END-USER LICENCE AGREEMENT FOR MONITORING SYSTEMS PROVIDED BY CEM (CENTRE FOR EVALUATION AND MONITORING)
THIS AGREEMENT IS MADE BETWEEN THE END USER OF THIS SOFTWARE (THE “SCHOOL”) AND THE UNIVERSITY OF DURHAM, WHOSE REGISTERED ADDRESS IS THE PALATINE CENTRE, STOCKTON ROAD, DURHAM, DH1 3LE AS REPRESENTED BY THE CENTRE FOR EVALUATION AND MONITORING (“CEM”).
- The School or organisation purchasing on behalf of the school (henceforth referred to as the “School”) wishes to purchase a licence from CEM to use one or more of CEM’s assessment and monitoring systems (henceforth referred to as the “System”), install or access online software belonging to CEM to facilitate computer based assessment which may include associated software components, media, printed materials, and "online" or electronic documentation which will be administered by the School in the form of a test (henceforth referred to as the “Assessment”), and access online or downloadable analysis of assessment data and other data provided by the school, including additional guidance material (henceforth referred to as the “Reports”);
- The Assessment will include one or more of either:
a) ASPECTS, BASE, PIPs Baseline, PIPS and/or InCAS (a “Primary Product”); or
b) MidYIS, Yellis, Alis, CEM IBE (a “Secondary Product”)
- CEM has agreed to allow the School to install or access online, and otherwise use the Assessment and Reports subject to the terms and conditions of this Agreement;
- In placing an online order with CEM (an “Order”) for any of CEM’s Systems, the School understands that in doing so, the School enters into a legally binding contract with the University of Durham in respect of a Licence to access and use such Systems. Incorporated into this Licence are the terms of the Order, and the conditions as set out in this Licence.
TERMS AND CONDITIONS OF LICENCE:
- This Licence shall be considered accepted by the School as follows:
1.1 Where the Assessment purchased by the School is a Primary Product, this Licence shall be accepted by the Parties on the placing by the School of an online Order to use one of CEM’s Systems, access to the System that is the subject of the Order shall commence on 1st August 2019 (the “Start Date”). This Licence shall remain in full force and effect for of an initial term of one (1) year following the Start Date, until 31st July 2020, unless earlier terminated in accordance with the provisions of Clause 26 herein. Where in the course of placing the Order, the School has chosen for this Licence to renew automatically, this Licence shall renew automatically for additional periods of one (1) year, every year on the anniversary of the Start Date unless the School notifies CEM either via the website or otherwise in writing, that the School wishes for this Licence to expire on the next relevant anniversary of the Start Date.
1.2 Where the Assessment purchased by the School is a Secondary Product, this Licence shall be accepted by the Parties on the placing by the School of an online Order to use one of CEM’s Systems, access to the System that is the subject of the Order shall commence on 1st June 2019 (the “Start Date”). This Licence shall remain in full force and effect for of an initial term of one (1) year following the Start Date, until 31st May 2020, unless earlier terminated in accordance with the provisions of Clause 26 herein. Where in the course of placing the Order, the School has chosen for this Licence to renew automatically, this Licence shall renew automatically for additional periods of one (1) year, every year on the anniversary of the Start Date unless the School notifies CEM either via the website or otherwise in writing, that the School wishes for this Licence to expire on the next relevant anniversary of the Start Date.
- CEM hereby grants to the School the right to install and use multiple copies of the Assessment on the School’s computers running validly licensed copies of the operating system for which the Assessment was designed.
- CEM hereby grants to the school the right to access online or download multiple copies of the Reports for use by the school.
- CEM agrees to provide the Assessment and Reports as detailed in the School’s Order in accordance with the terms and conditions of this Agreement. CEM will use its best endeavours to ensure that the Assessment is provided under the best care, skill and diligence and in accordance with best industry practice as outlined by the guidelines of the British Educational Research Association (BERA), and in accordance with CEM’s ethical research framework, and in accordance with all applicable laws and regulations, and in consultation with the Schools.
