Peppo provides English Conversation Clubs to certain students referred to it by the London Borough of Hounslow (LBH). In connection with those services certain information may be shared between Peppo and LBH and an agreement has been reached between the parties governing this arrangement. In essence, the arrangement is as follows:
- Joint Controllers: Both parties will be joint controllers of information such as email addresses, addresses and other contact details, student profile details (including first name, surname, name of school, year group, date and time of sessions), student-specific feedback and messages exchanged between students and Peppo.
- Subject Access Request: Both parties shall maintain a record of individual requests from data subjects to exercise their rights under the Data Protection Legislation. The party receiving a subject access request shall be responsible for the conduct of such subject access request but shall notify the other party, keep that party appraised and take their views into account. The other party shall provide the recipient with such reasonable assistance.
- Retention Period: Neither party shall retain or process the shared data for longer than is necessary to carry out the purposes for which it is held or to comply with law. No data shall be transferred to any person located outside the UK or an EEA Country.
- Security: Each party shall put in place and maintain, appropriate technical and organisational measures to secure the information (having regard to the state of technological development and the cost of implementing such measures) and shall train staff to handle such data.
- Breach: Each party shall notify the other of any potential or actual data breach relating to the shared data.
