How PE Pathway processes pupil and staff data on behalf of schools.
Download PDF (with signature page)It is accepted online by an authorised representative of the School when they accept the Terms of Service in PE Pathway, or by signing the acceptance page in the PDF version.
School: the school, academy trust, governing body or other organisation that subscribes to PE Pathway, as identified in the online acceptance record or on the acceptance page (the School).
Provider: Fit4Fun Sports Dance & Fitness Limited, company number 08337190, of 2 Waller Grove, Swanland, East Riding of Yorkshire, HU14 3FF, trading as PE Pathway (PE Pathway). PE Pathway is a trading name, not a separate legal entity.
1.1Data Protection Law means the UK GDPR, the Data Protection Act 2018 and other applicable UK privacy and data protection legislation, as amended. Controller, processor, personal data, processing, data subject and personal data breach have the meanings given in that law.
1.2Services means the platform at app.pepathway.co.uk and related support. School Personal Data means personal data processed on the School’s behalf as described in Schedule 1. Sub-processor means a provider processing that data on PE Pathway’s behalf.
1.3This agreement and its schedules take priority over the Main Agreement for the processing of School Personal Data. Commercial matters remain governed by the Main Agreement, subject to clause 12.
2.1The School is the controller and PE Pathway is the processor of School Personal Data. Each party will comply with its own obligations under Data Protection Law.
2.2The School determines and documents its lawful basis, provides appropriate privacy information, controls staff permissions and is responsible for the accuracy and lawfulness of the information it supplies. PE Pathway will provide the information and assistance needed for those purposes.
2.3Where PE Pathway determines the purposes of processing business contact, billing or legal records for its own administration, it acts as a separate controller for that processing, as explained in its Privacy Policy. This does not authorise any independent use of pupil records.
3.1PE Pathway will process School Personal Data only on documented instructions, including this agreement, the School’s authorised use of the agreed features and any later written instructions. This includes instructions about international transfers. If UK law requires other processing, PE Pathway will tell the School beforehand unless that law prohibits it on important grounds of public interest.
3.2PE Pathway will immediately tell the School if, in its opinion, an instruction infringes Data Protection Law, and will not carry out the affected instruction while the parties resolve it.
3.3PE Pathway will not sell School Personal Data, use it for advertising or allow it to be used to train general-purpose AI models. The authorised AI report-writing activity is described in Schedule 4.
4.1PE Pathway will ensure that authorised personnel are bound by contractual or statutory confidentiality obligations and access School Personal Data only as necessary for their role. PE Pathway will ensure those personnel understand their data protection responsibilities, including how to recognise and promptly report a personal data breach or an individual’s rights request.
5.1PE Pathway will implement and maintain the measures required by Article 32 of the UK GDPR, taking account of the processing, available technology and the risks, including that most pupil data subjects are children. Schedule 3 sets out the measures.
5.2PE Pathway will regularly assess those measures and will not materially reduce the agreed level of protection. Access through support, development tools or logs remains subject to this agreement, and production data is not used for unrelated development or testing.
6.1The School gives general written authorisation for the sub-processors listed in Schedule 2 and their documented onward providers, subject to this clause. PE Pathway will keep that list up to date and make it available to the School.
6.2PE Pathway will give at least 30 calendar days’ prior email notice of a proposed new or replacement sub-processor. The School may object on reasonable data protection grounds during that period. The parties will seek a solution, and the proposed provider will not process the School’s data while the objection remains unresolved. If no solution is agreed, the School may end the affected Services and receive a proportionate refund of prepaid fees for the unused period.
6.3Before processing starts, and after reasonable due diligence on its data protection and security arrangements, PE Pathway will bind each sub-processor to equivalent data protection obligations for the activities it performs, including sufficient security guarantees. PE Pathway remains fully liable to the School for those obligations.
7.1PE Pathway will make or permit transfers outside the UK, including relevant remote access, only on the School’s documented instructions and in accordance with the UK GDPR. Schedule 2 identifies the relevant locations and the adequacy regulations or Article 46 safeguards relied on.
7.2A primary database location does not establish every processing or access location. PE Pathway will provide information reasonably needed to understand the transfer arrangements. The School’s acceptance does not replace a required lawful transfer mechanism.
8.1Taking account of the nature of the processing, PE Pathway will assist the School through appropriate technical and organisational measures, so far as possible, with individuals’ rights requests. It will pass requests about School Personal Data to the School without undue delay and will respond to them itself only on the School’s instructions or where legally required. Where the School corrects, restricts or deletes School Personal Data, PE Pathway will apply that change without undue delay to the copies held by PE Pathway and its sub-processors, so far as technically possible and subject to clause 10.4 for backups.
