Data processing agreement

Using this DPA

This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at https://commonpaper.com/standards/data-processing-agreement/1.1/ (“DPA Standard Terms”), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

The Standard Terms are not reproduced here. They are published, unchanged and dated, at the link above, and are read as part of this agreement. Where this Cover Page adds to or narrows a numbered section of the Standard Terms, it says so expressly under “Additional terms” below, and the Cover Page controls.

Does this cover the UK GDPR?

Yes. The Standard Terms define “Applicable Data Protection Laws” as “the Applicable Laws that govern how the Service may process or use an individual’s personal information, personal data, personally identifiable information, or other similar term”: a definition wide enough to take in the UK GDPR and the Data Protection Act 2018. The Standard Terms also define “UK GDPR” and “UK Addendum” by name, and set out what happens on a restricted transfer out of the United Kingdom. The Additional terms below close the points on which the Standard Terms alone fall short of Article 28(3).

Key Terms

The key legal terms of the DPA are as follows:

Agreement

This DPA supplements the Wingsuit terms and conditions at usewingsuit.co.uk/terms, as accepted by Customer on [School to complete: date].

Approved Subprocessors

List of Subprocessors available at usewingsuit.co.uk/subprocessors. That page names each sub-processor, the country it is located in, what it does, and the data protection terms and transfer safeguards it operates under. It carries an “as at” date and a dated changelog, and the version in force on the date of this Cover Page is the list Customer authorises.

The following replaces the approval, notice and objection provisions of Section 2.6(a) of the Standard Terms. Customer gives Provider general written authorisation to engage sub-processors: those on that list as at the date of this Cover Page, and any Provider adds or replaces on these terms. No separate approval of each change is needed.

Provider will publish any intended addition or replacement on that page and email the Customer notices contact named in Annex I(A) at least 10 business days before the new sub-processor begins Processing Customer Personal Data, with its identity, location, the processing task and its safeguards. That is the notice period the Standard Terms themselves set. Customer may object in writing, with reasons, within that period. An objection does not prevent Provider from engaging the sub-processor. The parties will discuss it in good faith, and if it is not resolved within 30 days of the objection Customer may terminate the Agreement, as to the affected part of the Service or in whole, without penalty, with a pro-rata refund of any fees paid in advance for the unused period. That is Customer’s sole remedy for an objection. If Customer does not object within the notice period, Customer is taken to have accepted the change.

Exceptionally, where Provider must replace a sub-processor immediately to keep the Service secure or available, Provider may do so before the notice period has run, will notify Customer as soon as possible and in any event within 3 days, and Customer may object, with the remedy above, within 10 business days of that notice.

Provider Security Contact

A2x Development Ltd, 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. Email: support@usewingsuit.co.uk, for the attention of Alexander Colville, Director.

Security Policy

Provider will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR, and will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering. The measures in place are those listed in Annex II below; what is held, where it is held and how long it is kept is set out at usewingsuit.co.uk/data. The Article 32 obligation is set out in full under “Security measures” in the Additional terms below, and is an obligation rather than an efforts standard.

The template’s certification options (ISO 27001, penetration testing, SOC 2 Type I or II, PCI, HIPAA, FedRAMP) are not selected. Wingsuit holds none of them, holds no Cyber Essentials certification and no penetration test has been carried out. It follows that the Security Policy defines no audit standard, so there is no “Report” for the purposes of Section 5.2 of the Standard Terms. Rather than leave the audit right resting on that inference, the Additional terms below disapply Section 5.2 expressly and put a proportionate audit right in its place.

Additional terms

The Standard Terms are not edited. The terms below are written on this Cover Page, which controls over the Standard Terms where the two differ, using the same mechanism the template uses for its own DPA Liability Cap row (“The following is added to the end of Section 8.1 of the DPA Standard Terms”). They exist because the Standard Terms, read alone, do not carry every term Article 28 of the UK GDPR makes mandatory.

