Data processing agreement.

Version 1.0 · 10 November 2026

Betweenthe university, college, school or other organisation named in the order form or services agreement (“the Controller”), and Arrival Education Ltd, a company registered in England and Wales, whose company number and registered office are set out in the order form (“Arrival”, “the Processor”).

1. About this agreement

1.1 This agreement applies whenever Arrival processes personal data on the Controller’s behalf in providing the Services. It forms part of the services agreement between the parties. Where the two conflict on the protection of personal data, this agreement prevails.

1.2 “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and any other law on the processing of personal data that applies to either party. “Controller”, “processor”, “personal data”, “data subject”, “personal data breach” and “processing” have the meanings given in the UK GDPR.

1.3 “The Services” means Arrival’s programme for the Controller’s incoming students and their families, and the portal and reporting for the Controller’s staff, as described in the services agreement.

2. Roles

2.1 For personal data processed to provide the Services to the Controller’s students and staff, the Controller is the controller and Arrival is the processor.

2.2 Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

2.3 The Controller is responsible for having a lawful basis for the processing it instructs, and for telling its students how their data is used.

3. Instructions

3.1 Arrival processes personal data only on the Controller’s documented instructions, including with regard to transfers outside the United Kingdom. This agreement, the services agreement and the Controller’s use of the settings in the portal are its instructions.

3.2 If the law requires Arrival to process personal data otherwise, Arrival will tell the Controller before doing so, unless the law forbids it.

3.3 Arrival will tell the Controller straight away if, in its opinion, an instruction infringes Data Protection Law.

4. Confidentiality

4.1 Arrival ensures that everyone it authorises to process the personal data has committed to confidentiality or is under a statutory obligation of confidentiality, and has access only as far as their work needs it.

5. Security

5.1 Arrival implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR, including those in Schedule 2. Arrival may update them, provided the overall level of security does not decrease.

6. Sub-processors

6.1 The Controller gives Arrival general authorisation to engage the sub-processors listed in Schedule 3 and on our Security page.

6.2 Arrival will give the Controller at least 30 days’ notice before adding or replacing a sub-processor that handles the Controller’s personal data. The Controller may object on reasonable data protection grounds within that time, and the parties will discuss the objection in good faith. If it can’t be resolved, the Controller may end the affected Services without penalty.

6.3 Arrival imposes on each sub-processor, by contract, data protection obligations that give at least the same protection as this agreement, and remains fully liable to the Controller for each sub-processor’s performance of them.

7. Transfers outside the United Kingdom

7.1 Arrival transfers personal data outside the United Kingdom only as Schedule 3 sets out, and only where the transfer is lawful under Data Protection Law: to a country covered by UK adequacy regulations (such as Ireland), under the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. Data subjects’ rights

8.1 Taking into account the nature of the processing, Arrival helps the Controller, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights.

8.2 If Arrival receives such a request about the Controller’s personal data, it will pass it to the Controller without undue delay and will not respond itself except as the Controller instructs. Students can delete their own account at any time, which removes their data from the Services.

9. Breaches and other help

9.1 Arrival will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller’s personal data. The notice will describe, as far as Arrival then knows, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Arrival will update the Controller as it learns more.

9.2 Taking into account the nature of the processing and the information available to it, Arrival helps the Controller meet its obligations under Articles 32 to 36 of the UK GDPR: security, notifying breaches to the Information Commissioner and to data subjects, data protection impact assessments and prior consultation.

10. When the Services end

10.1 At any time, the Controller can export every student and their progress from the portal.

10.2 When the Services end, Arrival will, at the Controller’s choice, delete or return the Controller’s personal data within 30 days, and delete existing copies, unless the law requires Arrival to keep them. Copies in backups are deleted as the backups expire, within a further 30 days, and are not used in the meantime.

11. Information and audits

11.1 Arrival makes available to the Controller all information necessary to show that it meets its obligations under Article 28 of the UK GDPR, including answering reasonable security and data protection questionnaires.

11.2 Arrival allows for and contributes to audits, including inspections, by the Controller or an auditor it appoints, on at least 30 days’ notice, during normal working hours, no more than once a year unless a personal data breach or a regulator requires otherwise. Each party bears its own costs.

12. General

12.1 This agreement lasts for as long as Arrival processes personal data on the Controller’s behalf.

12.2 Each party’s liability under this agreement is subject to the limits in the services agreement, except where the law does not allow liability to be limited.

12.3 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule 1. The processing

Subject matter and purpose

Preparing the Controller’s incoming students for arrival and their first year, and showing the Controller’s staff how they are getting on.

Duration

The term of the services agreement, and any time needed afterwards under clause 10.

Nature of the processing

Collecting, storing, organising, displaying, sending messages and notifications, reporting, exporting and deleting.

Data subjects

Offer-holders and incoming students who join the Controller’s programme; parents or guardians a student chooses to invite; the Controller’s staff who use the portal.

Personal data

Name and email address; the Controller’s applicant ID for the student; optionally nationality, programme, study level, fee status and arrival date; the intake they join; account sign-in details (passwords are held only in hashed form by the sign-in provider); progress through lessons and quizzes and the arrival checklist; which of the Controller’s steps they have done, and whether a member of staff ticked one for them; when they last used the Services and which parts of the Controller’s page they used; the notifications and messages they were sent and whether they opened them; details a student chooses to enter while preparing; private copies of documents a student chooses to keep, which only the student can open; questions a student asks Ari, which are not kept, except a question and answer a student reports; if the student chooses, a profile shown to others starting at the same time; for parents, their name, email and link to the student; for staff, their name, email, job title, role and office.

Special category data

None is sought. If the Controller switches on the optional wellbeing check-in, a student’s answer about how they are feeling may be data concerning health. It reaches the Controller’s staff with the student’s name only when the student asks to be contacted, and only staff the Controller allows to see wellbeing.

Schedule 2. Security measures

• All data encrypted in transit, and encrypted at rest by our hosting providers.
• Data held in London, except as Schedule 3 sets out.
• Each university sees only its own students, enforced on our servers, not in the browser.
• Staff access by role (owner, manager, viewer) and, where the Controller sets it up, by office: someone in one office sees only that office’s steps and who has done them.
• The Controller’s staff never see what a student asks Ari or the documents they keep.
• Keys that can read across universities are held only on our servers, never sent to a browser or app.
• Passwords are never stored by us; the sign-in provider holds them hashed.
• Students can delete their account, and everything with it, at any time.
• We collect no financial details and never ask the Controller for students’ documents.

Schedule 3. Sub-processors