School Data Processing Agreement (DPA)

Standard contractual clauses governing the submission and processing of candidate records between participating schools (Data Controllers) and Matigo Examinations Board (Data Processor).

Automated Electronic IncorporationThis DPA is automatically incorporated into the contractual relationship between Matigo Examinations Board and any school upon account registration or when candidate records are submitted via Excel/PDF upload.

1. Scope & Parties

This Data Processing Agreement ("DPA") supplements the Terms of Service between:

The School ("Data Controller"): The educational institution submitting candidate student records.
Matigo Examinations Board ("Data Processor"): Providing cloud-based mock examination management, paper grading, score aggregation, and digital result slip generation.

2. Warranties of the School (Data Controller)

The School warrants, represents, and agrees that:

Parental/Guardian Consent: The School possesses valid legal authorization, statutory educational mandate, or parental/guardian consent to submit minors' candidate records in compliance with the Uganda Data Protection and Privacy Act, 2019.
Data Integrity: All candidate names, index numbers, and subject assignments submitted via the portal are accurate and legitimate.
Lawful Instructions: The School's configuration of assessments and enrollment of students constitutes lawful, documented processing instructions.

3. Obligations of Matigo Exams (Data Processor)

Matigo Examinations Board covenants and agrees to:

Process Solely on Instructions: Process candidate personal data strictly to administer mock exams, compute standard UNEB-aligned grades, and generate school result slips.
Personnel Confidentiality: Ensure all staff, examiners, and technicians are bound by strict contractual non-disclosure agreements (Examiner Confidentiality Terms).
Technical Safeguards: Maintain encryption in transit (TLS 1.3), encryption at rest (AES-256), and multi-tenant database isolation.
Incident Notification: Notify the School without undue delay (and in any event within forty-eight (48) hours) of any confirmed personal data breach impacting candidate data.
Data Deletion & Return: Securely delete or return candidate records upon contract termination or written request by the School Controller.

4. Subprocessors

The School authorizes the use of enterprise infrastructure subprocessors:

Google Cloud Platform / Firebase: Secure database storage, authentication, and hosting (SOC 1/2/3, ISO 27001, GDPR compliant).
Transactional Email Services: Account approval and password reset delivery.

5. Governing Law

This DPA is governed by the laws of the Republic of Uganda.

Institutional Governance Desk