- In consideration of the rights granted to the School hereunder, the School undertakes and agrees to make payment to CEM of the Licence Fee detailed in the Order, within thirty (30) days of receipt of an invoice.
- The School acknowledges and agrees that any and all Intellectual Property Rights held in the System, Assessment and Reports including but not limited to all copyright therein, shall remain the sole and exclusive property of CEM.
- CEM shall at its own expense obtain written permission for the inclusion of any copyright material in the Assessment or Reports, and shall be responsible for the payment of all fees charged for the use of such material subject to copyright.
- CEM warrants to the School that the Intellectual Property Rights in the Assessment and Reports, so far as it is aware and to the best of its knowledge and belief, do not infringe the rights of any third party and that no third party has threatened or is currently threatening proceedings in respect of such infringement, and none of its Intellectual Property Rights in the Assessment or Reports is the subject of any actual or, so far as it is aware, threatened challenge, opposition or revocation proceedings.
- The Parties agree at all times to handle personal information of the candidates strictly in accordance with the Data Protection Legislation which for the purposes of this Agreement means the Data Protection Act 2018, the Regulation EU/2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation) and all applicable laws and regulations relating to processing of personal data and privacy including where applicable the guidance and codes of practice issued by the Information Commissioner. Each Party shall have the rights and obligations subscribed to it under Data Processing Schedule set out below.
- The School will act as Data Controller, and CEM will act as Data Processor, in respect of any personal data entered into the System or otherwise supplied to CEM for the purpose of the Assessment or Reports. CEM will act as Data Controller in respect of information processed for research purposes.
- The School agrees they are responsible for ensuring they have a lawful basis for sharing any of the personal data provided to CEM as part of the System.
- The School agrees that they are responsible for ensuring that adequate privacy notices are provided to data subjects and for seeking consent for the processing of personal data.
- The School acknowledges that personal data provided to CEM will be used by CEM for research purposes and for service improvement. No School or individual will be identified as part of any published research. The School is responsible for ensuring that this processing activity is included within privacy notices.
- CEM shall provide appropriate technical and organisational measures to protect the security of the data, in particular against unauthorised and unlawful access or processing, alteration, accidental loss or destruction of or damage to the data, and will take all reasonable steps to ensure the reliability of any of its staff who have access to the data.
- The School hereby acknowledges to CEM that CEM is subject to the requirements of the Freedom of Information Act 2000 and the School agrees to assist and co-operate with CEM (at their own expense) to enable CEM to comply with these information disclosure requirements. Further, in the event that the School is also subject to the requirements of the Freedom of Information Act 2000, CEM agrees to assist and co-operate with the School (at their own expense) to enable the School to comply with these information disclosure requirements. Any disclosure made by either party pursuant to such party’s obligations under the provisions of the FOIA, shall not constitute a breach of this Agreement. The provisions of this clause 11 shall apply during the continuance of the Agreement and indefinitely after its expiry or termination.
- The following sets out the entire financial liability of CEM to the School in respect of any breach by CEM of this Agreement, non or incomplete performance or contemplated performance by CEM of this Agreement, negligence for which CEM is liable, and any representation or statement arising under or in connection with this Agreement or by or on behalf of CEM:
16.1. in respect of all other losses and claims, the aggregate liability of CEM for any breach, negligence and/or liability arising in any other way out of the subject matter of this Agreement or the performance of the Assessment will not exceed in total the amounts actually received by CEM from the School for the licence of the Assessment software under this Agreement; and
16.2. CEM shall in no circumstances be liable for any loss of profits, loss of business or production, depletion of goodwill, loss of or corruption to data, and/or any indirect loss.
- CEM will in no event be liable for any statement or representation about the School, their business, products or services made or communicated in or by any item, material or work approved by the Schools in writing.
- For clarity, nothing in this Agreement limits or excludes either Party’s liability for death or personal injury caused by such Party’s negligence or any fraud or for any sort of liability that by law cannot be limited or excluded.
