Data processing agreement

Version 2026-09-20. This forms part of the terms, and the version recorded against your account is the version of both.

Between you — the instructor, and the controller of your pupils’ details — and Kerby LTD, a company registered in Scotland with company number SC895039, registered office 4 Coronation Gardens, Montrose, DD10 9GH, which is your processor for that data. Questions to hello@gokerby.co.uk.

This has not been reviewed by a solicitor. It is written from what Kerby does, against Article 28 of the UK GDPR. If you want your own adviser to look at it before you rely on it, that is a reasonable thing to do and we will answer their questions.

Why you need this

Your pupils’ names, numbers, addresses, lessons and progress are yours. You decide what is held and why, so the law calls you the controller of them. Kerby holds and moves that data for you and for no purpose of our own, which makes us your processor.

Article 28 of the UK GDPR says a controller may only use a processor under a written contract, and it lists what that contract has to cover. This is that contract. It matters to you as much as to us: engaging a processor without one is your breach as well as ours, and it is the first thing an insurer or a training school will ask you for.

Your own account details — your name, email, phone, postcode, what you pay us — are a different matter. There Kerby is the controller and the privacy policy is the document that applies. This agreement is only about the people you teach.

What is being processed

We act on your instructions

Kerby processes pupil data only on your documented instructions. Your instructions are: this agreement, the terms, and what you do in the product. Adding a pupil, booking a lesson, switching on a reminder, exporting your records and closing your account are all instructions, and they are the normal way you give them. Anything outside that you can send to hello@gokerby.co.uk.

We do not use your pupils’ data for any purpose of our own. We do not sell it, do not advertise against it, do not use it to build anything else, and do not use it to train machine-learning models.

If we ever have to process it because the law requires us to rather than because you asked, we will tell you before we do — unless the law that requires it also forbids us from telling you.

If we think an instruction of yours would break data-protection law, we will say so rather than quietly carry it out.

Who can see it

Access is limited to the people who need it to run the service. At Kerby’s size that is a very short list, and everybody on it is under a duty of confidentiality that continues after they stop working with us.

Nobody at Kerby browses instructor records for interest. Administrative access to the database exists, is granted deliberately rather than claimed, and requires two-factor authentication.

Other instructors cannot see your pupils. That is enforced by the database itself — every table carries row-level security keyed to the signed-in instructor — rather than by the screens being careful.

Security

We take the measures Article 32 requires, appropriate to a service of this kind holding this data. In concrete terms:

• Data in transit is encrypted with TLS, with HSTS set so a browser will not fall back to an unencrypted connection.
• Data at rest is encrypted by the database host, and file uploads such as receipt photographs sit in private storage reachable only through short-lived signed links.
• Access control is enforced in the database with row-level security on every table, so a fault in the website or the app cannot show one instructor another’s records.
• Passwords are stored hashed, never in a readable form, and are never visible to us.
• The website sets a strict content-security policy, which is what stops an injected script from reading a session.
• Backups are taken by the database host and are held in the United Kingdom under the same protection as the live database.
• Changes to the product are reviewed and tested before release, including automated tests over the access-control rules themselves.

Security is not a finished job, and we may change a measure for one that is at least as good. We will not reduce the overall level of protection during your subscription.

Sub-processors

You give Kerby general authorisation to engage the services listed in the privacy policy under “Who else sees it”. Today that is Supabase, Vercel, Brevo, The SMS Works, Stripe, Apple and Cloudflare. Each one gets the minimum it needs, each is under written data-protection terms no weaker than this agreement, and Kerby stays responsible to you for what they do as if we had done it ourselves.

If we add or replace one, we will tell you by email at least 30 days beforehand. If you object on reasonable data-protection grounds within those 30 days, tell us and we will either find another way or, if we cannot, you may cancel without penalty and take your records with you.

HMRC is not on that list and is not a sub-processor. If you file your tax return through Kerby, HMRC receives your figures as a separate controller in its own right, under an obligation the law puts on you.

Where it is processed

Your pupils’ records are held in the United Kingdom: the database is in London and the website runs in London. Text reminders go through The SMS Works, also in the United Kingdom.

Two things leave the UK. Email is sent by Brevo in France, which is covered by the UK’s adequacy decision for the EU. Payment processing, push notifications and the bot check on public forms involve companies that operate globally; those transfers are made under the International Data Transfer Addendum or equivalent safeguards in the providers’ standard terms, which Kerby has accepted.

We will not move your pupils’ records to a country outside the UK without a lawful transfer mechanism in place, and we will not do it because it is cheaper.

When a pupil asks something

A pupil’s request goes to you, because you are their controller and you can answer most of it yourself: their record is in front of you in the product, editable, exportable and deletable.

If a pupil comes to us instead, we will not answer for you. We will pass the request on to you promptly and tell the pupil we have done so.

Where you need help we will give it — taking into account what we know and what you cannot see from inside the product — and at no charge for anything a reasonable number of requests involves.

If there is a breach

If personal data we hold for you is lost, exposed or altered without authorisation, we will tell you without undue delay, and in any case within 48 hours of becoming aware of it. Your own 72-hour clock for telling the ICO starts when we tell you, which is why ours is shorter.

We will tell you what happened, which of your pupils are affected and what data was involved, what we have done about it, and what we recommend you do. If we do not have all of that at the start we will send what we have rather than wait, and follow it up.

We will also help you with the things Articles 32 to 36 put on you: a data protection impact assessment if you need one, and a consultation with the ICO if it comes to that.

Ending it

You can take a full copy of everything Kerby holds for you, as a file, at any time and without asking us. That is in the product, and it is how you leave.

When you close your account we delete your pupils’ details, the lessons, the notes and any receipt photographs. Deletion completes within 30 days, including from backups as they age out on their normal cycle.

Two exceptions, both narrow. We keep a record of what was charged and when, with names removed, because HMRC requires six years of accounting records. And a pupil taught by more than one instructor is not deleted when one of you leaves, because the other instructor’s records are not yours to remove.

Checking that we do this

Ask, and we will give you the information you need to show that Kerby meets its obligations under this agreement — what we hold for you, which sub-processors touched it, and how the security measures above are implemented.

You may also audit, or have an independent auditor audit, on 30 days’ notice, no more than once a year unless a breach or a regulator gives you reason, during business hours and without disturbing other instructors’ data. In practice the documents above and our answers to your questions will settle it, and we would rather answer a hard question than host a visit.

How this fits with the rest

This agreement is part of the terms. Where it and the terms disagree about pupil data, this agreement wins. The limits on liability in the terms apply to this agreement too, as one overall limit rather than a fresh one for each document — except where the law does not allow a liability to be limited.

Nothing here changes who each of us answers to. You remain responsible for having a lawful basis to hold your pupils’ details, for telling them what you do with them, and for what you write in a lesson note.

Changes

If we change this agreement in a way that affects what you are agreeing to, we will email you at least 30 days beforehand and say why, exactly as the terms provide. The version number at the top moves with the terms.

Law

Governed by the law of England and Wales, the same as the terms, and the courts of England and Wales have exclusive jurisdiction.