How PE Pathway processes pupil and staff data on behalf of schools.
Download PDF (with signature page)It is accepted online by an authorised representative of the School when they accept the Terms of Service in PE Pathway, or by signing the acceptance page in the PDF version.
School: the school, academy trust, governing body or other organisation that subscribes to PE Pathway, as identified in the online acceptance record or on the acceptance page (the School, also called the Customer).
Provider: Fit4Fun Sports Dance & Fitness Limited, company number 08337190, of 2 Waller Grove, Swanland, East Riding of Yorkshire, HU14 3FF, trading as PE Pathway (PE Pathway, also called the Provider). PE Pathway is a trading name, not a separate legal entity.
Background: PE Pathway is a web-based platform that helps primary school teachers plan, deliver and assess PE, and produces assessment records and report comments for each pupil. Providing it involves processing personal data on the School’s behalf. This agreement contains the terms required by Article 28(3) of the UK GDPR for that processing.
1.1Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and other applicable UK privacy and data protection legislation, as amended, together with applicable guidance and codes of practice issued by the Information Commissioner. Controller, processor, personal data, processing, data subject and personal data breach have the meanings given in that law. The Commissioner means the UK Information Commissioner or its successor.
1.2Services means the platform at app.pepathway.co.uk and related support. School Personal Data means personal data processed on the School’s behalf as described in Schedule 1. Sub-processor means a provider processing that data on PE Pathway’s behalf.
1.3The schedules form part of this agreement. If the body of this agreement and a schedule conflict, the body prevails. This agreement takes priority over the Main Agreement for the processing of School Personal Data. Commercial matters remain governed by the Main Agreement, subject to clause 13.
1.4Writing and written include email and records made in PE Pathway, such as the online acceptance record.
2.1The School is the controller and PE Pathway is the processor of School Personal Data. Each party will comply with its own obligations under Data Protection Law.
2.2The School keeps control of School Personal Data. It determines and documents its lawful basis, provides appropriate privacy information and obtains any consents it needs, controls staff permissions, and is responsible for the accuracy and lawfulness of the information it supplies and the instructions it gives. PE Pathway will provide the information and assistance needed for those purposes.
2.3Where PE Pathway determines the purposes of processing business contact, billing or legal records for its own administration, it acts as a separate controller for that processing, as explained in its Privacy Policy. This does not authorise any independent use of pupil records.
3.1PE Pathway will process School Personal Data only to the extent necessary to provide the Services and only on documented instructions, including this agreement, the School’s authorised use of the agreed features and any later written instructions from the School’s authorised staff. This includes instructions about international transfers. PE Pathway will not process School Personal Data for any other purpose. If UK law requires other processing, PE Pathway will tell the School beforehand unless that law prohibits it on important grounds of public interest.
3.2PE Pathway will promptly tell the School if, in its opinion, an instruction infringes Data Protection Law, and will not carry out the affected instruction while the parties resolve it.
3.3PE Pathway will not sell School Personal Data, use it for advertising or allow it to be used to train general-purpose AI models. The authorised AI report-writing activity is described in Schedule 4.
3.4PE Pathway will comply promptly with the School’s written instructions to correct, transfer, delete or otherwise deal with School Personal Data, or to stop, mitigate or remedy any unauthorised processing.
3.5PE Pathway will not disclose School Personal Data to any third party except as this agreement or the School authorises, or as required by UK law, a court or a regulator (including the Commissioner). Where disclosure is legally required, PE Pathway will first tell the School and give it the opportunity to object or challenge the requirement, unless the law prohibits this.
3.6PE Pathway will tell the School promptly if it becomes aware of a change in Data Protection Law that is likely to affect its ability to perform this agreement.
4.1PE Pathway will ensure that everyone who can access School Personal Data on its behalf is bound by written or statutory confidentiality obligations, accesses that data only as necessary for their role, and has received appropriate data protection training, including how to recognise and promptly report a personal data breach or an individual’s rights request.
