This Data Processing Agreement outlines the obligations of Phased Cortex Ltd ("Processor") when processing personal data on behalf of educational institutions ("Controller") using the Class Architect platform.
The Controller authorizes the Processor to process personal data strictly to provide the Class Architect service (AI-assisted curriculum design and marking). The Processor shall not process data for any other purpose.
The Controller agrees to anonymise or redact sensitive Personally Identifiable Information (PII) before uploading student submissions. The Processor will transiently process data including student initials or identifiers as provided by the Controller.
The Processor implements a strict zero-retention architecture. Student submissions and generated feedback are processed in-memory and permanently deleted from the Processor's and Subprocessor's servers immediately after generation.
The Controller provides general written authorisation for the Processor to engage Google Cloud (Europe-West2, London) as a subprocessor for hosting and AI inference (Vertex AI). The Processor ensures that the Subprocessor guarantees zero AI training on customer data.
The Processor implements appropriate technical measures including TLS 1.2+ encryption in transit, AES-256 encryption at rest, and strict access controls.
Due to the transient nature of the processing, all personal data is deleted immediately. Upon termination of the service, any residual account data will be permanently deleted within 30 days.