1. About these terms

1.1 These School Terms govern how a school, group of schools or other education organisation buys and uses a licence to the Second Nature Learning platform.

1.2 Your Order Form, these School Terms and the Data Processing Agreement in Appendix 1 form a single contract between Second Nature Learning and the School (the “School Agreement”).

2. Key terms

Words in bold capitals have these meanings:

“AI Features” — parts of the Service that use generative AI or machine learning, such as the marking of written answers. “AI Content” is anything the AI Features take in or produce, including marks and feedback.

“Confidential Information” — information shared between the parties that a reasonable person would treat as confidential, whether or not it is labelled that way.

“Data Protection Laws” — every law on personal data that applies to the School Agreement, which may include UK GDPR together with the Data Protection Act 2018 (“UK GDPR”), the Privacy and Electronic Communications Regulations 2003, Regulation (EU) 2016/679 (“EU GDPR”) and comparable laws where the School is based.

“DPA” — the Data Processing Agreement in Appendix 1.

“Effective Date” — the date a Licence begins, as shown on the Order Form.

“Intellectual Property Rights” — copyright, database rights, design rights, trade marks, know-how and every other kind of intellectual property, in any country, whether registered or not.

“Licence” — each course the School has bought access to, for the number of students shown on the Order Form (for example, one Cambridge International AS & A Level course).

“Licence Period” — how long a Licence runs, as shown on the Order Form.

“Order Form” — the quote, order confirmation or renewal confirmation the School accepts, which records the Licences, student numbers, price and Licence Period.

“School” — the organisation named on the Order Form.

“Second Nature Learning”, “we”, “us” — the business that provides the Service under the name Second Nature Learning, [CONFIRM: business address], or a company that takes it over under section 12.3.

“Service” — the Second Nature Learning platform: its lessons, activities, assessments, teacher resources, downloads, AI Features and progress reporting, as we offer them over time.

“Terms of Use” — the Terms of Use that every individual user accepts.

“Trial” — free, time-limited access so the School can evaluate the Service.

“Users” — the students, teachers and staff the School allows to use the Service.

3. Providing the Service

3.1 Access. While the School keeps to the School Agreement, we will provide the Service for each Licence Period. The School may let its Users use the Service for the School’s own teaching and learning. This right is non-exclusive and cannot be transferred or sub-licensed.

3.2 Teachers and students. Each Licence is priced on the number of students shown on the Order Form. Teacher and staff accounts are unlimited and free.

3.3 School administrators. The School can nominate staff to manage its account, classes and Users. We may act on requests from those staff, and from other School staff who appear to have authority.

3.4 Support. Email support@secondnaturelearning.com. We aim to answer within one working day (UK time) and will fix faults in the Service as quickly as we reasonably can.

3.5 Changes. The Service will evolve — new content, better features, updates for syllabus changes. If we plan a change that would significantly reduce what the School receives, we will give reasonable notice, and the School may then cancel the affected Licence and get back a proportionate share of the fee for the time remaining.

4. Our commitments

4.1 Our warranties. We will:

1. provide the Service with reasonable skill and care;

2. use reasonable efforts to make sure the Service is secure, available and free of viruses and other harmful code; and

3. comply with Data Protection Laws and the DPA.

4.2 Disclaimer. Except as set out in these School Terms, we give no other warranty, express or implied, including as to fitness for a particular purpose, uninterrupted availability or particular exam results. AI marks and feedback are a teaching aid and are not official marks from any awarding body.

5. School obligations

5.1 What the School confirms. The School confirms that:

1. it is validly established in its country;

2. the information it gives us is accurate and complete, and it is entitled to share it with us;

3. the School and its Users will follow Data Protection Laws, the School Agreement and the Terms of Use;

4. it has, as controller, a lawful basis for sharing its Users’ personal data with us and for our processing of it as described in the DPA, and has given its Users (and, where needed, their parents or guardians) any notices and obtained any consents that Data Protection Laws require; and

5. neither it nor anyone who owns or controls it is subject to UK, EU, UN or US sanctions, and it will not use the Service in a way that breaks sanctions or export rules.

5.2 Acceptable use. The School will not, and will make sure its Users do not: copy, adapt, reverse engineer or decompile the Service; use it unlawfully or in breach of anyone’s rights; probe or test its security without our written agreement; access it other than through our interfaces; share logins or give access to anyone who is not a User; redistribute downloaded materials outside the School; or use any of our content to train or operate an AI system. We may suspend any User who breaches the School Agreement or whose use we reasonably believe puts the security or running of the Service at risk, and we will tell the School promptly when we do.

5.3 Accounts. The School is responsible for deciding who is a User, for removing Users who leave, and for keeping administrator accounts secure.

