This data handling agreement records the terms upon which Wonde will use the School Data for the purpose of transferring the School Data to School approved users, including application providers of services or products to the School and this Agreement is therefore formed between Wonde and the School.
Wonde means Wonde Pty Ltd, a company registered in Australia under ACN 631 042 307 whose registered office is at 204/3 Spring St, Sydney, NSW, 2000, Australia. Wonde is part of the Beyond group of companies (Beyond Group) including Wonde Limited (a company incorporated in England with the company number 14160647 (Wonde UK).
BY GRANTING ACCESS TO THE WONDE SOFTWARE TO SOME OR ALL OF THE SCHOOL DATA, THE SCHOOL AGREES TO THE TERMS OF THIS DATA HANDLING AGREEMENT.
THESE TERMS ARE INCORPORATED INTO ALL TERMS AND CONDITIONS UNDER WHICH WONDE HAS AGREED TO PROVIDE ITS WONDE SOFTWARE TO THE SCHOOL AND THE SCHOOL SUPPLIERS.
1. Definitions
1.1. In this Agreement the following definitions shall apply:
“Agreement” means this Data Handling Agreement.
“Authorised Persons” shall mean the persons or categories of persons that the School authorises to give Wonde instructions pursuant to this Agreement.
“Beyond Group” means the group of companies of which Wonde forms a part, including Wonde Limited UK (having company number 14160647).
“Confidential Information” means all confidential information (however recorded or preserved) disclosed by the School to Wonde in connection with this Agreement which is either labelled as such or else which could be reasonably considered confidential because of its nature and the manner of its disclosure.
“Data” means any information relating to an identified or unidentified individual or any other information defined as ‘personal data’ or ‘personal information’.
“Data Protection Laws” means all applicable data protection and privacy legislation in force from time to time in Australia and New Zealand including but not limited to the Australian Privacy Act 1988 (“Australian Act”) which incorporates the Australian Privacy Principles (“APPs”), the Privacy Act 2020 New Zealand (“NZ Act”) which incorporates the Information Privacy Principles (“IPPs”), any applicable state or territory data protection legislation and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of School Data (including, without limitation, the privacy of electronic communications); and the guidance and codes of practice issued by any Government, state or other relevant regulatory authority and applicable to either party.
“Effective Date” means the date upon which the School accepts these terms.
“Good Industry Practice” means using standards, practices, methods and procedures conforming to the law and exercising that degree of skill and care diligence prudence and foresight which would reasonably and ordinarily be expected from a skilled and experienced person or body engaged in a similar type of undertaking under the same or similar circumstances.
“Personal Data Breach” means an ‘eligible data breach’ as defined at section 26WE of the Australian Act or a ‘notifiable privacy breach’ as defined at section 112 of the NZ Act but shall include any breach of School Data.
“School” means the school, jurisdiction or education establishment using the Wonde Software.
“School Data” means any Data sets relating to students, parents and guardians, and staff at the School, and other forms of data regarding the School which are approved by any Authorised Persons.
“School Suppliers” means third party providers of services or products via third party applications to the School to which the School wishes to transfer certain data sets of the School Data.
“Services” Means the services performed by Wonde:
a. for the benefit of the School and School Suppliers, utilising the Wonde Software, of transferring selected School Data from the School or its SIS/SMS to selected School Suppliers; and
b. to allow students, parents and guardians, and staff at the School to access selected data from the SIS/SMS and/or School Suppliers using a single account within the Wonde Software; and
c. to allow access to, and use of the Wonde Software.
“SIS/SMS” means the School’s database which holds the School Data.
“Sub-contractors” means any third-party, person or company appointed by or on behalf of Wonde who may use or have access to Data to facilitate the provision of the Services in connection with the Agreement.
“UK Data Protection Laws” means all applicable data protection and privacy legislation in force from time to time in the UK including the Data Protection Act 2018 (“DPA”) (as amended or replaced from time-to-time), UK GDPR (as defined in the Data Protection Act 2018) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of Data (including, without limitation, the privacy of electronic communications); and the guidance and codes of practice issued by the Information Commissioner or other relevant regulatory authority and applicable to a party.
“Wonde Software” means the software applications and platform supplied (directly or indirectly) by Wonde and used by the School including the Wonde school portal.
1.2 A reference to writing or written includes emails and writing in any electronic form.
2. General Provisions
2.1. The Effective Date of this Agreement shall be the date that the School accepts the terms of this Agreement and the School acknowledges that this Agreement shall be effective and replace any previously applicable data handling terms to the extent not otherwise expressly agreed in writing.