- The School undertakes that under no circumstance shall the School:
19.1. copy, reproduce or create derivative works from the System, Assessment and/or Reports;
19.2. provide the System, Assessment and/or Reports to any a third party, other than as contemplated under this Licence, without the express written permission of CEM. It is acknowledged and agreed by CEM that the School shall be allowed to share the System, Assessment and/or Reports with third Parties with whom it is strictly necessary in order to allow the School to make full use of the System as contemplated under this Agreement, which shall include, but not be limited to bodies representing parents, local authorities, the School’s parent company/trust, external inspectors and education consultants employed by the school;
19.3. sublicense, rent, sell or lease any portion of the System, Assessment and/or Reports ; nor
19.4. use the System, Assessment and/or Reports in any manner not authorised by these terms.
- The School hereby acknowledge that certain elements of the System, Assessment and Reports may at any time be in the process of being developed. The System, Assessment and/or Reports may subsequently be substantially modified or withdrawn at the sole discretion of CEM.
- The School’s installation and use of the System, Assessment and/or Reports is at the School’s sole discretion and risk and may produce unintended or erroneous results and may contain bugs, errors and other problems that could cause system or other failures and data loss. The School accepts that the System, Assessment and/or Reports is provided to the School "as is" without any warranty, and CEM expressly disclaims any and all warranties, including, but not limited to, warranties of merchantability, fitness for a particular purpose or error free operation.
- To the extent permitted by applicable law, in no event shall CEM be liable for damages of any kind under this agreement including, without limitation, direct, indirect, incidental, punitive, or consequential damages. Therefore, the entire risk arising out of the use or performance of the System, Assessment and/or Reports shall remain with the School.
- Notwithstanding any damages that the School might incur for any reason whatsoever (including, without limitation, all damages referenced above and all direct or general damages), the entire liability of CEM and any of its suppliers under any provision of this Agreement, the School’s exclusive remedy for all of the foregoing shall be limited to the greater of the amount actually paid by the School for access to the System, Assessment and/or Reports under this Agreement, or FIVE GBP (£5). The foregoing limitations, exclusions, and disclaimers shall apply to the maximum extent permitted by applicable law, even if any remedy fails its essential purpose.
- CEM is not obligated to provide updates to the System, Assessment and/or Reports. However, in the event CEM elects in its sole discretion to provide updates to the System, Assessment and/or Reports, such updates shall be deemed to constitute part of the System, Assessment and/or Reports and shall therefore be subject to these terms.
- The School warrants to CEM it shall at no point:
25.1. take any action which is intended, or could reasonably be expected, to harm in any way CEM or the University of Durham, or CEM’s, or the University of Durham’s reputation; or
25.2. take any action which is intended, or could reasonably be expected to lead to any unwanted or unfavourable publicity for CEM or for the University of Durham.
- Following an Order, the School may terminate this Agreement for convenience at any time prior to the Start Date, by written notice to CEM. Where this Agreement is terminated by the School for convenience prior to the Start Date, the School agrees to pay CEM a withdrawal fee to a total sum of FIFTY GBP (£50). Payment of said withdrawal charge shall be made within thirty (30) days of receipt by the School of an invoice. Where the School wishes to terminate this Agreement following the Start Date, the School may do so by written notice to CEM, however, the School shall remain liable to CEM to pay the Licence Fee in full.
- In the event that any Court or other competent authority decides that any provision of this Agreement is void or otherwise ineffective in whole or in part than any other part and the other terms and conditions of this Agreement shall continue in full force and effect.
- The parties do not intend that any term of this Agreement shall be enforceable solely by virtue of the Contracts (Rights of Third Parties) Act 1999 by any person who is not a party to this Agreement.
- CEM reserves the right to at any time assign any or all of its rights and/or obligations under this agreement.
- This Agreement constitutes the entire agreement between the parties with respect to the subject matter of this Agreement and supersedes all previous agreements, arrangements or undertakings between the parties relating to the subject matter of this Agreement and any representations or warranties previously given or made to it.
- This Agreement is governed by and interpreted in accordance with English law. Any disputes or claims relating to this Agreement shall be subject to the exclusive jurisdiction of the English Courts.