Confidentiality of personnel (UK GDPR Article 28(3)(b))

Provider will ensure that every person authorised by Provider to Process Customer Personal Data, including Provider’s director, employees and contractors, is bound by a written duty of confidentiality that survives the end of their engagement, or is under an appropriate statutory obligation of confidentiality. Provider will limit access to Customer Personal Data to those persons who need it to provide the Service.

Infringing instructions (UK GDPR Article 28(3), final sub-paragraph)

Provider will immediately inform Customer if, in Provider’s opinion, an instruction from Customer infringes the UK GDPR, the Data Protection Act 2018 or other applicable data protection law, and may suspend performance of that instruction until Customer confirms or withdraws it.

Security measures (UK GDPR Articles 28(3)(c) and 32)

In addition to the Security Policy, Provider will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as required by Article 32 of the UK GDPR. The measures currently in place are those listed in Annex II.

Data subject rights (UK GDPR Article 28(3)(e))

Section 6.1 of the Standard Terms is extended: Provider will assist Customer, by appropriate technical and organisational measures and insofar as is possible, in fulfilling Customer’s obligation to respond to any request by a data subject to exercise a right under Chapter III of the UK GDPR, including access, rectification, erasure, restriction, portability and objection, and not only requests to delete or opt out.

Return and deletion (UK GDPR Article 28(3)(g))

In Section 7.2, “required or authorized by Applicable Law” is read as “required by Applicable Law”. Copies held in backups are not separately deleted on request; they are overwritten as they pass out of the hosting provider’s point-in-time recovery window, which is approximately four weeks, and remain protected by this DPA until they do.

Security incidents (replaces Section 4(a) of the Standard Terms)

Provider will notify Customer of a Security Incident affecting Customer Personal Data without undue delay and in any event within 72 hours of becoming aware of it, by email to the Customer notices contact named in Annex I(A). The initial notification will contain whatever is known at the time; Provider will not delay it in order to complete its investigation, and will follow up with the information described in Article 33(3) of the UK GDPR as it becomes available. Provider will not notify the Information Commissioner or any data subject on Customer’s behalf unless Customer asks it to in writing.

Audit and information (replaces Sections 5.2 and 5.3 of the Standard Terms)

Provider holds no SOC 2, ISO 27001, PCI, HIPAA or FedRAMP report and has not had a penetration test. There is therefore no “Report” for the purposes of Section 5.2 of the Standard Terms, and Section 5.2 does not apply. In its place, and notwithstanding the third sentence of Section 5.1:

• (a) Information. On written request to the Provider Security Contact, Provider will give Customer all information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR, including a completed security questionnaire, a description of its technical and organisational measures, its current list of sub-processors and, on request, redacted copies of its agreements with them. Provider will respond within 30 days.
• (b) Inspection. Customer, or an auditor mandated by Customer, may audit Provider’s compliance with this DPA, including by inspection. Customer will give at least 30 days’ written notice, will conduct no more than one audit in any 12-month period (unless required by a supervisory authority or following a Security Incident affecting Customer Personal Data, when there is no limit), will conduct it during normal working hours, will not unreasonably disrupt the Service, and will treat everything learned as confidential. Provider will cooperate and contribute to the audit. Because Provider is a small company with no offices open to visitors, an audit will normally be conducted remotely (by video call, screen-sharing of system configuration and records, and document review), and Provider will make its director available for that purpose. Provider may withhold access where it would disclose another customer’s data, a third party’s confidential information or credentials, and will explain what has been withheld and why.
• (c) Cost. Provider bears its own costs of one audit per 12-month period. Customer bears the cost of any auditor it appoints.
• (d) Supervisory authority. Nothing in this DPA limits the powers of the Information Commissioner or of any other competent supervisory authority.

How notices under this DPA are sent

Every notice this DPA promises (a sub-processor change, a Security Incident, an answer to an information request) is written and sent by hand by Provider’s director to the Customer notices contact named in Annex I(A). The only emails Wingsuit the product sends are a link to confirm an account’s email address and a link to reset its password, so there is no automated alerting to rely on, and none is claimed. That is also why Annex I(A) asks for an address that is monitored by more than one person.