2.2. This Agreement applies to the extent that Wonde uses, discloses or collects any School Data which is subject to the Data Protection Laws.
2.3. Wonde is part of the Beyond Group, which includes entities located outside of Australia, including Wonde UK. Wonde UK may be involved in the delivery of the Services and the Wonde Software.
2.4. By granting access to (some or all of) the School Data to Wonde and the Wonde Software, the School agrees to the terms of this Agreement, except where otherwise expressly agreed in writing.
2.5. The parties acknowledge that, for the purposes of the Data Protection Laws in Australia and New Zealand, Wonde handles School Data on behalf of the School as a service provider. The School and Wonde acknowledge that, to the extent that UK Data Protection Laws apply in respect of protecting the School Data, Wonde is a Data Processor, and the School is a Data Controller in respect of the School Data comprising Personal Data which is processed by the Wonde Software.
2.6. Information relating to Wonde’s collection and handling of School Data and information is outlined in its Privacy Policy, which is made available to the School and is further available on Wonde’s website or by request.
2.7. Wonde shall comply with all applicable Data Protection Laws in respect of its obligations for the use, collection and disclosure of the School Data.
2.8. Wonde shall not use or disclose any School Data other than:
2.8.1. in accordance with the documented instructions of the School; or
2.8.2. as required by applicable law, in which case Wonde shall, where legally permitted, notify the School prior to such disclosure.
2.9. The School hereby instructs and authorises Wonde to access, collect, hold, use and disclose School Data for the purpose of:
2.9.1. transferring certain School Data through its instructions via the Wonde school portal from the School to School Suppliers, which permits students, parents and guardians, and staff of the School to access and manage the School Data effectively;
2.9.2. carrying out requests and/or instructions to restrict or approve data sets via the Wonde school portal;
2.9.3. Wonde providing the School with access to the Wonde Software; and
2.9.4. to the extent strictly necessary for the performance of the Services and consistent with the documented instructions of the School.
2.10. The School warrants transfer by the School of the School Data to Wonde for the purpose of Wonde accessing and using the School Data as set out in this clause 2, is lawful. Each party is responsible for its own compliance with Data Protection Laws to the extent applicable to it. The School shall indemnify Wonde against any loss to the extent directly caused by the School’s breach of this clause, except to the extent that such loss is caused or contributed to by Wonde.
2.11. The School and Wonde confirm that Schedule 1 determines the subject matter, duration, nature and purpose of the use of the School Data which includes the following:
2.11.1. the access, collection and use of School Data by Wonde will comprise the collection or extraction of School Data from the SIS/SMS, the organisation and re-categorisation of that School Data, the disclosure of the School Data to School Suppliers notified to Wonde by the School via the Wonde school portal, the handling of School Data within and for the purpose of the Wonde Software, and the disclosure of the School Data to parents, guardians, students and staff of the School who are permitted access to the Wonde Software;
2.11.2. the purpose of the handling and use of School Data by Wonde is to enable Wonde to provide the Services; and
2.11.3. the School Data that will be processed by Wonde will be School Data, and the individuals likely affected by the use of School Data will be students of the School, their parents (including guardians and other parental level carers), and staff of the School.
2.12. Wonde must not:
2.12.1. use School Data for analytics, product development or service improvement purposes, except where such data has been irreversibly de-identified;
2.12.2. use School Data for marketing or advertising; or
2.12.3. otherwise use School Data for any purpose not expressly authorised by the School.
3. Term and Termination
3.1. This Agreement shall commence on the Effective Date and shall continue in full force unless and until:
3.1.1. the School removes the Wonde Software from the School’s computer network or SIS/SMS, at which point this Agreement shall automatically terminate; or
3.1.2. either party terminates this Agreement in accordance with any applicable master services agreement or applicable law.
3.2. Upon termination of this Agreement, clauses 2.6, 2.9, 2.12, 4, 5, 6 and 10 shall continue to apply.
3.3. Any provision of this Agreement that expressly or by implication should come into or continue in force on or after termination of the licence terms or this Agreement, in order to protect the School Data, will remain in full force and effect.
4. Access to Data, Complaints and Personal Data Breaches
4.1. Taking into account the nature of the handling of School Data conducted by Wonde, Wonde shall (and shall use all reasonable endeavours to procure that its Sub-contractors shall) assist the School by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the School’s obligations, to respond to requests to access or correction Data under the Data Protection Laws.
