Version: 23rd August 2026 (see Section 15)

DEFINITIONS

In this agreement:

• "Client", "School", "you", "your" — the legal entity that uses Elemental with its students and staff, being: (a) where the parties have signed a written version of this agreement, the entity named as the Client in that signed version; or (b) otherwise, the legal entity (for example a school, multi-academy trust or local authority) to which this agreement applies under Section 1. The person who signs up to Elemental confirms that they are authorised to act on the School's behalf.
• "Effective Date" — the date on which the School first approved the permissions listed in Section 3 via Microsoft Entra.
• "Privacy Policy" — the Elemental privacy policy at https://elementalmusic.app/privacy, as updated from time to time, which covers Personal Data for which we act as a Data Controller under UK GDPR Article 24.
• "Provider", "Elemental", "we", "our", "us" — Seasoft Limited (trading as Elemental), a company registered in England and Wales (company number 11321788) at Unit 36 Silk Mill Industrial Estate, Brook Street, Tring, HP23 5EF, United Kingdom.
• "Student Data" — the Personal Data listed in Section 3 that we obtain from your Microsoft Entra or Microsoft Teams for Education environment when providing Elemental to your students and staff.
• "Sub-processor" — another Data Processor we appoint to process Student Data on our behalf, as listed in Section 5.
• "UK GDPR" — the General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland, as defined in section 3(10) of the Data Protection Act 2018.

The terms "Data Controller", "Data Processor", "Data Subject", "Personal Data", "Personal Data Breach" and "Processing" have the meanings given to the equivalent terms in Article 4 of the UK GDPR. In plain terms: a Data Controller decides why and how Personal Data is used; a Data Processor handles it only on a Data Controller's instructions.

1. WHAT THIS AGREEMENT COVERS

This agreement applies when Elemental accesses Student Data (defined in Section 3) from the School's Microsoft Entra tenant or Microsoft Teams for Education environment, where Elemental acts as a Data Processor under UK GDPR Article 28.

What is covered by this agreement:

• User profiles (student and teacher email addresses, first names and last names)
• Class rosters (class names and identifiers, teacher identifiers and student identifiers)
• Assignments (identifiers and statuses)

What is not covered by this agreement:

Data where Elemental acts as a Data Controller under UK GDPR Article 24, in accordance with the Elemental Privacy Policy at https://elementalmusic.app/privacy, for example:

• Data entered by teachers directly into the Elemental platform, not via Microsoft Teams for Education (e.g., assignment names and descriptions)
• Data generated by the Elemental platform (e.g., assignment marks and feedback)
• Usage analytics (unless connected with personally identifiable user data)

2. ROLES

You (the School):

• Decide which students and staff use Elemental and for what educational purposes
• Authorise us to access your Microsoft Entra tenant and Microsoft Teams for Education environment by approving the scopes listed in Section 3
• Ensure that data sent from Elemental to your Microsoft Teams for Education environment, e.g., assignments, marks and feedback, is protected in accordance with your obligations as a Data Controller under UK GDPR Article 24

Us (Elemental):

• Only access the Microsoft Entra and Microsoft Teams for Education data you authorise per the scopes listed in Section 3
• Use that data only to provide our service to your students and staff
• Keep the data secure and delete it when you ask us to

3. WHAT DATA WE PROCESS

Student Data, defined as:

• User profiles (student and teacher email addresses, first names and last names)
• Class rosters (class names and identifiers, teacher identifiers and student identifiers)
• Assignments (identifiers and statuses)

This data is obtained from Microsoft Entra / Microsoft Teams for Education using the following scopes:

These scopes and their associated permissions are defined and described by Microsoft and are documented at https://learn.microsoft.com/en-us/graph/permissions-reference.

All scopes are delegated, so we can only access the data available to the signed-in user, and they are the minimum required to provide the features described in this agreement.