4.2PE Pathway will take reasonable steps to ensure the reliability of those people, including appropriate background checks such as DBS checks where relevant.
5.1PE Pathway will implement and maintain appropriate technical and organisational measures, as required by Article 32 of the UK GDPR, to protect School Personal Data against accidental, unauthorised or unlawful processing, access, loss, destruction, damage, alteration or disclosure. The measures will take account of the processing, available technology, the costs and the risks, including that most pupil data subjects are children. Schedule 3 sets out the measures.
5.2These measures include, as appropriate: encryption and pseudonymisation of personal data; the ongoing confidentiality, integrity, availability and resilience of systems and services; the ability to restore availability of and access to personal data promptly after a physical or technical incident; and a process for regularly testing, assessing and evaluating their effectiveness.
5.3PE Pathway will review those measures at least once a year and will not materially reduce the agreed level of protection. Access through support, development tools or logs remains subject to this agreement, and production data is not used for unrelated development or testing.
6.1The School gives general written authorisation for the sub-processors listed in Schedule 2 and their documented onward providers, subject to this clause. PE Pathway will not engage any other sub-processor except under this clause. PE Pathway will keep the list up to date and make it available to the School.
6.2PE Pathway will give at least 30 calendar days’ prior email notice of a proposed new or replacement sub-processor. The School may object on reasonable data protection grounds during that period. The parties will seek a solution, and the proposed provider will not process the School’s data while the objection remains unresolved. If no solution is agreed, the School may end the affected Services and receive a proportionate refund of prepaid fees for the unused period.
6.3Before processing starts, and after reasonable due diligence on its data protection and security arrangements, PE Pathway will bind each sub-processor to equivalent data protection obligations for the activities it performs, including sufficient security guarantees. PE Pathway remains fully liable to the School for those obligations.
7.1PE Pathway will make or permit transfers outside the UK, including relevant remote access, only on the School’s documented instructions and in accordance with the UK GDPR. By accepting this agreement, the School authorises the transfers described in Schedule 2, which identifies the relevant locations and the adequacy regulations or Article 46 safeguards relied on. Any other transfer needs the School’s prior written authorisation, given through the process in clause 6.2 where it involves a new sub-processor.
7.2A primary database location does not establish every processing or access location. PE Pathway will provide information reasonably needed to understand the transfer arrangements. The School’s acceptance does not replace a required lawful transfer mechanism.
8.1Taking account of the nature of the processing, PE Pathway will assist the School through appropriate technical and organisational measures, so far as possible, with individuals’ rights requests, including access, correction, erasure, restriction, portability, objection and complaints. Where the School corrects, restricts or deletes School Personal Data, PE Pathway will apply that change without undue delay to the copies held by PE Pathway and its sub-processors, so far as technically possible and subject to clause 10.4 for backups.
8.2PE Pathway will tell the School within 5 working days if it receives a request from an individual to exercise their rights over School Personal Data, and promptly if it receives any complaint, notice or other communication about the processing of School Personal Data or either party’s compliance with Data Protection Law. It will respond to the individual or disclose School Personal Data to them only on the School’s written instructions or where legally required.
8.3Taking account of the processing and the information available, PE Pathway will assist with the School’s obligations under Articles 32 to 36 of the UK GDPR, including security, notifications to the Commissioner and affected people, impact assessments and prior consultation, and with any information or assessment notice served on the School by the Commissioner. It will provide timely assistance so the School can meet applicable deadlines. PE Pathway will not charge for reasonable assistance under this clause.
9.1PE Pathway will notify the School in writing without undue delay, and in any event within 48 hours, after becoming aware of: a personal data breach affecting School Personal Data; any accidental, unauthorised or unlawful processing of School Personal Data; or the loss, corruption or unusability of all or part of School Personal Data. This outside limit does not permit avoidable delay. Where School Personal Data is lost or corrupted, PE Pathway will restore it from its backups as soon as reasonably possible.
