsible for its own annual FERPA notice to parents and for determining that its use of SeatPlan.io is consistent with that notice.
14. US state student privacy addendum (placeholder)
- Several states require additional contract terms for operators of school services, for example New York Education Law 2-d, the Illinois Student Online Personal Protection Act and California SOPIPA.
- Where the School is subject to such a law, the parties will attach the corresponding state addendum before signature. The addendum takes precedence over this Agreement to the extent of any conflict.
- State addendum attached: ______________________ (leave blank if none).
15. UK addendum (placeholder)
- For Schools in the United Kingdom, this Agreement operates under UK GDPR and the Data Protection Act 2018, and references to Articles are to the corresponding UK GDPR provisions.
- SeatPlan.io will provide the information the School needs to complete the Department for Education data protection toolkit for schools on request.
- UK addendum attached: ______________________ (leave blank if none).
16. Signature blocks
- For the School. Legal name: ______________________________
- Address: ______________________________
- Signatory name and title: ______________________________
- Signature and date (School): ______________________________
- For ZNZ Systems Ltd. Signatory name and title: ______________________________
- Signature and date (ZNZ Systems Ltd): ______________________________
- Order or licence reference: ______________________________
- Questions about this Agreement: hi@seatplan.io