DATA PROCESSING SCHEDULE
1. DEFINITIONS AND INTERPRETATION
- In this Schedule, unless the context otherwise requires:
“Controller” means the School, who determines (individually or jointly or in common with others) the purposes for which and the manner in which any Pupil’s Personal Data are or will be Processed;
"Data Breach" means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Pupil’s Personal Data;
"Data Protection Legislation" means any Applicable Law relating to the Processing, privacy, and use of personal data including, without limitation: (i) 2002/58/EC; (ii) the Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”); (iii) any corresponding or equivalent national laws or regulations; or (iv) approved codes of conduct or approved certification mechanisms issued by any relevant regulatory authority;
"Pupil’s Personal Data" means any information provided by or on behalf of School to CEM relating to an identified or an identifiable natural person (“data subject") being one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity, or as otherwise defined under applicable Data Protection Legislation;
"Process", “Processed” or "Processing" means accessing, collecting, obtaining, recording, holding, disclosing, using, altering, deleting, erasing or destroying Pupil’s Personal Data, or carrying out any operation(s) on the Pupil’s Personal Data or as otherwise defined under applicable Data Protection Legislation;
“Processing Instructions” means the instructions for Processing Pupil’s Personal Data, as set out in this Schedule and/or in the Agreement, and otherwise as provided in writing by or on behalf of Customer to CEM from time to time; and
“Processor” means CEM, where CEM Processes Customer Personal Data on behalf of the Customer or as otherwise defined under applicable Data Protection Legislation.
1.2 In case of any conflict or inconsistency between the provisions of this Schedule and the main terms of the Agreement, the provisions contained in this Schedule shall prevail.
1.3 A reference to a statute or statutory provision includes all subordinate legislation made under it from time to time, and is a reference to it as amended, extended or re-enacted from time to time (“Replacement Law”). References to terms defined in a statute or statutory provision shall be replaced with or incorporate (as the case may be) references to the equivalent terms defined in any Replacement Laws, once in force and applicable.
1.4 To the extent that a term of this Schedule requires the performance by a party of an obligation “in accordance with Data Protection Legislation” (or similar), unless otherwise expressly agreed in this Schedule, this requires performance in accordance with the relevant requirements of such Data Protection Legislation as is in force and applicable at the time of performance (if any).
2.1 Data Controller
2.1.1 School shall ensure that it only provides Pupil’s Personal Data to CEM as is required to allow CEM to provide the services.
2.1.2 School shall ensure it has a legal basis to transfer Pupil’s Personal Data to CEM.
2.2 Data Processor
2.2.1 For the services, CEM is a Processor acting on School’s behalf. Unless set out otherwise in this Schedule, Processing of the Pupil’s Personal Data shall be undertaken by the CEM in accordance with Appendix 1.
2.2.2 As Processor CEM will only act upon and Process Pupil’s Personal Data on the Processing Instructions, unless required by applicable law. Pupil’s Personal Data will be used by CEM in accordance with and for the purposes set out in the Processing Instructions and only where necessary to provide the services to School.
2.2.3 If CEM is ever unsure as to the parameters or lawfulness of the instructions issued by School, CEM will revert to School for the purpose of seeking clarification or further instructions.
2.2.4 CEM shall cooperate and assist Schools with any data protection impact assessments (“DPIAs”) and consultations with (or notifications to) relevant regulators as required by Data Protection Legislation in relation to the Pupil’s Personal Data and the services. School shall pay any costs incurred by CEM in respect of CEM's obligations under this clause 2.2.4.
2.2.5 CEM shall forward to School without undue delay and otherwise cooperate with and assist School promptly with any requests from data subjects of any Pupils Personal Data pursuant to Data Protection Legislation. School shall pay any costs incurred by CEM in respect of CEM's obligations under this clause 2.2.5.
2.3 CEM personnel
2.3.1 CEM shall (i) ensure that its personnel will not Process Pupil’s Personal Data except in accordance with the provisions of this Schedule; and (ii) procure that personnel are contractually obligated to maintain the security and confidentiality of any Pupil’s Personal Data and this obligation continues even after their engagement ends.