6. Fees and payment

6.1 Price. The price for each Licence is set out in the Order Form. Prices exclude VAT, sales tax and any other taxes, which will be added where they apply. If the School must withhold tax from a payment, it will pay an extra amount so that we receive the full amount we would have received without the withholding.

6.2 Invoicing. Each Licence Period is invoiced in full when it begins. For renewals, we will invoice once the last day for giving notice of cancellation has passed. Prices are in US dollars. We can invoice in US dollars, pounds sterling or euros, and the Order Form states the currency.

6.3 Payment terms. Invoices are payable by bank transfer, to the bank details shown on the invoice, within 30 days of the invoice date, unless the Order Form says otherwise. If the School gives us a purchase order number, we will quote it on the invoice (the purchase order’s own terms do not apply; see section 12.6). We may charge interest on late payments at 4% a year above the Bank of England base rate, or the statutory rate if higher. If an invoice is more than 30 days overdue and we have reminded the School in writing, we may suspend access until it is paid.

6.4 Student numbers and sign-up codes. For each Licence we issue single-use sign-up codes for the number of students in the Licence plus 10%, rounded up (for example, 33 codes for a Licence for 30 students). Each code lets one student create an account. If more students need access than the codes allow, the School adds seats to the Licence and we issue further codes. Added seats are charged at the Licence’s price per student, pro rata for the whole months left in the Licence Period, with any part month counted as a full month (so a seat added in the first month of the Licence Period is charged for the full 12 months). A seat whose code has been used comes back, as a new code, only if that student’s account is cancelled. If the School tells us an unused code has been lost, we will cancel it and replace it free of charge.

6.5 No refunds. Fees are not refundable, including if the School uses the Service less than expected or reduces its number of students during a Licence Period, except as set out in sections 3.5, 10.3 and 12.9.

6.6 Price changes. We may change our prices for a renewal by telling the School at least 60 days before the end of the current Licence Period. Any introductory discount applies only to the period stated in the Order Form.

7. Licence Period, renewal and Trial

7.1 Licence Period. Unless the Order Form says otherwise, each Licence Period is 12 months from the Effective Date.

7.2 Renewal. Unless the Order Form says otherwise, each Licence renews automatically for a further 12 months on the same terms, subject to section 6.6, unless the School gives written notice to cancel or to reduce student numbers at least 30 days before the end of the current Licence Period. We will remind the School at least 60 days before a renewal date.

7.3 Trial. We may offer the School a Trial, confirmed on an Order Form or by email. Unless agreed otherwise, Trial lasts 14 days and is free. We can end a Trial whenever we choose, and the warranties in section 4.1(a) and (b) do not apply to it. At the end of Trial, teacher accounts move to our free tier and students’ work is kept unless the School asks us to delete it.

8. AI Features

8.1 Use. The School and its Users may use the AI Features only for educational purposes and in line with any guidance we provide.

8.2 Accuracy. AI marking is a teaching aid and will sometimes be wrong. Teachers can review and override any AI mark, and AI Content should not be used as the only basis for a high-stakes decision about a student, such as a predicted grade or exam entry.

8.3 Data minimisation. We send our AI provider only the text of a student’s answer, the question and the marking material, together with a reference number that does not identify the student. We do not send names, email addresses, school names or class details. Our AI provider may not use our data to train its models. More detail is in our AI Statement and the DPA.

8.4 AI Content. AI Content relating to a student’s work is treated as “Your Work” under the Terms of Use.

9. Intellectual Property Rights

9.1 Our rights. We and our licensors own all Intellectual Property Rights in the Service, including the content, software, design and the Second Nature Learning name and logo. The School receives only the rights expressly granted in the School Agreement.

9.2 Work created by Users. The School and its Users keep ownership of the work Users submit (“Your Work” in the Terms of Use). We may use it only as set out in the Terms of Use and the DPA.

9.3 Downloads. Teachers may download, print and adapt teaching materials for use with the School’s own students during the Licence Period. Materials must not be shared outside the School or published, and the licence line printed on them must not be removed.

9.4 Feedback. We may use any feedback or suggestions from the School or its Users to improve the Service, without payment or attribution.

10. Confidentiality and data protection

10.1 Confidentiality. Each party will keep the other’s Confidential Information confidential, use it only for the purposes of the School Agreement, and not disclose it to anyone else without the other’s written consent.

10.2 Permitted disclosures. A party may disclose Confidential Information where required by law, regulation or a court or other authority, and to its professional advisers, insurers and service providers who need it and are bound by confidentiality duties.

10.3 Data protection. Each party will comply with Data Protection Laws. For personal data we process on the School’s behalf, the School is the controller and we are its processor, and the DPA applies. If we breach the DPA in a way that is material and is not put right within 30 days of written notice, the School may end the School Agreement and receive a pro-rata refund of prepaid fees for the unused part of the Licence Period.

