← Back to BrainLevelz
🧠 Data Processing Agreement
For schools using BrainLevelz with their pupils and families. Last updated: 23 September 2026.
A signed
Data Processing Agreement (DPA) is available on request for any school using
BrainLevelz: this is the separate contract between your school and VMtechy.com (as the data
processor) that most Data Protection Officers ask for before pupil data is processed by a
third-party service, alongside the
Privacy Notice
that covers what families are told directly.
What it covers
- The roles of each party (your school as data controller, VMtechy.com as data processor)
and exactly what personal data the Service processes on your behalf.
- The technical and organisational security measures already built into the Service (access
control enforced at the database layer, hashed credentials, and an aggregate-only design for a
teacher's school-wide report. No per-pupil data ever reaches that view. The exception is
homework: a teacher who sets homework for their own class sees the names of pupils in that
class, and their submitted answers, for marking purposes only; and, so that a class can be
built at all, a teacher can see a roster of the school's pupils limited to display name,
username and avatar, never their answers, scores or progress).
- Every third party involved in delivering the Service (database hosting, front-end hosting,
the font provider), and where each one processes data.
- How a personal data breach would be reported to your school, and the timescale for that.
- What happens to your school's data if you ever stop using the Service.
How to get one
Email nathan@vmtechy.com
with your school's name and your Data Protection Officer or business manager's contact details, and
a copy for signature will be sent across.
Request a DPA →
Related
Privacy Notice: what BrainLevelz collects and why, written for parents and pupils.