8.2Taking account of the processing and the information available, PE Pathway will assist with the School’s obligations under Articles 32 to 36 of the UK GDPR, including security, notifications to the regulator and affected people, impact assessments and prior consultation. It will provide timely assistance so the School can meet applicable deadlines.
9.1PE Pathway will notify the School without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting School Personal Data. This outside limit does not permit avoidable delay.
9.2The notice will give available details of the incident, the categories and approximate numbers of people and records affected, likely consequences, action taken or proposed, and a contact. Missing details will follow without undue further delay. PE Pathway will investigate, mitigate and cooperate with the School. PE Pathway will keep a record of personal data breaches affecting School Personal Data, including the facts, effects and action taken, and will make the relevant entries available to the School on request.
9.3The School decides which regulatory and individual notifications are required. PE Pathway will not notify pupils or parents on the School’s behalf without instructions, except where legally required. Each party’s independent legal duties remain unaffected.
10.1The School may choose secure return or deletion when the Services end and may give lawful erasure instructions at any time. Cancelling a future renewal is not itself the end of the Services while paid access continues. The periods below run from the actual end or expiry of the Services.
10.2The School has 30 calendar days after the Services end to request a copy of its data. PE Pathway will provide a secure copy in a commonly usable electronic format (such as CSV), including pupil records and report comments, and will delete remaining active copies by the end of that period. Return will come before deletion. An earlier deletion instruction will be followed without undue delay. If a timely request cannot be completed within that period, the parties will promptly agree a short timetable in writing, and data needed for the return will not be deleted before it is delivered.
10.3If no copy is requested, the School instructs deletion at the end of the 30-day period. Deletion covers linked records, relevant files, operational copies and sub-processor copies, not just removal from a class list. Archiving a pupil or an academic year is not deletion.
10.4Backup copies that cannot be selectively deleted will be put beyond ordinary use and will expire within a further 90 calendar days after the 30-day period (120 days in total). If a backup is restored for recovery, relevant deletions will be reapplied before ordinary use resumes.
10.5Where UK law requires retention, PE Pathway will identify the legal basis, the data affected and the period, unless prohibited. Retained data remains protected and is used only for that purpose. PE Pathway will confirm deletion on request, identifying any outstanding backup copies and their final expiry dates.
11.1PE Pathway will provide all information necessary to demonstrate compliance with Article 28 of the UK GDPR and will allow for and contribute to audits and inspections by the School or an auditor it appoints.
11.2Routine audits may be arranged on reasonable notice, normally once a year, with proportionate confidentiality and security arrangements. This does not restrict checks justified by a breach, reasonable evidence of non-compliance, a material processing change or a legal or regulatory requirement.
11.3PE Pathway will maintain a written record of its processing activities as a processor, as required by Article 30(2) of the UK GDPR, and will provide relevant extracts to the School on request.
12.1The liability provisions of the Main Agreement apply to the extent permitted by law. Nothing in this agreement excludes liability that cannot lawfully be excluded, restricts data subjects’ statutory rights or relieves either party of its own statutory obligations.
13.1This agreement applies to free trials and paid Services from acceptance of the Main Agreement incorporating it, or from signature by both parties if signed separately. It must be in place before School Personal Data is processed, and remains in effect for as long as PE Pathway or its sub-processors hold that data.
13.2Online acceptance by an authorised representative of the School binds the School. PE Pathway will keep a record of the accepted version, the organisation, the person accepting and the date, and will provide a copy on request. A signature page is an alternative, not an additional requirement.
13.3PE Pathway may update this agreement, for example to reflect a sub-processor change under clause 6.2 or a change in law. It will tell schools about material changes and ask an authorised representative to accept the new version in PE Pathway.
14.1This agreement is governed by the law of England and Wales, and its courts have exclusive jurisdiction, without restricting rights or regulatory powers that cannot lawfully be restricted.
