Rafyorafyo.

Data Processing Agreement

Last updated: 9 July 2026

This Data Processing Agreement ("DPA") forms part of the agreement between JKRSP LTD, trading as Rafyo ("Processor", "Rafyo"), and the school or educational institution ("Controller", "School") that has registered an account on the Rafyo platform. This DPA is entered into automatically when a School creates an account and applies for the duration of the service.

1. Definitions

  • "UK GDPR" — the UK General Data Protection Regulation (as retained under the Data Protection Act 2018)
  • "Personal Data" — any information relating to an identified or identifiable individual, as defined in UK GDPR
  • "Processing" — any operation performed on Personal Data, as defined in UK GDPR
  • "Data Subject" — the individual to whom Personal Data relates
  • "Sub-processor" — a third party engaged by the Processor to process Personal Data on behalf of the Controller

2. Roles and responsibilities

The School is the Controller. The School determines the purposes and means of processing personal data about its pupils, parents, and staff through the Rafyo platform.

Rafyo is the Processor. Rafyo processes personal data only on behalf of and in accordance with the School's documented instructions (i.e. the School's use of the Platform's features).

3. Subject matter and duration
Subject matter Provision of school management software (canteen ordering, pupil records, parent portals, bus route management, payments, audit logging)
Duration For the duration of the School's use of the Rafyo platform
Nature of processing Collection, storage, organisation, retrieval, use, disclosure by transmission, and erasure
Purpose To enable the School to manage canteen operations, pupil information, parent communications, payments, and regulatory record-keeping

4. Categories of data subjects

  • School administrators and staff
  • Parents and guardians
  • Pupils (children)

5. Types of personal data

Category Data processed
School staff Name, email, role, login activity (IP address, user-agent)
Parents/guardians Name, email, parent-child links, order history, payment records, login activity
Pupils First name, last name, class/year group, dietary notes (may include allergy and health-related information), parent links, order history

Special category data: Dietary notes may reveal information about a pupil's health conditions or religious beliefs. The School is responsible for ensuring an appropriate lawful basis for processing this data (typically substantial public interest under Schedule 1 of the Data Protection Act 2018, or explicit consent from parents).

6. Obligations of the Processor

Rafyo shall:

  1. Process Personal Data only on the documented instructions of the Controller (i.e. as directed through the Platform's features), unless required by law
  2. Ensure that persons authorised to process Personal Data are bound by confidentiality obligations
  3. Implement appropriate technical and organisational security measures (see Section 7)
  4. Not engage another processor (sub-processor) without the Controller's prior general authorisation (see Section 8)
  5. Assist the Controller in responding to data subject requests (access, rectification, erasure, portability)
  6. Assist the Controller in ensuring compliance with data protection impact assessments and prior consultations with the ICO, where required
  7. Delete or return all Personal Data to the Controller at the end of the service, at the Controller's choice (see Section 10)
  8. Make available to the Controller all information necessary to demonstrate compliance with this DPA

7. Security measures

Rafyo implements the following technical and organisational measures:

  • Encryption in transit — all data transmitted over TLS 1.2 or higher
  • Encryption at rest — database and file storage encrypted using AWS-managed keys
  • Access control — role-based access control with capability-based permissions per school
  • Authentication — passwords stored as one-way hashes (scrypt); tokens hashed (SHA-256) before storage
  • Data isolation — all queries scoped to the School's data; no cross-school data access
  • Audit logging — tamper-evident, append-only logs of all significant actions
  • Infrastructure — hosted on AWS in London, UK (eu-west-2); public access blocked at infrastructure level
  • Personnel — access to production systems restricted to authorised Rafyo personnel

8. Sub-processors

The Controller provides general authorisation for the Processor to engage sub-processors. The current list of sub-processors is:

Sub-processor Purpose Data location Transfer mechanism
Neon, LLC (part of Databricks, Inc.) Managed database — the primary store of all Personal Data London, UK (eu-west-2) UK Extension to the EU-U.S. DPF, certified as Databricks, Inc. Operated and supported from the USA.
Amazon Web Services (AWS) Cloud infrastructure hosting (compute, storage, content delivery, operational logs) and transactional email via Amazon SES. Email bodies include pupil names and dietary requirements. London, UK (eu-west-2) No transfer — UK region, AWS Europe entity

Neon's own sub-processors are listed at neon.com/subprocessors and that list is incorporated into this DPA by reference.

Stripe is not a sub-processor of Rafyo. Each School holds its own Stripe account under its own agreement with Stripe, Inc.; Rafyo initiates payments against that account through Stripe Connect. Stripe receives the payer's email address, the amount, the School name and the School's billing reference — no pupil names and no dietary or health data. The School is Stripe's customer for this purpose, and that relationship — including any transfer of data to Stripe in the United States and the safeguards for it — is between the School and Stripe rather than under this DPA.

Rafyo will notify the Controller by email at least 30 days before adding or replacing a sub-processor. If the Controller objects, the parties will work in good faith to resolve the objection. If no resolution is reached, the Controller may terminate the agreement.

9. Data breach notification

In the event of a personal data breach, Rafyo will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include:

  • A description of the nature of the breach, including categories and approximate number of data subjects affected
  • The name and contact details of Rafyo's point of contact
  • A description of the likely consequences of the breach
  • A description of the measures taken or proposed to address the breach

10. Data deletion and return

Upon termination of the service or at the Controller's request:

  • Rafyo will provide a complete export of the Controller's data in CSV format within 14 days of request
  • Rafyo will permanently delete all Controller data within 30 days of termination
  • Audit logs may be retained in anonymised form for up to 7 years to comply with Ofsted and DfE record-keeping requirements
  • Rafyo will confirm deletion in writing upon request

11. International transfers

All primary data storage and processing occurs in the United Kingdom (AWS London, eu-west-2 region), and transactional email is sent through Amazon SES in the same region.

One recipient is outside the UK: Neon, LLC (part of Databricks, Inc.), the managed database provider. The data itself remains in London, but Neon is operated and supported from the United States and its personnel may access it from there. Under UK GDPR that access is a restricted transfer. It is protected by the UK Extension to the EU-U.S. Data Privacy Framework (the UK-US data bridge) under Neon's certification as Databricks, Inc. Because the data bridge is an adequacy decision, no Standard Contractual Clauses, International Data Transfer Agreement or transfer risk assessment is required.

Payment data reaching Stripe, Inc. in the United States does so under the School's own agreement with Stripe (see Section 8), not under this DPA.

Rafyo previously used Postmark (ActiveCampaign, LLC) in the United States for transactional email. That arrangement has ended and no Controller data is sent to Postmark.

If our data transfer arrangements change, Rafyo will notify the Controller and ensure appropriate safeguards (such as UK International Data Transfer Agreements) are in place before any transfer occurs.

12. Audits

Rafyo will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA. The Controller may conduct audits (or appoint an independent auditor) with reasonable advance notice, during business hours, and no more than once per year unless a data breach has occurred. Rafyo will cooperate with such audits and provide reasonable access to relevant systems and personnel.

13. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service.

Nothing in this DPA limits or excludes liability where such limitation or exclusion is not permitted under UK GDPR or the Data Protection Act 2018.

14. Governing law

This DPA is governed by the laws of England and Wales and is subject to the exclusive jurisdiction of the courts of England and Wales.

15. Contact

For questions about this DPA or to exercise your rights as a Controller, contact us at privacy@rafyo.com.