4. HOW WE KEEP DATA SECURE

We protect Student Data with the following measures:

• Encryption in transit and at rest
• Secure cloud hosting through reputable third parties
• Access controls to ensure only authorised employees and contractors can view data
• Regular security updates and monitoring

Confidentiality: All employees and contractors who access the School's Student Data are bound by confidentiality obligations and receive regular data protection training.

5. OUR SUB-PROCESSORS

We use these trusted service providers for the processing of the Student Data:

All sub-processors are bound by agreements to ensure compliance under the UK GDPR.

We will provide notice before adding new sub-processors. You will have a reasonable opportunity to object on reasonable data protection grounds before any new sub-processor is added.

6. YOUR INSTRUCTIONS TO US

Under this agreement, you authorise us to:

• Connect to your Microsoft Entra tenant to obtain user profiles (see Section 3)
• Connect to your Microsoft Teams for Education environment to obtain class rosters and assignments (see Section 3)
• Connect to your Microsoft Teams for Education environment to create and update assignments using data from Elemental
• Use this data as necessary to provide Elemental to your students and staff

If you have alternative instructions for processing the Student Data, you can contact us at privacy@elementalmusic.app. Data will not be processed for other means without your written consent.

7. HELPING YOU WITH YOUR OBLIGATIONS

Data Subject Rights: If a student or parent contacts you asking to:

• See their data
• Correct their data
• Delete their data
• Download their data

You can contact us at privacy@elementalmusic.app and we will help you respond within 5 business days.

If a student, parent or other data subject contacts us directly in relation to their data protection rights, we will promptly notify and redirect the request to the School's nominated data protection contact (see Section 13), unless legally required to respond directly.

Security & Compliance Assistance: We will also help you with:

• Keeping data secure (as described in Section 4)
• Data Protection Impact Assessments (DPIAs) if you need to do one
• Providing information if you need to consult with the ICO
• Demonstrating our compliance with data protection requirements

8. IF THERE'S A DATA BREACH

If we become aware of a Personal Data Breach affecting your Student Data, we will notify you without undue delay and in any event within 48 hours of becoming aware, and tell you:

• What happened
• What data was affected
• What we're doing about it
• What you might need to tell students/parents

9. WHEN YOU STOP USING OUR SERVICE

When your subscription ends, or whenever you ask us to, you can choose for us to do either or both of the following:

• Delete all your school's Student Data
• Return it to you in a common format (CSV or Excel)

Within 14 days of receiving your request, except for any data we are required by law to keep. Data in backups will be deleted within 90 days.

We will confirm once deletion is complete.

10. AUDITS

You can ask us to demonstrate that we are keeping data secure and following this agreement at any time. We will provide documentation or allow an independent auditor to review our practices (at your expense).

11. INTERNATIONAL TRANSFERS

Student Data stays in the UK and EU.

12. HOW LONG THIS LASTS

This agreement continues while you use our service. When you stop using our service, we will delete the data as described in Section 9.

13. CONTACT INFORMATION

Your Data Protection Contact:
The user who signed up to Elemental, unless you tell us otherwise at privacy@elementalmusic.app. If your school has a Data Protection Officer or equivalent, we recommend nominating them, since we will redirect data protection rights requests to this contact under Section 7.

Our Data Protection Contact:
Name: Data Protection Officer, Seasoft Limited
Email: privacy@elementalmusic.app
Phone: +44 7405 857 044

Address: Unit 36 Silk Mill Industrial Estate, Brook Street, Tring, England HP23 5EF

14. ADDITIONAL TERMS

Changes: We can only change this agreement if both parties agree in writing

Governing Law: England and Wales

If parts are unenforceable: The rest of the agreement still applies

Liability: With the exception of data breaches caused by our failure to implement the security measures in Section 4 or to follow your instructions under Section 6, for which we remain liable in accordance with applicable law, Elemental's maximum liability is limited to the annual subscription fee paid by the School.

15. VERSION HISTORY