Skip to content
iEasySRiEasySR
Back to home

Data Processing Agreement

Last updated: 6 September 2026.

This Data Processing Agreement ("Agreement") forms part of the Terms of Agreement between iEasySR Pty Ltd, a company registered in Australia ("iEasySR", "we"), and the school or account owner ("you"). It applies where you use iEasySR to process personal data for which you are the controller (school and student data). Where they conflict, this Agreement governs the processing of that data. It supplements our Privacy Policy.

1. Definitions

"Controller", "processor", "personal data", "processing", "data subject", "sub-processor" and "special-category data" have the meaning given by applicable data-protection law, including Ghana's Data Protection Act, 2012 (Act 843), the EU and UK GDPR, and the Australian Privacy Act, as applicable to you.

2. Roles

You are the controller of the school and student data. iEasySR is the processor that processes that data on your behalf. Each party complies with its own obligations under applicable law.

3. Scope and instructions

iEasySR processes the personal data only to provide the Service and on your documented instructions, being this Agreement, the Terms, and your use of the features. If iEasySR considers an instruction to infringe applicable law, it will tell you.

4. Details of processing

Subject matter, duration, nature, purposes, and the categories of data subjects and data: see Annex A.

5. Confidentiality

People authorised to process the data are bound by confidentiality and access it only on a least-privilege basis.

6. Security

iEasySR implements appropriate technical and organisational measures (Annex B), designed to meet Section 28 of Ghana's Act 843 and comparable standards, to protect the data against unauthorised or unlawful destruction, loss, alteration, disclosure or access.

7. Sub-processors

You authorise the sub-processors listed in Annex C. iEasySR imposes equivalent data-protection obligations on them and remains responsible for their performance. We give you at least 14 days' notice of any change of sub-processor; you may object on reasonable data-protection grounds and, if it cannot be resolved, terminate the affected service.

8. International transfers

iEasySR may transfer and store the data across borders (see Annex A) under appropriate safeguards: Standard Contractual Clauses or the UK International Data Transfer Agreement and Addendum where applicable, providers' compliance frameworks, encryption, and data minimisation. This is described further in the Privacy Policy (section 10).

Some jurisdictions (for example several francophone West African countries) require the controller to obtain prior authorisation from, or make a declaration to, the national data-protection authority before personal data leaves the country. As the controller, you are responsible for obtaining any such authorisation; we provide our disclosures and this Agreement to support your application. See our Francophone West Africa pack and Ghana DPC pack.

9. Assistance

Taking into account the nature of processing and so far as feasible, iEasySR assists you in meeting your obligations: responding to data-subject requests (through the self-serve tools to access, correct, export and delete data), data-protection impact assessments and consultations, and through its support.

10. Data-subject rights

The Service provides tools to access, correct, export and delete data so you can respond to data-subject requests.

11. Personal-data breach

iEasySR notifies you without undue delay after becoming aware of a personal-data breach, with the information available to it, to help you meet your own notification obligations.

12. Deletion or return

On termination of the Service, iEasySR deletes or returns the personal data within the period stated in the Privacy Policy (7 days), except where retention is required by law.

13. Audit and information

iEasySR makes available the information needed to demonstrate compliance with this Agreement and allows for and contributes to reasonable audits (on reasonable notice, subject to confidentiality, no more than once a year or following a breach).

14. Liability and precedence

Liability under this Agreement is subject to the limitations in the Terms. For the processing of the data you control, this Agreement prevails over any conflicting provision of the Terms.

15. Term

This Agreement applies for as long as iEasySR processes personal data on your behalf.

Annex A: Details of processing

  • Subject matter: provision of the iEasySR Service.
  • Duration: the term of your account.
  • Nature and purposes: school administration, enrolment, scoring, report-card generation, attendance, fee billing, and the optional modules you enable.
  • Data subjects: students (children), parents and guardians, staff.
  • Categories of data: identity (names, dates of birth, gender, photos), contact (guardian emails and phones), academic (scores, attendance, reports), payment references; special-category data (student health notes, disability information for statutory reporting); staff HR data if you use the Staff module.
  • Locations: primary storage in the United Kingdom (Neon, London region); certain sub-processing in the United States (Annex C); controller established in Australia.

Annex B: Technical and organisational measures

  • Encryption in transit (TLS) and at rest.
  • Passwords stored as bcrypt hashes; multi-factor authentication available and enabled by default.
  • Least-privilege internal access; per-account data isolation (tenancy scoping).
  • Server-side authorisation on every route; activity logs; rate limiting.
  • Uploaded files stored in per-account storage with access controls.
  • Backups by the managed database provider; breach-response process; retention limits.
  • Offline data-entry screens cache data in the browser's local storage on the device; it is cleared on sign-out.

Annex C: Sub-processors

  • Vercel (United States / global): hosting and running the application.
  • Neon (United Kingdom, London): PostgreSQL database, primary storage.
  • Vercel Blob (United States): file storage (photos).
  • Resend (United States): transactional email delivery.
  • Stripe (United States / global): payment processing.
  • OpenAI (United States): optional AI assistant and drafting.
  • Google (United States): optional OAuth sign-in.

Need a signed copy for your file? Email support@ieasysr.com.

iEasySR | Data Processing Agreement