Data Processing Agreement

Version 2026-10-27. This Data Processing Agreement ("DPA") forms part of the Acadence Centre Terms of Service between BOOK IN CHAT PTE. LTD. (UEN 202646792Z) ("Book In Chat") and the Centre. Words defined in those terms have the same meaning here. "Centre Personal Data" means personal data in Centre Data.

1. Roles

1.1 For Centre Personal Data, the Centre is the organisation under the PDPA and Book In Chat is its data intermediary, processing on the Centre's behalf and for the Centre's purposes, as described in Annex 1.

1.2 Book In Chat is an organisation in its own right only for the uses described in Annex 4. This DPA does not apply to those uses, except clause 9.

1.3 As PDPA s4(2) provides, Book In Chat's own obligations under the PDPA for Centre Personal Data are those of a data intermediary: protection (s24), retention limitation (s25) and notifying the Centre of a data breach (s26C(3)(a)). All other data protection obligations for Centre Personal Data are the Centre's.

2. The Centre's instructions

2.1 The Centre's complete instructions are: the Agreement; the settings the Centre's managers choose in Centre admin; and the actions the Centre's Users take in the Service, including every use of an AI Feature. Where the Centre has confirmed under clause 5.1A of the terms that it holds Parents' agreements, the Centre instructs Book In Chat to run AI Features for every Student that confirmation covers, unless a "no" is recorded for the Student in the Service. Book In Chat processes Centre Personal Data only on those instructions, unless the law requires otherwise (in which case it will tell the Centre first, where the law allows).

2.2 The Centre may give further reasonable written instructions. If an instruction would need a change to the Service, Book In Chat may decline it, and the Centre may then end the Agreement under clause 14.2 of the terms.

2.3 Book In Chat will tell the Centre if it believes an instruction breaks the PDPA, but it is not obliged to check the Centre's instructions or the Centre's compliance.

3. The Centre's promises

The Centre promises that: it collected Centre Personal Data lawfully; it has given every notice and obtained every consent the PDPA and other laws require for Book In Chat and every provider in the Provider list to process it as this DPA describes, including transfer outside Singapore and, where the Provider list says so, a parent's or guardian's consent; it has checked Students' ages; and its instructions comply with the law. The Centre is responsible for the accuracy of Centre Personal Data and for answering Users' requests and complaints.

4. Security (PDPA s24)

4.1 Book In Chat will make reasonable security arrangements to protect Centre Personal Data in its possession or under its control against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks, and against loss of any storage medium on which it is stored. Annex 2 describes the main measures in place.

4.2 Book In Chat will allow access to Centre Personal Data only to its personnel, contractors and advisers who need it, who are bound in writing to keep it confidential.

4.3 The Centre is responsible for the security of its own accounts, devices and Users, and for its settings (clause 4.6 of the terms).

5. Breaches

5.1 If Book In Chat has reason to believe that a data breach has occurred affecting Centre Personal Data, it will tell the Centre without undue delay, and will give the Centre the information it reasonably has (such as what happened, the data and Users likely affected, and the steps taken) and reasonable help to assess the breach.

5.2 The Centre decides whether a breach is notifiable and notifies the Personal Data Protection Commission and the affected individuals as the PDPA requires. Book In Chat will not notify them for the Centre unless the Centre asks it to in writing or the law requires it.

5.3 Each party bears its own costs of responding to a breach. If the breach was caused by the Centre or its Users, the Centre reimburses Book In Chat's reasonable costs of assistance. If it was caused by Book In Chat's breach of clause 4, Book In Chat's liability is as clause 12 of the terms provides.

5.4 Where a breach affects Students, the Centre will consider informing Parents, as the PDPC's guidance on children's personal data recommends; Book In Chat will give the Centre the Parent contact details the Service holds for that purpose.

6. Providers (sub-processors)

6.1 The Centre authorises Book In Chat to use the providers in the Provider list to process Centre Personal Data, as the list describes. Book In Chat will use each one under a written contract or terms that require it to protect the data.

6.2 Despite clause 15 of the terms, Book In Chat may add or replace a provider by updating the Provider list and telling the Centre's managers at least 10 days before the new provider processes Centre Personal Data, unless sooner is needed for security or continuity. A new AI Provider receives a Student's work only where the Student's current AI consent (or a Parent's agreement the Centre holds under clause 5.1A of the terms) covers third-party AI services of that kind and the in-app AI marking consent names the provider. If the Centre reasonably objects, it may stop using the affected feature, or end the Agreement without charge and receive a pro-rata refund of fees paid in advance.

6.3 As between the parties, and so far as the PDPA allows: providers' own terms set out how they process data, and Book In Chat cannot change them. Book In Chat's responsibility for a provider is limited to choosing it with reasonable care and holding it to its contract.

7. Transfers outside Singapore (PDPA s26)

7.1 The Centre authorises and instructs Book In Chat to transfer Centre Personal Data to the countries and providers named in the Provider list, where an AI Feature or other part of the Service that the Centre uses needs it.

7.2 Book In Chat will take appropriate steps so that each recipient outside Singapore is bound by legally enforceable obligations to give the data a standard of protection comparable to the PDPA, using the recipient's data processing terms or other contractual terms reasonably available to it. The Centre has read the Provider list and accepts that these terms are the providers' standard terms, written mainly for EU and US law. Where a provider does not name the countries where it processes data, the Provider list says so. On request, Book In Chat will give the Centre copies of the provider terms it relies on. Where the Centre relies on a Student's or Parent's consent to a transfer, the in-app AI marking consent and Privacy notice give the written summary the PDPA regulations require.