Changes to the Agreement

DPA Covered Claim

Not used. This DPA adds no separate indemnity; the indemnity terms of the Agreement apply as written.

DPA Liability Cap

Not used. This DPA adds no separate liability cap; the limitation of liability in the Agreement applies, as Section 8.1 of the Standard Terms provides. Section 8.3 of the Standard Terms is unaffected: this DPA does not limit any liability to an individual about their data protection rights, or between the parties for violations of the UK Addendum.

Governing Law and Chosen Courts

Not used. The Agreement at usewingsuit.co.uk/terms is already governed by the laws of England and Wales, so this DPA needs no separate governing law. The governing law for the UK Addendum is set out under Restricted Transfers below.

Service Provider Relationship

Not applicable. Wingsuit is sold to schools and colleges in the United Kingdom and this option, which addresses the California Consumer Privacy Act, is not selected. Under the Standard Terms an unselected option means “not applicable” and the clause does not apply. Wingsuit does not sell or share personal data in any event.

Restricted Transfers

Governing Member State

UK Transfers: the laws of England and Wales.

Where the data is stored

All application data (the database, uploaded files and backups) is stored in Railway’s EU West region, in Amsterdam, the Netherlands. When a teacher imports a Word or PowerPoint file, that file is converted to a PDF by a service Provider runs on Railway in the same region, which keeps nothing once the conversion is done. The Netherlands is an EEA state, and transfers to an EEA state are approved by regulations made under Article 45A of the UK GDPR (Data Protection Act 2018, Schedule 21, paragraphs 4 and 5(1)(a)), so storing data there needs no further safeguard and no transfer risk assessment.

Who can reach it, and under what safeguard

Storage in the EEA does not answer the whole question. A restricted transfer is judged by the receiving organisation, not the server: making personal data accessible to a separate organisation outside the United Kingdom is a transfer, so a US-established supplier whose staff can reach systems in Amsterdam is a transfer to the United States even though the bytes rest in the EEA. Each such supplier is named below with the mechanism relied on. All are listed, with their terms, at usewingsuit.co.uk/subprocessors.

Railway Corporation (hosting, database, file storage, backups) and Stripe, LLC (web card payments) are indicated on the Data Privacy Framework List as participating in the UK Extension to the EU-US Data Privacy Framework, with active status for both HR and non-HR data, checked on the official list at dataprivacyframework.gov on 19 September 2026. Transfers to them are covered by the United Kingdom’s adequacy regulations for the United States (SI 2023/1028), so no Article 46 safeguard and no transfer risk assessment is needed for them. Stripe is reached directly. A Stripe customer is created only when a teacher first goes to pay, never on a plan read, and it receives the account’s email address and the Wingsuit account identifier; no name is sent. Card and billing details are collected on Stripe’s own checkout page and never reach Provider.

Plus Five Five, Inc. (Resend) sends the three kinds of email Wingsuit sends, each to the account’s own address: a link to confirm the address of an account that signs in with an email and password, a link to reset a password, and a confirmation when a subscription is cancelled on the website; and it sends Provider’s own support address each report a teacher makes about something shared with them. It receives the recipient’s email address and the message, which holds a link that expires after an hour, or what was cancelled, when and anything refunded, or, for a report, the reason given, the name of the board or folder and the names and email addresses of its owner and of whoever shared it. It never receives what is drawn on a board. Mail is sent from Resend’s Ireland region, but Resend stores messages and logs in the United States, for 30 days. Resend is listed on the Data Privacy Framework List as active under the EU-US Data Privacy Framework and its UK Extension for non-HR data, checked on 13 October 2026, so transfers to it are covered by the same adequacy regulations and need no transfer risk assessment. Resend’s own DPA also incorporates the EU Standard Contractual Clauses, with the UK Addendum for transfers from the United Kingdom, should its certification lapse.

No other supplier is involved in billing. Provider runs billing itself: the records of what an account is entitled to and what it has bought are held in Provider’s own database in the EEA, as Annex I(B) sets out, not by a third party.

