# Information Sharing Agreement

**Between:** [SCHOOL NAME], DfE URN [URN], hereafter "the School"
**And:** Linked2Link Ltd, hereafter "the Provider"

**Effective from:** 11 July 2026
**Review:** Annual

## 1. Purpose

Sharing of pupil data to enable the use of NeuroKids for SEN/SEND
communication, learning, and reporting.

## 2. Data shared

- Pupil first name & age (mandatory)
- SEN/SEND focus area (optional, parent-chosen)
- Learning progress logs (generated in-app)
- AAC communication entries (generated in-app)

NOT shared: surname, address, contact details, biometric data, photos,
medical records, attendance records.

## 3. Roles under UK GDPR

The **School** is Data Controller. The **Provider** is Data Processor
(Art. 28). A Data Processing Agreement (DPA) accompanying this ISA sets
out the processor's obligations.

## 4. Sub-processors

The Provider engages the sub-processors listed at
https://neuro-kids-space.co.uk/api/schools/processors and provides 30
days' notice of any change.

## 5. Pupil rights

Subject Access, rectification, erasure, restriction, portability, and
objection rights can be fulfilled by the parent directly through the
in-app "Export Data" and "Delete Account" features, or by emailing
**dpo@neuro-kids-space.co.uk** (target: 30 days).

## 6. Breach notification

The Provider notifies the School DPO within **24 hours** of becoming
aware of any breach affecting School pupil data (UK GDPR Art. 33 target
is 72h to ICO; we tighten our internal SLA).

## 7. Termination

On contract end or School request:
- Pupil records returned (JSON export) within 14 days, then
- Permanently deleted within a further 30 days, including backups.
- Anonymised, aggregate analytics may be retained for service
  improvement (Recital 26).

## 8. Signatures

| Role | Name | Date | Signature |
|---|---|---|---|
| School Headteacher | | | |
| School DPO | | | |
| Linked2Link DPO | | | |