Version: 23rd August 2026 (see Section 15)

DEFINITIONS

In this agreement:

• "Client", "School", "you", "your" — the legal entity that uses Elemental with its students and staff, being: (a) where the parties have signed a written version of this agreement, the entity named as the Client in that signed version; or (b) otherwise, the legal entity (for example a school, multi-academy trust or local authority) to which this agreement applies under Section 1. The person who signs this agreement on the School's behalf confirms that they are authorised to do so.
• "Effective Date" — the date stated in the signed copy of this agreement.
• "Privacy Policy" — the Elemental privacy policy at https://elementalmusic.app/privacy, as updated from time to time, which covers Personal Data for which we act as a Data Controller under UK GDPR Article 24.
• "Provider", "Elemental", "we", "our", "us" — Seasoft Limited (trading as Elemental), a company registered in England and Wales (company number 11321788) at Unit 36 Silk Mill Industrial Estate, Brook Street, Tring, HP23 5EF, United Kingdom.
• "Student Data" — the Personal Data listed in Section 3 that your administrators and teachers enter into Elemental when creating accounts.
• "Sub-processor" — another Data Processor we appoint to process Student Data on our behalf, as listed in Section 5.
• "UK GDPR" — the General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland, as defined in section 3(10) of the Data Protection Act 2018.

The terms "Data Controller", "Data Processor", "Data Subject", "Personal Data", "Personal Data Breach" and "Processing" have the meanings given to the equivalent terms in Article 4 of the UK GDPR. In plain terms: a Data Controller decides why and how Personal Data is used; a Data Processor handles it only on a Data Controller's instructions.

1. WHAT THIS AGREEMENT COVERS

This agreement applies where the School has opted in to it and a copy has been signed by us and by an authorised representative of the School. It then covers the Student Data (defined in Section 3), where Elemental acts as a Data Processor under UK GDPR Article 28.

To opt in, contact us at privacy@elementalmusic.app to request a copy for signature.

Where the School has not opted in, Elemental acts as a Data Controller for that data under UK GDPR Article 24, and it is governed by the Elemental Privacy Policy rather than by this agreement.

What is covered by this agreement:

• User profiles (student and teacher email addresses, first names and last names)
• Class names

What is not covered by this agreement:

Data where Elemental acts as a Data Controller under UK GDPR Article 24, in accordance with the Elemental Privacy Policy at https://elementalmusic.app/privacy, for example:

• Data entered by users directly into the Elemental platform, with the exception of the aforementioned user profile information and class names.
• Data generated by the Elemental platform (e.g., assignment marks and feedback)
• Usage analytics (unless connected with personally identifiable user data)

2. ROLES

You (the School):

• Decide which students and staff use Elemental and for what educational purposes

Us (Elemental):

• Use that data only to provide our service to your students and staff
• Keep the data secure and delete it when you ask us to

3. WHAT DATA WE PROCESS

Student Data, defined as:

• User profiles (student and teacher email addresses, first names and last names)
• Class names

This data is provided by school administrators or teachers through the Elemental website when creating Elemental student accounts, either through text entry or CSV / Excel upload.

4. HOW WE KEEP DATA SECURE

We protect Student Data with the following measures:

• Encryption in transit and at rest
• Secure cloud hosting through reputable third parties
• Access controls to ensure only authorised employees and contractors can view data
• Regular security updates and monitoring

Confidentiality: All employees and contractors who access the School's Student Data are bound by confidentiality obligations and receive regular data protection training.

5. OUR SUB-PROCESSORS

We use these trusted service providers for the processing of the Student Data:

All sub-processors are bound by agreements to ensure compliance under the UK GDPR.

We will provide notice before adding new sub-processors. You will have a reasonable opportunity to object on reasonable data protection grounds before any new sub-processor is added.

6. YOUR INSTRUCTIONS TO US

Under this agreement, you authorise us to:

• Store the Student Data entered by your administrators and teachers
• Use this data as necessary to provide Elemental to your students and staff

If you have alternative instructions for processing the Student Data, you can contact us at privacy@elementalmusic.app. Data will not be processed for other means without your written consent.

7. HELPING YOU WITH YOUR OBLIGATIONS

Data Subject Rights: If a student or parent contacts you asking to:

• See their data
• Correct their data
• Delete their data
• Download their data

You can contact us at privacy@elementalmusic.app and we will help you respond within 5 business days.

If a student, parent or other data subject contacts us directly in relation to their data protection rights, we will promptly notify and redirect the request to the School's nominated data protection contact (see Section 13), unless legally required to respond directly.

Security & Compliance Assistance: We will also help you with:

• Keeping data secure (as described in Section 4)
• Data Protection Impact Assessments (DPIAs) if you need to do one
• Providing information if you need to consult with the ICO
• Demonstrating our compliance with data protection requirements

8. IF THERE'S A DATA BREACH

If we become aware of a Personal Data Breach affecting your Student Data, we will notify you without undue delay and in any event within 48 hours of becoming aware, and tell you:

• What happened
• What data was affected
• What we're doing about it
• What you might need to tell students/parents

9. WHEN YOU STOP USING OUR SERVICE

When your subscription ends, or whenever you ask us to, you can choose for us to do either or both of the following:

• Delete all your school's Student Data
• Return it to you in a common format (CSV or Excel)

Within 14 days of receiving your request, except for any data we are required by law to keep. Data in backups will be deleted within 90 days.

We will confirm once deletion is complete.

10. AUDITS

You can ask us to demonstrate that we are keeping data secure and following this agreement at any time. We will provide documentation or allow an independent auditor to review our practices (at your expense).

11. INTERNATIONAL TRANSFERS

Student Data stays in the UK and EU.

12. HOW LONG THIS LASTS

This agreement continues while you use our service. When you stop using our service, we will delete the data as described in Section 9.

13. CONTACT INFORMATION

Your Data Protection Contact:
The user who signed up to Elemental, unless you tell us otherwise at privacy@elementalmusic.app. If your school has a Data Protection Officer or equivalent, we recommend nominating them, since we will redirect data protection rights requests to this contact under Section 7.

Our Data Protection Contact:
Name: Data Protection Officer, Seasoft Limited
Email: privacy@elementalmusic.app
Phone: +44 7405 857 044

Address: Unit 36 Silk Mill Industrial Estate, Brook Street, Tring, England HP23 5EF

14. ADDITIONAL TERMS

Changes: We can only change this agreement if both parties agree in writing

Governing Law: England and Wales

If parts are unenforceable: The rest of the agreement still applies

Liability: With the exception of data breaches caused by our failure to implement the security measures in Section 4 or to follow your instructions under Section 6, for which we remain liable in accordance with applicable law, Elemental's maximum liability is limited to the annual subscription fee paid by the School.

15. VERSION HISTORY