1. Parties

This Data Processing Agreement ("DPA") is entered into between:

Data Controller: The school or academy trust that has registered for Mustard Investments ("the School").
Data Processor: Mustard Investments Ltd, registered in England and Wales ("Mustard").

2. Purpose of processing

Mustard processes personal data solely to provide the financial education platform to the School's students and staff, including:

Account creation and authentication
Delivering age-appropriate educational content
Tracking learning progress and awarding achievements
Generating class and cohort analytics for educators
Providing safeguarding and safety controls

3. Categories of data subjects

Students aged 11–18 enrolled in the School's Mustard cohorts
Teaching staff and administrators with educator accounts

4. Types of personal data

Students: Display name, date of birth, age band, school email (if provided), learning progress, quiz scores, XP, streak data, paper-trading portfolio data.
Educators: Full name, school email address, school name, classes managed.

No special category data (Article 9 UK GDPR) is processed. No biometric, health, or political data is collected.

5. Sub-processors

The current list of sub-processors is published at /subprocessors. Mustard will notify the School at least 30 days before adding a new sub-processor. The School may object within that period.

6. Data retention

Student data is retained for the duration of the School's active subscription or agreement.
Upon termination, all student data is deleted within 90 days.
The School may request immediate deletion at any time.
Anonymised, aggregated analytics may be retained indefinitely.

7. Security measures

Data encrypted in transit (TLS 1.3) and at rest (AES-256).
Firebase Authentication with secure session management.
Role-based access control — educators see only their own classes.
Firestore security rules enforce data isolation between schools.
No student data is stored on client devices beyond session tokens.
Regular security reviews and dependency audits.

8. Data subject rights

Mustard will assist the School in fulfilling data subject access requests (DSARs), rectification, erasure, and portability requests within the timescales required by UK GDPR (one calendar month). Requests should be directed to dpo@mustardinvestments.com.

9. International transfers

Primary data processing occurs within the UK and EEA (Google Cloud europe-west2, London). Where data is processed outside the UK, it is covered by Standard Contractual Clauses or an adequacy decision. See the sub-processor list for details.

10. Breach notification

Mustard will notify the School without undue delay (and in any event within 72 hours) upon becoming aware of a personal data breach affecting School data. Notification will include the nature of the breach, categories of data affected, approximate number of data subjects, and measures taken or proposed.

11. Audit rights

The School may audit Mustard's compliance with this DPA once per calendar year, with 30 days' written notice. Mustard will provide reasonable access to relevant documentation, systems, and personnel.

12. Termination

This DPA terminates automatically when the School's use of Mustard ceases. Upon termination, Mustard will delete or return all personal data as directed by the School, and certify deletion in writing.

Contact

Data Protection Officer: dpo@mustardinvestments.com
Schools team: schools@mustardinvestments.com