4.2. Wonde shall:
4.2.1. promptly notify the School if it or any Sub-contractor receives a request from an individual under any Data Protection Law in respect of School Data;
4.2.2. notify the School promptly in writing if it receives any complaint or notice that relates directly or indirectly to the handling of the School Data and/or to either party’s compliance with the Data Protection Laws; and
4.2.3. not, and shall use all reasonable endeavours to ensure that the Sub-contractor does not, respond to any request from an individual, except on the written instructions of the School or as required by any applicable laws to which Wonde or the Sub-contractor is subject to.
4.3. Wonde shall notify the School as soon as practicable, and in any event within 48 hours, after becoming aware of:
4.3.1. the loss, unintended destruction or damage, corruption, or unusability of part or all of the School Data. Wonde will restore any School Data at its own expense as soon as possible;
4.3.2. any accidental, unauthorised or unlawful handling of the School Data; or
4.3.3. any Personal Data Breach,
in respect of any School Data processed by Wonde, providing the School with sufficient information to allow the School to meet any obligations to report, or inform the individuals to which the School Data related, of such Personal Data Breach under Data Protection Laws. It shall be the responsibility of the School to report the Personal Data Breach to the appropriate regulatory authority and affected individuals, if required to do so by law, but nothing in this Agreement limits the ability of Wonde or any of its Sub-contractors from making such reports where failure to do so would cause it to breach the Data Protection Laws. Wonde shall provide all information reasonably required to enable the School to comply with the Notifiable Data Breaches scheme under the Australian Act.
4.4. Wonde shall cooperate with the School and take such reasonable commercial steps as directed by the School to include; assisting in the investigation, facilitating any interviews, remediation and making any records available in relation to any such Personal Data Breach referred to in clause 4.3.
4.5. Wonde shall provide reasonable assistance to the School (at the School’s expense, provided such costs are reasonable, pre-agreed in writing, and reflect Wonde’s actual costs) with:
4.5.1. responding to any request from an individual; and
4.5.2. any privacy impact assessments, and prior consultations with competent data privacy authorities, which the School reasonably considers to be required under any Data Protection Laws.
5. Disclosure of School Data
5.1. The School hereby consents to the Wonde Software accessing the School Data held on the SIS/SMS, for the purpose of collecting and disclosing such School Data to Wonde and to School Suppliers.
5.2. Upon leaving the School SIS/SMS by electronic means (via HTTPS) the School Data will be encrypted by the Wonde Software.
5.3. Wonde shall ensure that the School has access to the Wonde school portal whereby the School has visibility and control over the categories of School Data they are sharing with each School Supplier; subject to any terms and conditions of use for the online portal.
5.4. School Data will only be disclosed to School Suppliers where instructed by the School to the school portal within the Wonde Software.
5.5. The School will also enter into separate contractual terms with the School Suppliers to ensure that all Data Protection Laws are being complied with by the School Suppliers and to protect the data relationships.
5.6. The School agrees that it has determined that it has a lawful basis for such a disclosure to Wonde and has provided all notices and received all consents and rights necessary under the Data Protection Laws to enable Wonde to handle the School Data in the manner described in this Agreement.
5.7. In particular, the School acknowledges and agrees that it will be solely responsible for, to the extent within its control, (i) the accuracy, quality, and legality of the School Data and the means by which it has been acquired; (ii) complying with all necessary transparency and lawfulness requirements under the Data Protection Laws for the collection, use, disclosure and storage of the School Data in the manner permitted by this Agreement; (iii) ensuring the School has the right to transfer or provide Wonde access to the School Data for handling under this Agreement; (iv) ensuring that the School’s instructions to Wonde comply with applicable laws including the Data Protection Laws.
5.8. The School indemnifies Wonde against losses to the extent directly caused by the School’s breach of this clause 5, except to the extent caused or contributed to by Wonde or its Sub-contractors.
6. Ownership of the School Data and Confidential Information
6.1. The School Data shall always remain the property of the School.
6.2. The School therefore retains control of the School Data and remains responsible for its compliance obligations under the Data Protection Laws, including but not limited to, providing any required notices and obtaining any required consents, and for the written handling instructions it gives to Wonde.
6.3. Wonde shall keep all Confidential Information and School Data confidential and shall not:
6.3.1. use any Confidential Information or School Data except for the purpose of performing the Services it provides to the School; or
6.3.2. disclose any Confidential Information in whole or in part to any third party, except as expressly permitted by this Agreement, or as required for the purpose of any Services provided by Wonde to the School, or to the extent required by law.
6.4. Wonde shall ensure that all persons authorised by Wonde to process the School Data are:
6.4.1. informed of the confidential nature of the School Data and are bound by confidentiality obligations and use the appropriate restrictions in place in respect of preserving the School Data; and
6.4.2. to have undertaken training on the Data Protection Laws relating to any handling of the School Data.
