ExamDisplay
Sign in

Data Processing Agreement

Last updated: 26 July 2026

This Data Processing Agreement (DPA) forms part of the ExamDisplay Terms of Service between Lompla Ltd and the subscribing school or organisation. It governs all personal data the School uploads to ExamDisplay and applies automatically to every subscription and trial. No separate signature is required, though we will countersign a copy on request.

1. Parties and scope

This DPA is between Lompla Ltd, a company registered in England and Wales (company number 14087508; registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom) (the “Processor”, “we”) and the school or organisation identified in the account (the “Controller”, the “School”). It applies to all personal data the School or its authorised users submit to the service (“School Personal Data”), and reflects the requirements of Article 28 of the UK GDPR and EU GDPR. If this DPA conflicts with the Terms of Service, this DPA prevails for data protection matters.

2. Roles

The School is the controller of School Personal Data and warrants that it has a lawful basis for the processing it instructs, including for any special category data. Lompla Ltd is the processor and processes School Personal Data only on the School’s documented instructions. The School’s instructions are: use of the service’s features and settings, this DPA, and any additional written instructions agreed between the parties. We will inform the School if, in our opinion, an instruction infringes data protection law.

For the personal data we process for our own purposes (staff account administration, billing, support, security logging), we act as an independent controller as described in our Privacy Policy; that processing is outside the scope of this DPA.

3. Details of the processing

Subject matter and duration

Hosting and processing of School Personal Data to provide the ExamDisplay service, for the duration of the subscription (including trials) plus the deletion period in section 9.

Nature and purpose

Storage, organisation, retrieval, display, and analysis of examination administration data: exam displays and invigilation, exam scheduling, room and candidate management, seating, document printing, and results analysis, according to the School’s plan.

Data subjects

  • Students and examination candidates, including children.

  • School staff members (teachers, invigilators, administrators).

Categories of personal data

  • Candidate identification: names, exam board candidate numbers, dates of birth.

  • Educational data: class and subject enrolments, exam entries, schedules, seating allocations, examination results.

  • Access arrangements (for example extra time, rest breaks, separate rooms). This may reveal disability or health information and is treated as special category data with the additional safeguards in Annex II.

  • Staff data: names, work email addresses, roles, invigilation and workload assignments.

On-device candidate data by default

The categories above apply only to the extent the School’s plan and configuration send them to us. On the Display plan, no candidate personal data is submitted to our servers. By default, candidate-linked data is stored on-device, exclusively in the browser on the School’s own devices. Our servers refuse it at the database level, so we do not process it within the meaning of this DPA; the School is responsible for securing and backing up those devices using the service’s built-in export tools. Hosted candidate data is enabled only by arrangement after the School has been informed about the processing and safeguards.

If the School enables an accountless teacher request link, we process the submitting teacher's name, work email address, and class-level scheduling request. The public form does not receive candidate names, identifiers, enrolments, counts, workload results, or access-arrangement data. For on-device schools, unimported request contents are held in a restricted transfer mailbox for no more than 30 days and are erased when an authorised coordinator confirms a successful import.

4. Confidentiality and personnel

We ensure that every person we authorise to process School Personal Data is bound by a contractual or statutory duty of confidentiality, and that access is limited to what is needed to operate, support, and secure the service.

5. Security

We implement and maintain appropriate technical and organisational measures to protect School Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, taking into account the state of the art and the nature of the data, including the measures described in Annex II (our Security page, which forms part of this DPA). We may update those measures over time provided the overall level of protection is not reduced.

6. Sub-processors

The School gives general written authorisation for us to engage the sub-processors listed on our Sub-processors page (Annex III, which forms part of this DPA). We will update that page at least 30 days before adding or replacing a sub-processor that processes School Personal Data, and schools can subscribe to change notices by emailing contact@lompla.com. The School may object on reasonable data protection grounds within that period; if we cannot accommodate the objection, the School may terminate the affected subscription and receive a pro-rata refund of prepaid fees. We impose data protection obligations on every sub-processor equivalent to those in this DPA and remain liable for their performance.

7. Assistance to the School

  • Data subject rights: taking into account the nature of the processing, we assist the School with appropriate technical and organisational measures to respond to data subject requests (access, rectification, erasure, restriction, portability, objection). The service’s built-in search, edit, export, and deletion tools cover most requests; we assist directly where they do not. If a data subject contacts us directly about School Personal Data, we will refer them to the School without undue delay.

  • DPIAs: we provide reasonable assistance with data protection impact assessments and prior consultations relating to the service, including through the documentation on our Security and Sub-processors pages.

  • Compliance information: we make available the information reasonably necessary to demonstrate compliance with Article 28.

8. Personal data breach

We will notify the School without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting School Personal Data. The notification will describe, so far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will cooperate with the School and take reasonable steps to mitigate the breach. Notification is not an admission of fault.

9. Deletion and return of data

During the subscription, the School can export its data at any time using the built-in export tools. Upon termination or expiry of the subscription, we will delete all School Personal Data from our production systems within 30 days, and from backups on their normal expiry cycle, unless retention is required by law. On written request made before the end of that period we will instead assist the School in exporting its data first.

10. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including responding to the School’s reasonable written security questionnaires. No more than once per 12-month period, and on at least 30 days’ written notice, the School may conduct (itself or through an independent auditor bound by confidentiality) an audit of our processing of School Personal Data, during business hours, without disruption to the service, and at the School’s cost. Audit rights do not extend to other customers’ data or to sub-processors’ facilities, for which we rely on the sub-processors’ own audit reports and certifications.

11. International transfers

School Personal Data is hosted in the European Union (Ireland). We will not transfer School Personal Data outside the UK or EEA unless the transfer is covered by an adequacy decision or by appropriate safeguards under Chapter V of the UK/EU GDPR (the EU Standard Contractual Clauses and/or the UK International Data Transfer Agreement or Addendum, as applicable), which are incorporated into this DPA to the extent such a transfer occurs. Transfer details per sub-processor are on the Sub-processors page.

12. Liability, term, and law

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where data protection law does not permit such limitation. This DPA takes effect when the School first submits personal data to the service and continues until we have deleted all School Personal Data under section 9. This DPA is governed by the laws of England and Wales.

Annexes

To request a countersigned copy of this DPA for your records, email contact@lompla.com.