2.4 Deletion or return of Customer Personal Data
2.4.1 CEM shall (i) at School’s option, securely delete or return all copies of Pupil’s Personal Data which CEM does not require to use for the purposes of its own research; and (ii) cease Processing such Pupil’s Personal Data after the business purposes for which the Pupil’s Personal Data was collected or transferred have been fulfilled (or earlier upon School’s written request), unless CEM requires to Process such Pupil’s Personal Data for the purposes of its own research.
3.1 CEM shall implemented and shall maintain throughout the term of the Agreement appropriate technical and organisational measures, internal controls and information security routines intended to protect School’s Personal Data against accidental, unauthorised or unlawful access, disclosure, alteration, loss, or destruction, which shall at all times be:
3.1.1 of at least the minimum standard required by Data Protection Legislation; and
3.1.2 so as to ensure a level of security for the Pupil’s Personal Data appropriate to the risk.
- NOTIFICATION AND DATA BREACHES
4.1 If CEM becomes aware that any Data Breach has occurred, CEM shall without undue delay, notify School of the Data Breach and provide sufficient information to allow School to report the Data Breach and/or notify affected data subjects as required under Data Protection Legislation.
4.2 CEM shall promptly (and in any event within 72 hours) inform School if it receives a complaint or request relating to either Party’s obligations under Data Protection Legislation relevant to this Schedule and shall provide School with relevant details of such complaints or requests.
5.1 School provides its general consent to allow CEM to engage sub-processors for the purposes of CEM providing the services where:
5.1.1 CEM informs School of any intended changes concerning the addition or replacement of sub-processors, thereby giving Customer the opportunity to object to such changes.
5.1.2 Sub-processors are contractually bound to equivalent obligations as are contained in this Schedule. CEM shall also remain fully liable to School where the sub-processor fails to fulfil its data protection obligations, as well as for any acts or omissions of the sub-processor regard of its Processing of Pupil’s Personal Data.
- TRANSFER OF DATA
6.1 CEM (or any sub-processor) shall only transfer Pupil’s Personal Data from the EU to a country outside the EEA or an international organisation where such transfer:
6.1.1 is subject to appropriate safeguards; and
6.1.2 otherwise complies with Data Protection Laws.
- INFORMATION AND AUDIT
7.1 CEM shall make available to School all information necessary to demonstrate its compliance with the obligations under Data Protection Legislation and allow for and contribute to audits, including inspections, conducted by School or another auditor mandated by School. Information and audit rights of the School only arise under this clause 7 to the extent that other provisions in the Agreement do not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Legislation.
7.2 School shall pay any costs incurred by CEM in respect of CEM's obligations under this clause 7.
7.3 Information and audit rights of the only arise under this clause 7 to the extent that the Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Legislation.
Each party represents and warrants that it shall comply with all applicable Data Protection Legislation at all times.
- SUBJECT-MATTER, NATURE AND PURPOSE OF THE PROCESSING:
The context for and purposes for the Processing of Pupil’s Personal Data is CEM’s provision of the applicable services under the Agreement.
- DURATION OF PROCESSING:
Processing of the Pupil’s Personal Data by CEM shall be for the term of the Agreement, provided that Pupil’s Personal Data shall not be Processed for longer than is necessary for the purpose for which it was collected or is being Processed (except where a statutory exception applies).
- CUSTOMER PERSONAL DATA IN SCOPE:
3.1 CEM may Process the following types/categories of Pupil’s Personal Data:
3.1.1 Pupils’ Personal Data, consisting of: forename, surname, gender, class name, year group, ethnic origin, unique pupil number, home postcode, which language pupil speaks at home, place of birth, first language, free meals status.
3.1.2 Sensitive Pupil’s Personal Data/other special categories of Customer Personal Data, consisting of: Special Education Needs, Special Education Needs Type.
- PERSONS AFFECTED (DATA SUBJECTS):
The group of data subjects affected by the Processing of their Personal Data consists of:
Primary and Secondary EULA Subscription V4 01/04/2019