Data processing

Data processing agreement

When a university puts personal data about students and staff into Oxonia, it is the controller and we are its processor. This agreement sets out the rules we follow, as Article 28 of the UK and EU GDPR requires.

1. About this agreement

Last updated: 10 October 2026.

This data processing agreement (DPA) forms part of every university's contract with Oxford City Academy for Education and Development (OAED) ("Oxonia", the processor). The university or institution named in the order form is the controller. Oxonia Academy is part of Oxford City Academy for Education and Development (OAED), registered in England and Wales, company number 05216710, established 2004, Oxford.

It is written to meet Article 28 of the UK GDPR and the EU GDPR. It also covers the equivalent rules for processors and operators in the other countries we serve, set out in section 11. To request a signed copy, or to propose your own template, email legal@oxonia.ai.

2. Details of the processing

Item	Detail
Subject matter	Providing the Oxonia products and add-ons in the order form
Duration	The term of the contract, plus the export and deletion period in section 10
Nature and purpose	Hosting, storing, transcribing, translating, analysing, generating drafts from, displaying, sharing and deleting data so that the university can teach, assess, govern, administer and support students
Data subjects	Students, applicants, staff, external examiners, Council and Senate members, researchers, guardians and sponsors, alumni and donors
Personal data	Identity and contact details, course and role, recordings and transcripts, coursework and exam scripts, marks and feedback, governance papers, staff records, fees and payments, research records, usage and audit logs
Special category data	Only where the university chooses to process it, for example health information in a hardship or extenuating circumstances application

3. Our obligations as processor

Process personal data only on the university's documented instructions, including those given through the way it sets up and uses the Services, unless the law requires otherwise, in which case we will tell the university first where the law allows.
Tell the university if we think an instruction breaks data protection law.
Make sure everyone authorised to process the data is bound by confidentiality and trained.
Apply appropriate technical and organisational security measures, as described in the security overview.
Use sub-processors only as section 4 allows.
Help the university respond to people using their rights, and pass on any request we receive directly without answering it ourselves.
Help the university with security, breach notifications, data protection impact assessments and consultations with regulators.
Delete or return the data at the end of the Services, as section 10 says.
Make available the information needed to show we meet this DPA, and allow and contribute to audits, as section 9 says.
Not sell the data, not use it for our own purposes, and not use it to train AI models unless the university agrees in writing.

4. Sub-processors and change notices

The university gives general written authorisation for us to use the sub-processors listed on our sub-processors page. We bind each one by written terms that protect the data at least as well as this DPA, and we remain responsible for them.

Notice. We give at least 30 days' notice before a new or replacement sub-processor starts to handle the university's personal data. We email the university's named privacy contacts and update the sub-processors page.
Subscribe. Any university can add contacts to the notice list by emailing privacy@oxonia.ai with the subject "Sub-processor updates".
Object. The university may object on reasonable data protection grounds within the notice period. We will discuss the concern in good faith and try to offer an alternative, such as not using the new sub-processor for that university.
Exit. If we cannot resolve the objection, the university may end the affected Services and receive a refund of prepaid fees for the unused part of the term.
Emergencies. If a sub-processor must be replaced urgently to keep the Services running or secure, we will give as much notice as we can and explain why.

5. AI processing

AI features process the content Users give them, such as recordings, transcripts, essays and exam scripts, to produce drafts and answers. The AI service providers we use are listed as sub-processors. We use their business terms, under which they do not train their models on the data we send by default; they may keep it for a limited period for abuse and safety monitoring under those terms.

Where a university connects its own AI keys, that provider acts under the university's own agreement with it for that processing. Anything that becomes an official record waits for a named person to approve it. See the responsible AI policy.

6. International transfers

The order form and the data residency page record where the university's data is hosted. Where personal data is transferred outside the UK or the EEA, we rely on adequacy regulations or decisions, the UK International Data Transfer Agreement or UK Addendum, or the EU standard contractual clauses, with supplementary measures where a transfer risk assessment calls for them. For other countries, we use the mechanisms their laws recognise, as set out in the regional privacy addenda.

7. Personal data breaches

We will notify the university without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting its data, so that it can meet its own deadlines, such as 72 hours to notify the ICO. We will provide what we know, follow up as we learn more, take reasonable steps to contain the breach, and not notify regulators or individuals about the university's data without its agreement unless the law requires it.

8. Security measures

Encryption of data in transit and at rest.
Role-based access, two-step sign-in for administrators, and single sign-on with the university's identity provider.
Logging of administrative and staff access, with audit logs the university can export.
Separation of each university's data.
Tested backups and a documented recovery process.
Regular security testing and a public vulnerability disclosure route.

9. Audits

We will answer reasonable security and data protection questionnaires and share summaries of our policies and test results. Where that is not enough to show compliance, the university, or an independent auditor it appoints who is bound by confidentiality, may audit us once a year on at least 30 days' notice, during business hours and in a way that limits disruption and protects other customers' data, or at any time a regulator requires.

10. Return and deletion

For 30 days after the contract ends, the university can export its data using the Services' tools, including audit and consent logs.
Within 30 days after that, we delete the university's personal data, including from live systems, and instruct sub-processors to do the same, unless the law requires us to keep some of it.
Backups are overwritten on their normal cycle and stay encrypted and protected until then.
On request we confirm deletion in writing.

11. Regional terms

Where the university is subject to another country's law, the same terms apply with the necessary changes. For example, we act as a data processor under Nigeria's Data Protection Act 2023, an operator under South Africa's POPIA, a data processor under Kenya's Data Protection Act 2019 and Ghana's Data Protection Act 2012, a data processor under Malaysia's PDPA as amended in 2024, a data processor under Turkey's KVKK, and a processor under the UAE and Saudi PDPLs. Details are in the regional privacy addenda.

12. Liability and contact

Each party's liability under this DPA is subject to the limits in the terms of service, unless the order form sets a separate cap for data protection claims. Nothing in this DPA limits a person's rights under data protection law.

Questions about this DPA: legal@oxonia.ai or privacy@oxonia.ai.

Sub-processorsLike most software services, Oxonia relies on other companies for some parts of the service. This page names them, says what they do and where, and explains how we tell universities about changes.Regional privacy addendaWe serve universities in many countries. These addenda add to our privacy notice and data processing agreement where local law gives extra rights or sets different rules.Terms of serviceThese terms form the agreement between Oxonia Academy and each university or institution that subscribes to its products. They are written for business customers, not consumers.