Early Access: First Month Free – Use code WALNUT-EARLY at checkout. Free for the first month. Cancel anytime. See Terms

Sign In
Get Started

Data Processing Agreement (DPA)

Last updated: 16 October 2025

This Data Processing Agreement (“DPA”) describes how Walnut Learning Assistant Ltd (“Walnut”, “we”, “our”, or “us”) processes personal data on behalf of customers in accordance with the UK General Data Protection Regulation (“UK GDPR”).

This DPA is incorporated by reference into the Terms of Use and applies automatically to all customers who use Walnut’s services.

1. Roles and Responsibilities

Depending on the context of data processing:

  • When Walnut collects and determines the purpose of processing (for example, data provided directly by parents and learners), Walnut acts as a Data Controller.
  • When a school, academy, or organisation provides personal data to Walnut for use of the platform, Walnut acts as a Data Processor, and the school or organisation remains the Data Controller.

2. Purpose of Processing

Walnut processes personal data only to provide and improve its services, which include:

  • Operating the Walnut Learning Assistant platform
  • Managing user accounts and authentication
  • Delivering adaptive learning and AI-driven support
  • Providing analytics, feedback, and reporting
  • Handling subscriptions, billing, and payment processing
  • Sending necessary service emails and notifications

We do not process personal data for marketing purposes without consent.

3. Categories of Data

Personal data processed may include:

  • Account and contact information (name, email, user ID)
  • Student learning activity and progress data
  • Text or responses entered into the Walnut Assistant
  • Payment information (via secure third-party processors)
  • System and usage metadata (e.g. timestamps, device type)

Data subjects include:

  • Students / learners
  • Parents / guardians
  • Teachers or school administrators

Walnut does not intentionally collect sensitive categories of data such as health, ethnicity, or biometric data.

4. Duration and Retention

Walnut retains personal data for as long as necessary to provide the services or as required by law.
When an account is closed, data is deleted or anonymised within a reasonable timeframe in line with Walnut’s internal retention policy.

5. Subprocessors

Walnut uses carefully selected third parties (“subprocessors”) to assist in providing the service.
Each subprocessor is bound by written agreements ensuring equivalent data protection standards.

The current list of subprocessors is available at:
👉 https://walnutlearn.com/sub-processors/

6. International Transfers

Where personal data is transferred outside the UK or EEA, Walnut ensures appropriate safeguards are in place, including:

  • The UK International Data Transfer Agreement (IDTA), or
  • The EU Standard Contractual Clauses (SCCs), as applicable.

Transfers are made only when necessary to deliver the services.

7. Security Measures

Walnut implements appropriate technical and organisational measures to protect personal data, including:

  • Encryption at rest and in transit
  • Access controls and role-based permissions
  • Regular security reviews and monitoring
  • Incident detection and response processes
  • Staff confidentiality agreements and training

8. Data Subject Rights

When acting as a Data Processor, Walnut assists the Data Controller in fulfilling its obligations regarding data subject rights, including access, rectification, erasure, and portability.

Parents or learners who use Walnut directly may contact support@walnutlearn.com to exercise their rights under UK GDPR.

9. Data Breach Notification

In the unlikely event of a personal data breach, Walnut will:

  • Notify affected Controllers without undue delay after becoming aware of the breach
  • Provide details about the nature, impact, and remediation steps
  • Cooperate fully to support required notifications to authorities or individuals

10. Audit and Inspection

Controllers may request information necessary to demonstrate Walnut’s compliance with this DPA.
Where further assurance is required, Walnut may provide summaries of security audits or certifications upon request.
Any on-site inspections must be pre-agreed and conducted under confidentiality obligations.

11. Termination and Deletion

Upon termination of the services, Walnut will delete or return all personal data processed on behalf of the Controller, unless retention is required by law.
Deletion will be confirmed in writing upon request.

12. Liability and Governing Law

This DPA is governed by the laws of England and Wales, and any disputes will be handled by the courts of that jurisdiction.

Walnut’s total liability under this DPA will not exceed the amounts paid by the customer for the relevant services during the 12-month period preceding the incident giving rise to the claim.

13. Contact

For all data protection matters, please contact:
Data Protection Officer
Walnut Learning Assistant Ltd
Email: support@walnutlearn.com
Registered in England and Wales, company number 16758083

By using Walnut Learning Assistant, you agree to the terms of this Data Processing Agreement.