If Provider itself makes a transfer out of the United Kingdom that no adequacy regulations cover, Section 3.3 of the Standard Terms applies and the parties are deemed to have signed the UK Addendum, completed by this Cover Page. Provider re-checks these certifications and agreements every year, and whenever a supplier is added.

Railway’s own platform logs, billing data and other service metadata are not confined to the pinned EU West region and may be processed in the United States. That transfer is covered by the same safeguard as the rest of Railway’s processing: Railway Corporation’s participation in the UK Extension to the EU-US Data Privacy Framework, so no Article 46 safeguard is needed for it either.

Annex I(A) List of Parties

The notices contact is the address to which Provider sends a sub-processor change, a Security Incident notification and any other notice under this DPA. It is worth giving an address that more than one person reads, and telling Provider when it changes.

Annex I(B) Description of Transfer and Processing Activities

Service

Wingsuit: teaching tools at usewingsuit.co.uk and in the Wingsuit mobile app, including an infinite-canvas whiteboard with image, PDF, Word and PowerPoint import, view-only share links and persistent broadcast rooms.

Categories of Data Subjects

• Customer’s employees: teachers and other staff who hold a Wingsuit account.
• Customer’s students, but only where a teacher writes or uploads something about a named student onto a board, into a tool or into a support request. Students have no accounts and Wingsuit never asks for their details.

Categories of Personal Data

• Name.
• Contact information: the email address the account is registered with.
• Transactional information: which plan the account is on and the identifiers used to manage a subscription. Wingsuit never receives card details. These billing records are held in Provider’s own database rather than a third party’s: subscriptions (provider, product, status, period end); grants of a plan or raised limits, made by an administrator, by a redeemable code or by a school’s email-domain rule, which applies only to verified email addresses; a credit ledger in pence, mirrored to the teacher’s Stripe balance and taken off her next invoices, with no cash value; orders, recording what was bought, the exact consent wording shown, the terms version, the time, and an immutable confirmation document the teacher can download from Settings; and a content-free log of provider events kept for 90 days. All of it is deleted with the account, 14 days after its owner asks; asking sets a Stripe subscription to stop at the end of the period already paid for, and it is cancelled outright when the account goes. Payment and invoice records are kept by Stripe under its own legal obligations. Before paying, the teacher is shown the required pre-contract information, and presses a button naming the price beside a sentence saying that paying starts the service at once, which acknowledges the obligation to pay and expressly requests that start; Provider records the sentence.
• User activity such as device information or IP address: the IP address and user agent recorded with a sign-in session, and the app version, timezone and request identifiers attached to a support ticket, and the request identifier recorded with a fault in the server’s own logs.
• Teaching content: anything a teacher draws, writes, types or uploads onto a board (strokes, text, images, imported PDFs and Word documents, and PowerPoint slides with their speaker notes), together with folders and sharing settings. Personal data appears in teaching content only because a teacher put it there.
• Support correspondence: the text of tickets and messages and any screenshot a teacher attaches.

Special Category Data

No. Wingsuit is not designed to process special category data and asks that Customer’s staff do not put it on a board: a board is a teaching surface, not a record system. Customer instructs Provider on that basis.

Special Category Data Restrictions or Safeguards

Not applicable, because “No” is selected above. The template directs that this row be deleted in that case; it is kept here, marked not applicable, so that nothing appears to have been quietly left out.

Frequency of Transfer

Continuous, for as long as Customer’s staff use the Service.

Nature and Purpose of Processing

Provider will Process Customer Personal Data as instructed in Section 2.3 of the DPA Standard Terms: to provide and maintain the Service. The nature of processing includes:

• Receiving data, including collection, accessing, retrieval, recording, and data entry.
• Holding data, including storage, organization, and structuring.
• Updating data, including correcting, adaptation, alteration, alignment, and combination, as a teacher edits a board or her account.
• Protecting data, including restricting, encrypting, and security testing.
• Sharing data, including disclosure, dissemination, allowing access, or otherwise making available, only where a teacher turns on a share link or broadcasts to a room.
• Returning data to the data exporter or data subject.
• Erasing data, including destruction and deletion.

