DATA PROCESSING AGREEMENT
The agreement UK PE Group signs with each school or organisation using Sports I.
Status: In Review. This agreement is under legal review and has not yet been issued for signature. The sections below describe the intended scope of the agreement — they do not constitute an executed agreement or legal advice. The final document will be published in the Trust Centre document library once approved.
Roles of UK PE Group and the school
The school (or trust) remains the controller of pupil and staff personal data held in Sports I. UK PE Group Ltd acts as a processor: we only process data on the school's documented instructions, to deliver the platform the school has subscribed to.
Types of personal data
- •Pupil names, classes and year groups
- •PE assessment levels, criteria scores and teacher comments
- •Evidence media (photos and video) where the school chooses to upload it
- •Attendance, club and competition participation records
- •Staff names, roles and school email addresses
- •School administration and billing details
Categories of data subjects
- •Pupils
- •School staff
- •School administrators
- •Parents and carers (where the school enables the Parent Portal)
Processing purposes
- •Delivering PE planning, assessment, evidence and school-sport features the school subscribes to
- •Producing reports for the school (including PE and Sport Premium impact reports)
- •Secure account access and tenant isolation between schools
Security measures
Access controls, role-based permissions, per-school data isolation, encryption in transit, session management and platform-managed infrastructure. See the Security page for what is confirmed and what is still being verified.
Subprocessors
Sports I is delivered through a small number of vetted subprocessors. The current register — including verification status — is published on the Subprocessors page.
Data subject rights support
Schools act as controller for data subject requests. UK PE Group supports schools with access, correction, export or deletion of data held in Sports I within agreed timescales.
Breach notification process
If a personal data breach affecting school data is identified, UK PE Group will assess and document it, and notify the affected school without undue delay so the school can meet its own UK GDPR notification duties.
Deletion and return of data
On termination, a school can request export of its data and deletion from Sports I storage, subject to the retention schedule and any back-up expiry.
International transfers
Where any processing or storage occurs outside the UK, an appropriate transfer mechanism will be documented. Transfer details are recorded in the subprocessor register — currently shown as 'Verification in progress' until confirmed.
Audit and cooperation
UK PE Group cooperates with reasonable school, trust or auditor information requests about how Sports I processes school data, and maintains this Trust Centre so compliance information stays current.