8. Requests from individuals

If Book In Chat receives a request from an individual to access, correct or withdraw consent for Centre Personal Data, it will send it to the Centre and will not answer it except to say it has done so. The Service lets the Centre find, export, correct and delete data. Book In Chat will give reasonable further help at the Centre's cost.

9. Keeping and deleting data (PDPA s25)

9.1 Book In Chat keeps and deletes Centre Personal Data as set out in Annex 3, or as the Centre instructs through the Service's settings, and stops keeping it once it is no longer needed for the Centre's purposes or for legal or business purposes.

9.2 When the Agreement ends, Book In Chat deletes Centre Personal Data as clause 14.3 of the terms and Annex 3 describe, except copies the law requires it to keep or that Annex 3 says are kept to establish or defend legal claims, De-identified Data, and data it holds under Annex 4.

10. Records and audits

Book In Chat will answer the Centre's reasonable written questions about its compliance with this DPA once a year, and more often after a breach. Any other audit is at the Centre's cost, on at least 30 days' notice, during business hours, by an auditor bound to confidentiality, and limited to what is needed. An audit may not include penetration testing or access to any other centre's data, and takes place at most once in any 12 months unless a regulator requires it.

11. Liability

The limits and exclusions in clause 12 of the terms, and the Centre's indemnity in clause 13 of the terms, apply to this DPA.

Annex 1. Processing details

• Individuals: Students, Parents, Staff and managers of the Centre.
• Data: names, usernames, class and course membership, emails, parent links; schoolwork (typed and handwritten answers, photos and files uploaded, pages drawn on), marks, feedback, AI Output, practice records, progress; corrections of how the Service read a Student's handwriting; policy acceptances; sign-in, device, browser and IP records; audit records; and, where the Centre uses centre operations: timetables, attendance, absence and leave requests with their reasons, medical certificates uploaded for them, make-up lessons, cover arrangements, family billing names, emails and addresses, invoices, recorded payments and reminders, enquiries and trial lessons (names, phone numbers, emails, level, subject, notes and the agreement to be contacted), notices sent and read, and devices' push-notification addresses.
• Purposes: hosting the Centre's online classroom; giving out, collecting, marking and returning work; AI Features the Centre uses; reading a Student's handwriting better within the Centre's own site; progress reports; running the Centre's timetable, attendance, absences, make-ups, leave and cover, fees and enquiries; notices, notifications and emails; security, support, backups, billing counts; complying with law.
• Duration: the Agreement, then as Annex 3 says.

Annex 2. Main security measures

• Each centre has its own site, database, storage, internal network, passwords and session cookie; centres cannot reach each other's data, and this is tested.
• Hosted in Singapore; traffic encrypted in transit (TLS) through Cloudflare to the server.
• Servers and AI workers can reach only the outside services they need (an allow-list); a worker for AI receives a Student's work only where the Service's consent check passes for that Student and provider at the moment of sending: a current AI consent recorded in the Service, or, where the Centre has confirmed under clause 5.1A of the terms that it holds Parents' agreements, no recorded "no" for that Student. A Student the Centre has marked as under 13 is never sent to OpenAI, and is sent to any other AI Provider only with a Parent's recorded agreement.
• Centre admin needs two-step verification; accounts lock after repeated failed sign-ins; first passwords must be changed at first sign-in; each person resets their own password by email.
• Names and account details are not sent to AI Providers; Students are asked to leave names off their work.
• Changes to marks, settings, accounts and policy acceptances are recorded in audit logs.
• Daily backups, kept for 7 days; access to the server limited to Book In Chat's administrators.

Annex 3. Keeping and deleting

• Schoolwork, marks, feedback, AI suggestions and the text AI read from work: kept while the Student is enrolled and for 12 months after the Student leaves (or the period the Centre sets in the Service), then deleted.
• The full request and reply of an AI practice job: deleted 90 days after it was made.
• Records of policy acceptances, and logs of who changed a mark or setting: kept for at least 6 years after the Student leaves or the Agreement ends, to establish or defend legal claims, and no longer than that purpose needs.
• Monthly billing records (account numbers of Students who submitted work; no schoolwork), and the Centre's own invoices and recorded payments: kept for 7 years as financial records.
• Medical certificate files for absences and leave: deleted after the period the Centre sets (default 30 days after the decision); only the fact that one was seen is kept.
• Enquiries: deleted after the period the Centre sets (default 12 months after the last change) once closed or not followed up, whether or not the family enrolled; possible spam after 30 days; the sender's network fingerprint after 1 day.
• Copies of notice emails waiting to be sent: deleted after 2 days.
• Handwriting corrections: kept with the Student's work; deleted when the Centre switches the feature off for that Student, or with the work. Turning the feature off for the whole Centre stops new corrections and any use of kept ones; they are deleted with the Student's work.
• Backups: overwritten within 30 days (currently 7 days).
• When the Agreement ends: an export is offered for 30 days; then the Centre's site and data are deleted, and backups age out as above.
• Copies held by AI Providers: as each provider's terms say (see the Provider list).

Annex 4. Book In Chat's own uses

• De-identified Data (clause 6.2 of the terms): statistics and other information that cannot reasonably be used to identify anyone, for example how often AI suggestions were accepted. Small groups are left out where they could make someone identifiable.
• Improving AI marking and learning materials: copies of a Student's work, the AI's reading of it and tutors' corrections, with names removed, only with the separate optional consent "Help improve Acadence" given by a Parent (or by the Student, if 18 or older), on a signed form or recorded in the Service on the Student's behalf.
• Marketing: a Student's work shown in Book In Chat's promotion, without the Student's name or face, only with a signed consent form (from a Parent for a Student under 18).
• Shared knowledge: what the Centre chooses to share with other centres in Centre admin or in writing.
• Our relationship with the Centre: managers' and Staff's business contact details and sign-in records, for billing, support, security and notices.