7. Security of the Data
7.1. Wonde shall implement and maintain reasonable technical and organisational measures to protect School Data, reflecting Good Industry Practice, including:
7.1.1. encryption in transit and at rest where practicable;
7.1.2. access controls based on least privilege;
7.1.3. authentication and identity management controls;
7.1.4. logging and monitoring;
7.1.5. regular testing of security measures; and
7.1.6. incident response procedures.
7.2. In assessing the appropriate level of security, Wonde shall take account in particular of the risks that are presented by the handling and use of the School Data, in particular from a Personal Data Breach and to preserve the security and confidentiality of the School Data, in accordance with Wonde’s Privacy Policy. Further details of Wonde’s security policies and processes are available on request.
8. Sub-contractors and International Transfers
8.1. Wonde may permit access to School Data by Wonde UK and other members of the Beyond Group solely for the purpose of providing support and maintenance services to the School, provided that Wonde remains responsible for the acts and omissions of such entities in connection with this Agreement.
8.2. The parties acknowledge that access to School Data from outside Australia, including by remote access, constitutes a disclosure of personal information to an overseas recipient for the purposes of the Australian Privacy Principles.
8.3. Wonde shall comply with APP 8 and section 16C of the Australian Act and shall:
8.3.1. take reasonable steps to ensure overseas recipients do not breach the Australian Privacy Principles;
8.3.2. ensure overseas recipients are bound by enforceable contractual obligations providing substantially similar protection; and
8.3.3. implement appropriate technical and organisational measures to safeguard School Data during any cross-border access.
8.4. Wonde shall ensure that access is limited to what is reasonably necessary for the provision of the support and maintenance services, including by limiting access to the minimum amount of School Data required for the relevant support activity.
8.5. Wonde shall make available to the School, and on request provide further details of:
8.5.1. countries where School Data may be accessed; and
8.5.2. categories of recipients.
8.6. Cross-border access to School Data shall only occur in accordance with clause 8.3.
8.7. If any School Data disclosure between Wonde and the School requires execution of further contractual clauses in order to comply with the Data Protection Laws or UK Data Protection Laws, the parties shall agree to enter into a further agreement to reflect those further requirements.
8.8. Wonde shall maintain an up-to-date list of Sub-contractors with access to School Data and provide it on request. Wonde shall notify the School of material changes within a reasonable time after such changes occur.
9. Insurance
9.1. Wonde maintains a policy of insurance in respect of public liability in respect of the Services provided by Wonde and the handling and extraction of the School Data and shall produce a copy of such policy to the School if requested to do so.
10. Deletion or return of School Data
10.1. Upon termination or written request, Wonde shall, within 30 days, delete or return all School Data, unless required to retain it by law.
10.2. Subject to clause 10.3, the School may in its absolute discretion by written notice to Wonde at any time require Wonde to:
10.2.1. return a complete copy of all School Data by secure file transfer in such format as is reasonably notified by the School to Wonde; and
10.2.2. delete and use all reasonable endeavours to procure the deletion of all other copies of School Data handled by Wonde or any of its Sub-contractors.
10.3. Wonde shall provide a written certification of deletion upon request.
10.4. Wonde and its Sub-contractors may retain School Data to the extent required by any applicable law, provided that Wonde and its Sub-contractors shall ensure the confidentiality of all such School Data retained, and shall ensure that such School Data is only handled and used as necessary for the purpose(s) specified by the applicable laws requiring its storage and for no other purpose.
10.5. Wonde shall, within 30 days of a formal request from the School, provide written confirmation to the School that it has complied with this clause 10.
11. Audit and Information Rights
11.1. Subject to clauses 11.2, 11.3 and 11.4, Wonde shall:
11.1.1. make available to the School on request all information reasonably necessary to demonstrate Wonde’s compliance with this Agreement; and
11.1.2. allow for and contribute to audits, including inspections, by the School or any auditor nominated by the School in relation to the handling of the School Data by Wonde and its Sub-contractors.
11.2. The information and audit rights of the School under clause 11.1 shall apply only to the extent required by Data Protection Laws.
11.3. The School shall give Wonde reasonable notice of any audit or inspection that it wishes to conduct under clause 11.1 and shall (and shall ensure that any nominated auditor shall) avoid causing (or, if it cannot avoid, minimise) any damage, injury or disruption to Wonde’s or its Sub-contractors’ premises, equipment, personnel and business.
