Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") supplements the Terms of Service entered into between the registered educational institution ("School" or "Data Controller") and the Matigo Examinations Board ("Matigo Exams", "Platform", or "Data Processor").

This DPA governs the processing of personal data relating to candidates, students, and school staff submitted by or on behalf of the School to Matigo Exams for the purpose of mock examination management, paper coordination, score processing, grading calculation, result slip generation, and performance analytics.

• Subject Matter: Processing of candidate registration and examination performance data for Ugandan primary and secondary mock examinations (PLE, UCE, UACE).
• Duration of Processing: For the duration of the School's active registration with Matigo Exams, plus any subsequent retention period required for academic record-keeping or statutory compliance.
• Nature and Purpose: Ingesting student candidate information, allocating subjects, recording examiner marks, computing standard national grading formulas, producing institutional analytics, and rendering digital result slips.
• Categories of Data Subjects: Enrolled student candidates (primarily minors), school administrators, and subject teachers.
• Types of Personal Data: Candidate legal names, UNEB index numbers/student IDs, gender/sex, age, class stream, enrolled subjects, examination marks, aggregate scores, and final grades.

The School explicitly warrants, covenants, and represents that:

1. Lawful Authority & Consent: The School possesses valid legal authority, statutory educational mandate, or verifiable parental/guardian consent to collect and transfer student personal data to Matigo Exams for examination processing in full compliance with the Uganda Data Protection and Privacy Act, 2019.
2. Data Accuracy: All student lists, Excel spreadsheets, and UNEB draft register PDFs uploaded by the School are authentic, accurate, and up to date.
3. Authorized Instructions: The School's configuration of subjects, student enrollments, and examination requests constitutes lawful and documented instructions to Matigo Exams.

Matigo Exams undertakes and agrees to:

1. Process Strictly on Documented Instructions: Process student personal data solely in accordance with the documented instructions of the School and for the purposes defined in this DPA and the Terms of Service.
2. Personnel Confidentiality: Ensure that all staff, technicians, and contracted examiners who have access to candidate data are bound by strict contractual confidentiality agreements (such as the Examiner Confidentiality Agreement).
3. Security Safeguards: Implement and maintain robust technical and organizational security measures, including database-level tenant isolation, access logging, encrypted transmissions (TLS 1.3), and encrypted cloud storage at rest (AES-256).
4. Subprocessor Management: Engage only reputable cloud service providers (e.g., Google Cloud Platform / Firebase) under contracts imposing data protection obligations no less stringent than those set out in this DPA.
5. Assistance with Data Subject Rights: Reasonably assist the School in fulfilling its obligations to respond to requests from candidates or parents/guardians exercising their data rights (e.g., access, rectification, or deletion).
6. Breach Notification: Notify the School without undue delay (and in any event within forty-eight (48) hours) upon becoming aware of a confirmed personal data breach affecting the School's candidate records.
7. Deletion or Return of Data: Upon termination of services or upon formal written request by the School, securely delete or return all candidate personal data, unless applicable law requires retention of specific audit or tax records.

1. The School grants general authorization to Matigo Exams to utilize the following infrastructure subprocessors:

• Google Cloud Platform / Firebase: Cloud hosting, database management, and authentication services.
• Transactional Email Service: Notification and account verification delivery.

1. Matigo Exams remains fully liable to the School for the performance of its subprocessors' data protection obligations.

1. In the event of a confirmed security incident or unauthorized access to candidate records, Matigo Exams will:

• Immediately initiate containment and remediation protocols.
• Provide the School with details regarding the nature of the breach, affected records, and remediation steps taken.
• Assist the School in notifying regulatory authorities (such as NITA-U) or affected individuals if required by applicable law.

Upon reasonable advance written notice and no more than once per academic year, Matigo Exams will make available to the School documentation demonstrating compliance with its obligations under this DPA, provided that such review does not compromise the security, confidentiality, or proprietary systems of other schools or examiners.

This DPA shall be governed by and construed in accordance with the laws of the Republic of Uganda. Any dispute arising under this agreement shall be resolved in accordance with the dispute resolution provisions set out in the Terms of Service.

By completing account registration as a School, uploading student records via spreadsheet/PDF registers, or checking the mandatory consent checkbox within the portal, the School Administrator electronically executes and formally accepts this Data Processing Agreement on behalf of the educational institution.

Matigo Examinations Board - Compliance Office

• Email: compliance@matigoexams.org
• Website: https://matigoexams.org