1. Roles of the Parties

For personal data uploaded by the school, the school acts as the data controller and Juno acts as the data processor.

2. Subject Matter and Duration

The subject matter of this agreement is the processing of personal data in connection with provision of the Juno platform.

Processing will continue for the duration of the service agreement between Juno and the school.

3. Nature and Purpose of Processing

Processing includes storing, organising, displaying, and retrieving personal data so that the school can manage operational information and communications with parents and students.

4. Processor Obligations

Juno processes personal data only on documented instructions from the school unless required to do otherwise by law.

5. Confidentiality

Juno ensures that personnel authorised to process personal data are subject to confidentiality obligations.

6. Security

Juno implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, or destruction.

7. Sub‑processors

Juno may engage third‑party service providers to support the operation of the platform. Juno remains responsible for ensuring that such providers comply with applicable data protection obligations.

8. Assistance to the Controller

Juno will assist the school, taking into account the nature of the processing, in responding to requests from individuals exercising their data protection rights.

9. Personal Data Breaches

In the event of a personal data breach affecting school‑controlled data, Juno will notify the school without undue delay.

10. End of Processing

Upon termination of the service, Juno will delete or return personal data as instructed by the school, subject to applicable legal requirements.

Schedule 1 – Categories of Data

Data subjects may include school administrators, parents or guardians, students, and teachers.

Personal data may include names, contact details, optional date of birth, optional gender, class participation information, and communication preferences.

Schedule 2 – Sub‑processors

Supabase – database, authentication, and storage infrastructure

Vercel – application hosting infrastructure

Stripe – payment processing

Plausible – privacy‑focused analytics