Data Processing Agreement

This Data Processing Agreement (“DPA”) applies where TeZe Ltd (company no. 17137231, operating the Tactile Framework app, “Processor”, “we”) processes personal data on behalf of the Customer (“Controller”, “you”) in providing the app. It reflects Article 28 of the UK GDPR and, where it applies to you, the EU GDPR.

Acceptance. This DPA is incorporated into the Terms of Use. By using the app for your organisation you accept it. For a separately signed copy, email compliance@teze.app.

• Customer Personal Data means personal data we process on your behalf in connection with the app, principally learner records.
• Applicable Data Protection Law means the UK GDPR, the Data Protection Act 2018 (including amendments under the Data (Use and Access) Act 2025), the EU GDPR where it applies to you, and any related law.
• Sub-processor means any third party we engage to process Customer Personal Data.
• UK IDTA means the UK International Data Transfer Agreement, and EU SCCs the EU Standard Contractual Clauses approved by Commission Decision (EU) 2021/914.

• Subject matter: storage and presentation of practitioner observations, skill assessments and goals relating to learners, against the Bodily-Tactile Communication Framework.
• Duration: for as long as your practitioners hold accounts, plus up to 30 days afterwards for export or deletion.
• Nature: storage, retrieval, display, report generation, and export back to you. Optionally, and only if you enable it, de-identified text drafting as set out in section 6.
• Purpose:enabling your practitioners to keep structured records of a learner’s communication development and to plan and evidence their support.

• Data subjects: your practitioners, and the learners they support. The learners are usually children and young people with disabilities.
• Practitioner data: name, email address, organisation, role, authentication timestamps.
• Learner data, as held by us:a code and label chosen by the practitioner, framework stage, communication partner roles, observation free text, skill ratings, goals and dates. The app provides no field for a learner’s name, date of birth, address or NHS number.
• Special category data.Unlike our other products, this one expects it. Observations describe a learner’s communication, development and disability, and that is data concerning health under Article 9. We process it as your processor on the Article 9 condition you have determined and recorded, and we apply the measures in Annex 2 to all of it.
• What you must not put in. Direct identifiers do not belong in free text. Your practitioners should identify learners by code. We cannot technically enforce this, so it is a contractual obligation on you rather than a claim by us.

We will:

• Documented instructions. Process Customer Personal Data only on your documented instructions. The Terms of Use, your configuration and normal operation of the app together constitute those instructions. We will tell you immediately if we believe an instruction infringes Applicable Data Protection Law.
• Confidentiality. Ensure anyone authorised to process Customer Personal Data is bound by confidentiality and has had data protection training.
• Security. Implement the Article 32 measures described in Annex 2.
• Data subject rights. Assist you in responding to requests within 5 business days of a documented request. Because our records are pseudonymous, you hold the key that connects a learner to a code; we cannot identify a learner without you.
• Articles 32 to 36. Assist you with security, breach notification, data protection impact assessments and prior consultation. Given the data subjects here, we expect you to carry out a DPIA and we will support it.
• No direct contact. We do not answer data subjects, parents or guardians directly about their rights. We forward contact to you and act on your instructions.
• Safeguarding. We will not obstruct a practitioner who needs to export or print a specific record for a safeguarding referral, and export does not require the receiving body to hold an account.
• Article 30 records. Maintain processor records under Article 30(2) and make them available to you or a regulator on reasonable request.

No use for our own purposes. We will not process Customer Personal Data for our own purposes: not for product development beyond what is strictly necessary to provide the service to you, not for marketing, profiling or analytics, and never for sale, licence or transfer to anyone other than an authorised Sub-processor.

No AI training. We will not, and we will procure that our Sub-processors do not, use Customer Personal Data to train, fine-tune or otherwise improve any AI or machine learning model.

What the AI features actually do.If you enable them, three drafting features send text to Anthropic and return an editable draft to the practitioner. Names, contact details and links are removed before the request leaves our server. Drafts are never written to a learner’s record automatically. Anthropic does not train on API traffic. We have not signed a separate zero-retention agreement, and we do not claim one. If your assessment requires zero retention in writing, tell us before you enable the features and we will put it in place.