10.4 Our own processing. We act as an independent controller only for limited purposes: managing the commercial relationship with the School’s contacts (for example, invoicing and account emails), keeping the Service secure, and producing aggregated, de-identified statistics about how the Service is used so we can improve it. These are described in our Privacy Notice. We will never sell personal data, use it for advertising, or build profiles of students for any purpose outside the Service.

10.5 Third-party services. If the School chooses to connect the Service to a third-party service (for example, a single sign-on provider or a learning management system), the School’s use of that service is between the School and that provider, and we are not responsible for that provider’s handling of data.

11. Liability

11.1 Excluded losses. Neither party is liable for any indirect or consequential loss, or for loss of profits, revenue, goodwill or anticipated savings, however it arises.

11.2 Cap. Each party’s total liability for everything relating to the School Agreement in any 12-month period is limited to the total fees paid and payable by the School under the School Agreement in the 12 months before the first event giving rise to the liability.

11.3 What is not limited. Nothing in the School Agreement limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for the School’s obligation to pay fees, or for anything else that cannot be limited by law.

12. General

12.1 Publicity. We will not use the School’s name or logo in our marketing without the School’s written permission.

12.2 Notices. Formal notices are given by email, to the contact named in the Order Form or, for us, to legal@secondnaturelearning.com.

12.3 Transfer. The School may not transfer the School Agreement without our written consent. We may transfer it to a company that we control or that takes over the Second Nature Learning business, provided we tell the School and the transfer does not reduce the School’s rights. Otherwise we need the School’s consent.

12.4 Subcontractors. We may use subcontractors and sub-processors to provide the Service, as set out in the DPA, and remain responsible for them.

12.5 Whole agreement. The School Agreement sets out everything agreed about the Service and overrides earlier discussions, proposals and agreements.

12.6 Order of precedence. If there is a conflict, the DPA takes priority on data protection matters; otherwise the Order Form takes priority over these School Terms. Terms in a purchase order or other School document do not apply, even if we accept the purchase order.

12.7 Waiver and severance. A delay in enforcing a right is not a waiver of it. If any provision is found to be unenforceable, the rest of the School Agreement continues in effect.

12.8 Surviving provisions. Provisions that by their nature should survive the end of the School Agreement, including those on Intellectual Property Rights, confidentiality, data protection, liability and payment of fees due, will survive.

12.9 Events outside a party’s control. Neither party is liable for delay or failure caused by events outside its reasonable control. If such an event stops us providing the Service for more than 30 consecutive days, the School may end the affected Licence and receive a pro-rata refund.

12.10 Changes to these School Terms. We may update these School Terms. Changes apply from the next renewal of a Licence, unless the School agrees to them earlier or they are needed to comply with the law. We will tell the School about changes at least 60 days before they apply.

12.11 Third-party rights. No one other than the parties has any right to enforce the School Agreement.

13. Law and disputes

13.1 The School Agreement is governed by the law of England and Wales.

13.2 The parties will first try to resolve any dispute by good-faith discussion between senior contacts for at least 30 days. If it is not resolved, the courts of England and Wales have exclusive jurisdiction.

Appendix 1 — Data Processing Agreement

1. Scope

1.1 This DPA is incorporated into the School Agreement and covers personal data that we process on behalf of the School in providing the Service (“School Personal Data”).

1.2 The School is the controller of School Personal Data and we are its processor. The School instructs us to process School Personal Data as described in Sub-appendix 1 to provide the Service.

1.3 Terms such as “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “supervisory authority” have the meanings given in Data Protection Laws.

2. School obligations

The School will:

1. make sure it has a lawful basis for the processing, and keep a record of it;

2. give data subjects the information Data Protection Laws require, including about our role as its processor;

3. only share with us the personal data needed for the Service;

4. tell us about any personal data it knows to be inaccurate and cannot correct itself through the Service; and

5. comply with Data Protection Laws.

3. Our obligations

3.1 We will:

1. process School Personal Data only on the School’s documented instructions (including this DPA and the School’s use of the Service), unless the law requires otherwise, in which case we will tell the School first unless the law prohibits it;

2. tell the School straight away if we believe an instruction breaks Data Protection Laws;

3. make sure everyone authorised to process School Personal Data is bound by a duty of confidentiality and has been trained in data protection;

4. put in place the technical and organisational security measures in Appendix 2;

5. refer to the School any request we receive from a data subject, and help the School, by appropriate technical and organisational measures, to respond to requests to exercise data subjects’ rights (including access, correction, deletion and data portability);

6. help the School meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to us; and

7. never sell School Personal Data, use it for advertising or marketing to students, or use it to build profiles of students for any purpose other than providing the Service to the School.