11.4. Without prejudice to clause 11.3, Wonde or its Sub-contractors are not required to give access to their premises for the purposes of an audit or inspection:
11.4.1. to any individual unless he or she produces reasonable evidence of identity and authority; or
11.4.2. outside normal business hours at those premises; or
11.4.3. for the purposes of more than one audit or inspection in any calendar year, unless a Personal Data Breach or material compliance issue has occurred.
12. Liability
12.1. Wonde shall not be liable for:
12.1.1. loss, corruption or compromise of School Data;
12.1.2. loss, interception or corruption of any School Data resulting from any negligence or default by any provider of telecommunications services to Wonde, the School or any School Supplier;
12.1.3. any loss arising from the default or negligence of any School Supplier;
12.1.4. damage to reputation or goodwill, to the extent not arising from Wonde’s breach of confidentiality or Data Protection Laws;
12.1.5. any indirect or consequential loss, excluding losses arising from breach of confidentiality, data protection obligations, or security incidents,
except, in each case, to the extent directly caused by Wonde’s breach of this Agreement, negligence, or failure to comply with Data Protection Laws.
12.2. Subject to clause 12.3, a party’s total aggregate liability to the other party, whether arising in contract, tort (including negligence), breach of statutory duty or otherwise, in connection with the Services or this Agreement shall not exceed the greater of:
12.2.1. the fees paid or payable by the School for the Services in the 12 months preceding the event giving rise to the claim; or
12.2.2. a reasonable amount reflecting the foreseeable loss arising from the relevant breach, provided that this limitation shall not apply to liability arising from breach of confidentiality, data protection obligations, or any security incident.
12.3. Nothing in this clause shall limit the liability of either party for any death or personal injury caused by its negligence, fraud or fraudulent misrepresentation, or any other matter for which liability cannot be limited or excluded as a matter of law.
12.4. Nothing in this Agreement excludes liability for:
12.4.1. breach of confidentiality;
12.4.2. a Personal Data Breach caused by failure to comply with this Agreement; or
12.4.3. liability which cannot be excluded by law.
13. Records
13.1. Wonde agrees that it shall keep detailed, accurate and complete records regarding any data handling activities it carries out pursuant to this Agreement, including but not limited to, the access, control and security of the School Data.
13.2. Wonde will ensure that any such records referred to in clause 13.1 are sufficient to enable the School to verify Wonde’s compliance with its obligations under this Agreement and will respond to any reasonable request by the School for copies.
14. Miscellaneous Provisions
14.1. Save for any statement, licence, representations or assurances as to the method or location of storage this Agreement and the Schedules to it constitutes the entire agreement and understanding between the parties and with respect to all matters which are referred to and shall supersede any previous agreements between the parties in relation to the matters referred to in this Agreement.
14.2. No one other than a party to this Agreement, its successors and permitted assignees shall have any right to enforce any of its terms.
14.3. Wonde may propose variations by notice. Any variation takes effect only with the School’s agreement.
14.4. This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual dispute or claims) shall be governed by and construed in accordance with the laws of New South Wales and subject to the exclusive jurisdiction of the courts exercising jurisdiction in New South Wales.
14.5. Wonde may transfer, assign or novate its rights and obligations under this Agreement to any member of its group companies to whom Wonde transfers all or substantially all of its business, provided that such transfer does not materially adversely affect the School’s rights under this Agreement.
Schedule 1
Subject matter of extraction of School Data
The transfer is necessary to enable the provision of Services by Wonde as set out in clause 2.11 (provision of data integration / data extraction services).
Duration of handling
For as long as it is necessary to provide the Services and until the School removes the Wonde Software from the School’s computer network or SIS/SMS, and then School Data is held and then deleted in accordance with Wonde’s data retention policy.
Nature of handling
The collection, storage, organisation and re-categorisation of the School Data in connection with, and for the purpose of, providing the Services to the School.
Personal Data Categories and Types
The School Data being processed concerns the following categories of: Data Subjects
- Students / Pupils
- Authorised Persons iIncluding but not limited to School employees, state, diocese and association authorities, volunteers, agents, temporary and casual workers
- Relatives, guardians, and associates of the data subject
Data Types
- Sensitive Information as defined by Data Protection Laws
- Identifying information – names and former names, and dates of birth, reference numbers, personal pupil number, etc
- Contact information – postal and email addresses (current and former), telephone number
- Education/training records and examination results
- Employment details for School employees such as name, address, email, WWC information, bank details, previous history
- Usernames, passwords, IP addresses and cookies
- Attendance / Absence information
- Information collected by the school to form a student record
- Characteristic data such as financial information, pupil premium and free school meal eligibility.