9.2The notice will give available details of the incident, the categories and approximate numbers of people and records affected, likely consequences, action taken or proposed (including to reduce possible harm), and a contact. Missing details will follow without undue further delay. PE Pathway will keep a record of incidents affecting School Personal Data, including the facts, effects and action taken, and will make the relevant entries available to the School on request.
9.3PE Pathway will investigate the incident with the School and reasonably cooperate in the School’s handling of it, including by assisting with the investigation, making relevant records, logs and other information available, making relevant personnel available to answer questions, and taking reasonable and prompt steps to mitigate the effects and minimise any harm.
9.4The School decides whether to notify the Commissioner, affected individuals or anyone else, the content of any notice, and whether to offer any remedy. PE Pathway will not inform any third party of an incident affecting School Personal Data without the School’s written consent, except where legally required. Each party’s independent legal duties remain unaffected.
9.5PE Pathway will bear its own costs of meeting its obligations under this clause, unless the incident arose from the School’s instructions, negligence or breach of this agreement. Where an incident is caused by PE Pathway’s breach of this agreement or Data Protection Law, PE Pathway will also reimburse the School’s reasonable costs of responding to it, including notifying affected individuals, subject to clause 13.
10.1The School may choose secure return or deletion when the Services end and may give lawful erasure instructions at any time. Cancelling a future renewal is not itself the end of the Services while paid access continues. The periods below run from the actual end or expiry of the Services.
10.2The School has 30 calendar days after the Services end to request a copy of its data, which may be provided to the School or to a third party it nominates in writing. PE Pathway will provide a secure copy in a commonly usable electronic format (such as CSV), including pupil records and report comments, and will delete remaining active copies by the end of that period. Return will come before deletion. An earlier deletion instruction will be followed without undue delay. If a timely request cannot be completed within that period, the parties will promptly agree a short timetable in writing, and data needed for the return will not be deleted before it is delivered.
10.3If no copy is requested, the School instructs deletion at the end of the 30-day period. Deletion covers linked records, relevant files, operational copies and sub-processor copies, not just removal from a class list. Archiving a pupil or an academic year is not deletion.
10.4Backup copies that cannot be selectively deleted will be put beyond ordinary use and will expire within a further 90 calendar days after the 30-day period (120 days in total). If a backup is restored for recovery, relevant deletions will be reapplied before ordinary use resumes.
10.5Where UK law requires PE Pathway to retain School Personal Data, it will tell the School in writing which data is affected, the legal basis and the period, unless prohibited, and will delete the data when the requirement ends. Retained data remains protected and is used only for that purpose.
10.6PE Pathway will confirm deletion to the School in writing within 30 calendar days of completing it, identifying any outstanding backup copies and their final expiry dates.
11.1PE Pathway will provide all information necessary to demonstrate compliance with Article 28 of the UK GDPR and will allow for and contribute to audits and inspections by the School or an auditor it appoints.
11.2Routine audits may be arranged on reasonable notice, normally once a year, with proportionate confidentiality and security arrangements. This does not restrict checks justified by a breach, reasonable evidence of non-compliance, a material processing change or a legal or regulatory requirement. PE Pathway will promptly address any issues an audit identifies, with a written plan of corrective action where needed.
11.3PE Pathway will keep accurate, up-to-date written records of its processing of School Personal Data, including the record required by Article 30(2) of the UK GDPR, the sub-processors used, the categories of processing and a general description of its security measures. The records will be sufficient to show its compliance with this agreement, and PE Pathway will provide relevant copies to the School on request.
11.4PE Pathway will review the schedules at least once a year and update them when needed to reflect current practice, telling the School about material changes under clause 14.4.
12.1PE Pathway warrants that it will process School Personal Data in accordance with this agreement and Data Protection Law, that the people processing it on its behalf meet clause 4, and that it has no reason to believe Data Protection Law prevents it from providing the Services.
12.2The School warrants that PE Pathway’s processing of School Personal Data to provide the Services, and in line with the School’s instructions, will comply with Data Protection Law.