The template’s “Using data, including analysis, consultation, testing, automated decision making, and profiling” is not selected. Wingsuit runs no advertising, no analytics or tracking, no AI features and no profiling, and does not use teaching content for any purpose of its own.

Duration of Processing

Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws (read, per the Additional terms above, as required rather than merely authorised by law). In practice that is the term of the Agreement, after which data is deleted on the schedule published at usewingsuit.co.uk/data. Deletion inside the Service is self-service and enforced by an hourly sweep; copies in backups are then overwritten as they pass out of the hosting provider’s point-in-time recovery window, which is roughly four weeks.

Annex I(C) Competent Supervisory Authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum. For a school or college in the United Kingdom that is the Information Commissioner’s Office.

Annex II Technical and Organisational Security Measures

The measures below are those actually in place. The template offers a longer list; options not shown here are not selected, and their absence is deliberate rather than an oversight.

• Protecting Customer Personal Data during transmission (in transit): all traffic between a device and the Service is encrypted (HTTPS and WSS).
• Protecting Customer Personal Data during storage (at rest): data is encrypted at rest by the hosting provider at the storage layer. Individual volumes are not separately encrypted at the software level, and nothing stronger is claimed.
• User identification and authorization process and protection: accounts sign in with an email and password, with the password stored only as a hash, or with Google sign-in, or Apple sign-in in the iPhone and iPad app. Share links and broadcast rooms use unguessable identifiers; uploaded files are addressed by a 256-bit hash of their contents. Administrative access to the Service is limited to Provider’s director.
• Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services: everyone authorised to process Customer Personal Data (Provider’s director and any contractor) is bound by a written duty of confidentiality that survives the end of their engagement, as the Additional terms above require, and access is limited to those who need it to provide the Service.
• Events logging: sensitive actions, including every administrative action on an account such as signing in as it, are written to an audit log kept for 365 days. It records who did what and when, and for sharing and renaming the email addresses or names involved; it never holds board content.
• Ability to restore the availability of and access to Customer Personal Data in a timely manner following a physical or technical incident: the database has point-in-time recovery to a bucket in the same region. The hosting provider keeps the last four full backups, a restore window of roughly four weeks.
• Ensuring data minimization: students have no accounts, no profiles and no way to contribute; a viewer of a broadcast is an anonymous connection held in memory and counted, and nothing about a viewer is written to the database. Speaker notes from an imported deck are stored apart from the board so that viewers never receive them. There is no analytics or tracking of any kind.
• Ensuring limited data retention: every retention period is enforced in code by an hourly sweep: deleted boards leave the recycle bin after 7 days on Wingsuit Starter or 90 days on Wingsuit Pro, uploaded files are removed once nothing has referenced them for a day, support screenshots after 30 days, resolved tickets after 180 days, audit events after 365 days, and quick whiteboards 8 hours after their last change. The full schedule is at usewingsuit.co.uk/data.
• Allowing data portability and ensuring erasure: account deletion is self-service in Settings; asking freezes the account at once and it is deleted 14 days later, with its uploaded files following in the next sweep. Boards in an organisation’s or a team’s space pass to another member of it; support tickets stay, without the teacher’s name or any screenshot, until 180 days after they were resolved; audit events stay for their 365 days. A teacher can also ask in Settings for a copy of everything held about her, as JSON and the original files, which is removed 7 days after it is ready. Boards can be exported as portable .wingsuit files that stay on the device.

Certification or assurance of processes and products: not selected. Wingsuit holds no ISO 27001 or Cyber Essentials certification and has not had a penetration test. Wingsuit is operated by one person; there is no security team, and no claim is made to one.

Signatures

Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above. By signing this Cover Page, each party agrees to enter into this DPA as of the last date of signature below.

Send the completed page to support@usewingsuit.co.uk. A countersigned copy comes back by email, and the date of the last signature is the date this DPA starts.