No joint controllership. Nothing here creates a joint controller relationship under Article 26. If a change to your use of the app would in our reasonable view create one, we will discuss it with you before implementing it.

You give general authorisation for the Sub-processors listed at /legal/subprocessors, which is incorporated into this DPA by reference along with each entry’s location, purpose and transfer mechanism.

We give at least 30 days’ notice of any addition or replacement. You may object on reasonable data protection grounds, and if we cannot resolve the objection within 30 days you may terminate the affected services without penalty. We impose obligations on each Sub-processor no less protective than these, and we remain liable to you for their performance.

Customer Personal Data is stored in the European Economic Area: the database and authentication service are in eu-west-3 (Paris, France). This is EEA hosting, not UK hosting. Where your procurement policy requires UK-only residency, raise it with us before deployment.

Where a Sub-processor is outside the UK or EEA, transfers are made under the UK IDTA where the UK GDPR applies, or the EU SCCs with the UK Addendum where the EU GDPR also applies, both incorporated by reference. The optional AI drafting features involve a transfer to a US provider of de-identified text only, under the provider’s standard terms and transfer safeguards.

Transfer risk. We will provide our assessment of any transfer outside the UK or EEA, in summary form, on reasonable written request.

We will notify you without undue delay, and in any event within 48 hours of becoming aware, of any personal data breach affecting Customer Personal Data. The notification covers the nature and scope, likely consequences, measures taken or proposed, and a contact point (compliance@teze.app).

We will not publicly disclose a breach affecting your data without your prior written consent, except where the law or a supervisory authority requires it.

Within 30 days of termination, or earlier on your documented request, we will at your choice delete Customer Personal Data from live systems, with encrypted backups purged in line with backup rotation, or return it in a structured, machine-readable format and then delete all copies. Written confirmation of deletion is available on request.

Retention is yours to set, and is not automated yet.UK practice for speech and language therapy records is 8 years from the last entry, or until the person’s 26th birthday if later, under the NHS Records Management Code of Practice 2021. Your schedule governs. Scheduled deletion is not currently enforced by the app, so records persist until you ask us to remove them. We will tell you when automated retention ships.

On reasonable prior written notice, and no more than once in any 12-month period unless you have reasonable grounds to suspect non-compliance, we will make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits by you or an auditor you mandate, subject to reasonable confidentiality obligations.

Audits take place in business hours and in a way that does not unreasonably disrupt operations or other customers’ security. You bear our reasonable costs beyond a once-yearly desktop review.

Updates. Any change that materially reduces your rights or our obligations is notified at least 30 days in advance, and you may object on reasonable grounds and terminate without penalty if we cannot resolve it. Changes that improve protection or are required by law take effect on publication.

Notices. Data protection notices go to compliance@teze.app. We acknowledge substantive notices within 5 business days.

Conflict. Order of precedence: (i) the UK IDTA or EU SCCs, (ii) this DPA, (iii) the Terms of Use, (iv) any other document.

Governing law. England and Wales, whose courts have exclusive jurisdiction, subject to any mandatory provisions of the UK IDTA or EU SCCs.

Maintained at /legal/subprocessors. That list forms part of this DPA and changes as described in section 7.

• Pseudonymity by design: no field exists for a learner’s name, date of birth or other direct identifier.
• Data hosted in the EEA, eu-west-3 (Paris).
• Postgres row-level security so a practitioner reaches only their own caseload.
• TLS in transit, encryption at rest.
• Practitioner-only access: learners have no account and cannot sign in.
• De-identification of any text sent to the optional drafting features, applied server-side in the prompt builder so a route cannot skip it.
• Timestamped, practitioner-attributed record entries.
• Multi-factor authentication enforced on every administrative system.
• Managed database backups with point-in-time recovery.
• Cyber Essentials certified by IASME, 31 July 2026, annual renewal. ICO registration ZC134108.
• Documented information security policies (information security, acceptable use, access control, retention, incident response, risk register), reviewed at least annually.

Not yet in place, and listed because a reviewer will ask: an independent penetration test, a WCAG 2.2 AA audit, DSPT submission, and a DCB0129 clinical safety case. Where your procurement requires any of these, talk to us before you deploy.