13.1Each party is responsible for losses the other suffers as a result of its breach of this agreement or Data Protection Law. The limits of liability in the Main Agreement apply to all liability under this agreement, including costs reimbursed under clause 9.5, to the extent permitted by law.
13.2Nothing in this agreement excludes or limits liability that cannot lawfully be excluded or limited, restricts data subjects’ statutory rights or relieves either party of its own statutory obligations.
14.1This agreement applies to free trials and paid Services from acceptance of the Main Agreement incorporating it, or from signature by both parties if signed separately. It must be in place before School Personal Data is processed, and remains in effect for as long as PE Pathway or its sub-processors hold that data. Provisions needed to protect School Personal Data continue after the Main Agreement ends.
14.2Online acceptance by an authorised representative of the School binds the School and has the same effect as a handwritten signature. PE Pathway will keep a record of the accepted version, the organisation, the person accepting and the date, and will provide a copy on request. A signature page is an alternative, not an additional requirement.
14.3If PE Pathway materially breaches this agreement and does not remedy the breach within 30 calendar days of written notice (or immediately, if it cannot be remedied), the School may end the Services on written notice and receive a proportionate refund of prepaid fees for the unused period. If a change in Data Protection Law prevents either party from performing this agreement, the parties may agree to suspend the affected processing until it complies; if it cannot be brought into compliance within 30 calendar days, either party may end the affected Services on written notice.
14.4PE Pathway may update this agreement, for example to reflect a sub-processor change under clause 6.2 or a change in law. It will tell schools about material changes and ask an authorised representative to accept the new version in PE Pathway.
15.1Notices under this agreement must be in writing and sent by email: to PE Pathway at hello@pepathway.co.uk, and to the School at the data protection contact it gives PE Pathway or, if none is given, the PE lead’s email address. Either party may also deliver a notice by hand or by first-class post to the other’s registered office or main address.
15.2An email notice is received when sent, or when business hours next resume if sent outside them. A notice delivered by hand is received when left at the address, and a posted notice at 9am on the second working day after posting. This clause does not apply to the service of legal proceedings.
16.1This agreement is governed by the law of England and Wales, and its courts have exclusive jurisdiction, without restricting rights or regulatory powers that cannot lawfully be restricted.
| Item | Details |
|---|---|
| Subject matter | Delivery, assessment and reporting of primary school PE using PE Pathway. |
| Purpose | Provide lesson content, session assessments, end-of-block and annual report drafts, certificates and badges, whole-school progress information, staff access and service support. |
| Nature and frequency | Receive, record, organise, store, retrieve, display, amend and analyse data; generate AI report text; send necessary service emails; provide copies and delete. Processing happens as features are used, with continuous hosting. |
| Duration | The term of the Main Agreement, including any trial, followed only by the return, deletion and retention periods in clause 10. |
| People concerned | Pupils added by the School, usually Reception to Year 6; teachers, PE leads and other authorised staff. Support messages may incidentally identify other people and should be kept to a minimum. |
| Pupil information | Name (held as a single full-name field); year group and class; school and pupil identifiers; current or left status; session assessments and dates; attainment levels and not-completed or not-assessed status; end-of-block and annual report comments; certificates and badges. There is no separate attendance register. |
| Staff information | Name and certificate title, school work email, role, class or year group, account status (active, on leave or deactivated), account identifiers and login records, terms acceptance records; end-of-block ratings, badges and feedback sent through the platform; necessary support messages. |
| Operational information | Login and activity records, request details such as IP addresses, diagnostic information and identifiers. Pupil names and report text are not written to application logs. |
| Excluded information | Pupil health, SEND, safeguarding, ethnicity, religion and other special category or criminal offence data are outside the agreed scope. Staff must not enter these, including in free text. If received accidentally, PE Pathway will tell the School and help remove it on instructions. |
| School and commercial details | School details linked to identifiable staff may be personal data. PE Pathway’s own subscription, invoice and legal records are covered by its Privacy Policy as a separate controller. |
| Retention and location | Archived records are kept while the School keeps its account. Clause 10 governs exit. Primary database: Supabase, AWS eu-west-1 (Ireland). Other providers and locations are listed in Schedule 2. |
The School may require correction, return or deletion on its lawful instructions. A new category of data or a materially different purpose requires a documented change to this schedule.