| Item | Details |
|---|---|
| Subject matter | Delivery, assessment and reporting of primary school PE using PE Pathway. |
| Purpose | Provide lesson content, session assessments, end-of-block and annual report drafts, certificates and badges, whole-school progress information, staff access and service support. |
| Nature and frequency | Receive, record, organise, store, retrieve, display, amend and analyse data; generate AI report text; send necessary service emails; provide copies and delete. Processing happens as features are used, with continuous hosting. |
| Duration | The term of the Main Agreement, including any trial, followed only by the return, deletion and retention periods in clause 10. |
| People concerned | Pupils added by the School, usually Reception to Year 6; teachers, PE leads and other authorised staff. Support messages may incidentally identify other people and should be kept to a minimum. |
| Pupil information | Name (held as a single full-name field); year group and class; school and pupil identifiers; current or left status; session assessments and dates; attainment levels and not-completed or not-assessed status; end-of-block and annual report comments; certificates and badges. There is no separate attendance register. |
| Staff information | Name and certificate title, school work email, role, class or year group, account status (active, on leave or deactivated), account identifiers and login records, terms acceptance records; end-of-block ratings, badges and feedback sent through the platform; necessary support messages. |
| Operational information | Login and activity records, request details such as IP addresses, diagnostic information and identifiers. Pupil names and report text are not written to application logs. |
| Excluded information | Pupil health, SEND, safeguarding, ethnicity, religion and other special category or criminal offence data are outside the agreed scope. Staff must not enter these, including in free text. If received accidentally, PE Pathway will tell the School and help remove it on instructions. |
| School and commercial details | School details linked to identifiable staff may be personal data. PE Pathway’s own subscription, invoice and legal records are covered by its Privacy Policy as a separate controller. |
| Retention and location | Archived records are kept while the School keeps its account. Clause 10 governs exit. Primary database: Supabase, AWS eu-west-1 (Ireland). Other providers and locations are listed in Schedule 2. |
The School may require correction, return or deletion on its lawful instructions. A new category of data or a materially different purpose requires a documented change to this schedule.
These providers process School Personal Data on PE Pathway’s behalf. Each is bound by its own data processing terms, which include UK transfer safeguards where data is processed or accessed outside the UK and EU.
| Provider | Purpose and data | Location and safeguards |
|---|---|---|
| Supabase | Database and login. Pupil, assessment and report records; staff accounts and login records. | Ireland (EU, AWS eu-west-1). The UK recognises the EU as adequate. Supabase’s DPA covers any access from outside the UK and EU. |
| Replit | Application hosting. Servers that process pupil and staff data; technical logs (no pupil names or report text). | Deployment region: Europe (EU). Replit, Inc. is US-based; its DPA and UK transfer terms cover any access from the USA. |
| Anthropic | AI report drafting. Pupil first names only, assessments, sport, skill topics, year group and earlier report comments (see Schedule 4). | USA. Anthropic’s DPA incorporates the UK Addendum to the EU Standard Contractual Clauses. Inputs and outputs are not used for model training. |
| Resend | Service emails. Staff names, email addresses, school name and invitation or password emails containing single-use links (not passwords). | EU sending region. Resend is US-based; its DPA and UK transfer terms apply. |
| Microsoft 365 | PE Pathway’s support mailbox ([email protected]). Staff contact details and support messages. Schools should not send pupil data by email. | Exchange Online data location Europe, with the UK as the committed location. Microsoft Products and Services DPA. |
The AI features draft end-of-block and annual PE report comments from the School’s recorded assessments and, for annual reports, earlier comments. The School instructs this processing when authorised staff use the features. Comments are only generated when a teacher chooses to generate them. They are shown to staff inside PE Pathway and are never sent to parents or anyone outside the School by PE Pathway.
Staff must read and, where needed, correct each comment before using it. The feature supports professional judgement: the School must not use generated text as the only basis for any decision with legal or similarly significant effects.
Only the pupil’s first name is sent; any further names are removed before sending. End-of-block requests contain the pupil’s first name, a temporary reference (such as P1), attainment level, total and per-session scores (as descriptions), session topics, sport and academic year, and use Claude Sonnet 4.5. Annual requests contain the pupil’s first name, year group, the sports covered and their topics, planned curriculum coverage and the pupil’s earlier report comments, with the pupil’s surname removed from that earlier text, and use Claude Haiku 4.5.
School names, staff names and database identifiers are not sent. Sending first names only is data minimisation, not anonymisation: the information is still personal data.
Generated comments are stored with the pupil’s record and may contain inaccurate statements or assumptions. The AI may infer pronouns from a pupil’s first name, so teachers must check names, pronouns and wording against their own assessment before use.
PE Pathway uses Anthropic’s commercial API. Under Anthropic’s commercial terms, inputs and outputs are not used to train its models. Anthropic’s standard API policy deletes inputs and outputs within 30 days, subject to limited exceptions such as policy enforcement or legal requirements. Deleting a comment in PE Pathway does not instantly delete any copy Anthropic holds within that period.
PE Pathway will provide this description, relevant provider terms and available technical information to support the School’s privacy notice and any impact assessment. The School decides its lawful basis and whether an impact assessment is needed. The School’s agreement to this processing is not consent on behalf of pupils or parents.
Most schools accept this agreement online, when a PE lead accepts the Terms of Service in PE Pathway. The online record identifies the School, the person accepting, the date and time and the version accepted. If your school or trust prefers to sign on paper, download the PDF above, which includes a signature page.
| Role | Contact |
|---|---|
| Data protection and incident lead | Tom Farrow, Director · [email protected] |
| Backup incident contact | Danny Furlong · [email protected] |