3.2 Information and audits. Once a year, or after a personal data breach, and on at least 14 days’ written notice, we will make available to the School the information reasonably needed to show that we comply with this DPA — normally by answering a reasonable security and privacy questionnaire and providing our current policies. If that is not enough to show compliance, we will allow and contribute to an audit by the School or an independent auditor it appoints who is bound by confidentiality, at the School’s cost and at a mutually agreed time.

4. Personal data breaches

4.1 If we discover a personal data breach involving School Personal Data, we will tell the School in writing promptly, and no later than 48 hours after we discover it.

4.2 The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the steps we have taken or propose to take to deal with the breach and reduce its effects. We will update the School as more information becomes available.

4.3 We will help the School meet its obligations to notify the supervisory authority and data subjects. We will not notify data subjects of a breach affecting School Personal Data without the School’s agreement unless the law requires it.

5. Sub-processors

5.1 The School gives us general authorisation to engage sub-processors to help provide the Service. Our current sub-processors are listed at secondnaturelearning.com/legal/subprocessors.html.

5.2 We will impose on each sub-processor, by written contract, data protection obligations that give at least the same level of protection as this DPA. We remain fully liable to the School for our sub-processors’ performance.

5.3 We will tell the School at least 30 days before adding or replacing a sub-processor (by email to its administrators). Within that time the School may raise a reasonable data protection objection, which we will work through together; if we cannot resolve it, the School may end the affected Licence and receive a pro-rata refund of prepaid fees for the unused period.

6. International transfers

6.1 Some of our sub-processors process data outside the UK and the European Economic Area, as shown on the sub-processor list.

6.2 We will only transfer School Personal Data outside the UK or EEA under a transfer safeguard recognised by Data Protection Laws, for example an adequacy decision or adequacy regulations (including the UK–US Data Bridge and EU–US Data Privacy Framework, for certified recipients), the EU standard contractual clauses, or the UK International Data Transfer Agreement or Addendum, with any supplementary measures needed.

7. Return and deletion

7.1 When the School Agreement ends, the School may export or ask for a copy of its School Personal Data (for example, students’ results) within 60 days.

7.2 After those 60 days we will delete School Personal Data from the live Service, and it will be removed from our backups within a further [CONFIRM: 30] days, unless the law requires us to keep it. On request we will confirm deletion in writing.

7.3 We may keep system and security logs, which may contain limited personal data such as user IDs and IP addresses, for up to 12 months to keep the Service secure, after which they are deleted.

7.4 The School can delete an individual User, or ask us to, at any time during the Licence Period.

8. Costs

We will help the School under this DPA at no extra charge, except that we may charge a reasonable fee for help that is manifestly excessive or for on-site audits.

9. Liability and law

9.1 Each party’s liability under this DPA is subject to the limits in section 11 of the School Terms.

9.2 The governing law and jurisdiction provisions of the School Terms apply to this DPA, except where Data Protection Laws or a transfer mechanism require otherwise.

9.3 This DPA continues for as long as we process School Personal Data.

Sub-appendix 1 — Details of processing

Appendix 2 — Technical and organisational security measures

We maintain at least the following measures. A fuller description is in our Information Security Overview.

1. Encryption. All traffic to and from the Service is encrypted in transit using HTTPS/TLS. Databases and file storage are encrypted at rest by our hosting provider.
2. Access control. Users only see the data their role allows. This is enforced in the database itself by row-level security, not just in the user interface. Teachers see only their own classes; students see only their own work.
3. Staff access. Access to production systems and School Personal Data is limited to a very small number of authorised people, protected by strong, unique passwords, and used only for support, maintenance or security.
4. Data minimisation. We collect only what the Service needs. AI marking receives the answer text and a random reference only.
5. Secrets. API keys and credentials are held server-side and never sent to browsers.
6. Downloads. Teaching materials are held in private storage and delivered through short-lived signed links.
7. Passwords. User passwords are stored only as salted hashes by our authentication provider. A minimum password length applies.
8. Abuse protection. Rate limits apply to marking and other sensitive endpoints, and AI spending is monitored with alerts.
9. Backups and resilience. The database is backed up automatically by our hosting provider. [CONFIRM: backup frequency and retention on your plan]
10. Vulnerability management. We review the Service’s security, including access rules and endpoints, before releasing changes and keep dependencies up to date.
11. Incident response. We have a written incident response procedure, including notifying affected Schools within 48 hours of becoming aware of a personal data breach.
12. Sub-processors. We choose sub-processors with recognised security programmes and bind them by written data protection terms.

Questions about this document? Email legal@secondnaturelearning.com.  Back to the Legal hub