These providers process School Personal Data on PE Pathway’s behalf. Each is bound by its own data processing terms, which include UK transfer safeguards where data is processed or accessed outside the UK and EU.
| Provider | Purpose and data | Location and safeguards |
|---|---|---|
| Supabase | Database and login. Pupil, assessment and report records; staff accounts and login records. | Ireland (EU, AWS eu-west-1). The UK recognises the EU as adequate. Supabase’s DPA covers any access from outside the UK and EU. |
| Replit | Application hosting. Servers that process pupil and staff data; technical logs (no pupil names or report text). | Deployment region: Europe (EU). Replit, Inc. is US-based; its DPA and UK transfer terms cover any access from the USA. |
| Anthropic | AI report drafting. Pupil first names only, assessments, sport, skill topics, year group and earlier report comments (see Schedule 4). | USA. Anthropic’s DPA incorporates the UK Addendum to the EU Standard Contractual Clauses. Inputs and outputs are not used for model training. |
| Resend | Service emails. Staff names, email addresses, school name and invitation or password emails containing single-use links (not passwords). | EU sending region. Resend is US-based; its DPA and UK transfer terms apply. |
| Microsoft 365 | PE Pathway’s support mailbox (hello@pepathway.co.uk). Staff contact details and support messages. Schools should not send pupil data by email. | Exchange Online data location Europe, with the UK as the committed location. Microsoft Products and Services DPA. |
The AI features draft end-of-block and annual PE report comments from the School’s recorded assessments and, for annual reports, earlier comments. The School instructs this processing when authorised staff use the features. Comments are only generated when a teacher chooses to generate them. They are shown to staff inside PE Pathway and are never sent to parents or anyone outside the School by PE Pathway.
Staff must read and, where needed, correct each comment before using it. The feature supports professional judgement: the School must not use generated text as the only basis for any decision with legal or similarly significant effects.
Only the pupil’s first name is sent; any further names are removed before sending. End-of-block requests contain the pupil’s first name, a temporary reference (such as P1), attainment level, total and per-session scores (as descriptions), session topics, sport and academic year, and use Claude Sonnet 4.5. Annual requests contain the pupil’s first name, year group, the sports covered and their topics, planned curriculum coverage and the pupil’s earlier report comments, with the pupil’s surname removed from that earlier text, and use Claude Haiku 4.5.
School names, staff names and database identifiers are not sent. Sending first names only is data minimisation, not anonymisation: the information is still personal data.
Generated comments are stored with the pupil’s record and may contain inaccurate statements or assumptions. The AI may infer pronouns from a pupil’s first name, so teachers must check names, pronouns and wording against their own assessment before use.
PE Pathway uses Anthropic’s commercial API. Under Anthropic’s commercial terms, inputs and outputs are not used to train its models. Anthropic’s standard API policy deletes inputs and outputs within 30 days, subject to limited exceptions such as policy enforcement or legal requirements. Deleting a comment in PE Pathway does not instantly delete any copy Anthropic holds within that period.
PE Pathway will provide this description, relevant provider terms and available technical information to support the School’s privacy notice and any impact assessment. The School decides its lawful basis and whether an impact assessment is needed. The School’s agreement to this processing is not consent on behalf of pupils or parents.
Most schools accept this agreement online, when a PE lead accepts the Terms of Service in PE Pathway. The online record identifies the School, the person accepting, the date and time and the version accepted. If your school or trust prefers to sign on paper, download the PDF above, which includes a signature page.
| Role | Contact |
|---|---|
| Data protection and incident lead | Tom Farrow, Director · hello@pepathway.co.uk |
| Backup incident contact | Danny Furlong · danny@fit4fun.co |