Data Processing Agreement
Description of Transfer
Security of Data

Terms and Conditions

Last updated: 25 October 2024

Introduction

  1. These terms tell you the rules for using our website www.bebras.uk (referred to as "this site").

  2. The site is for the UK Bebras Challenge (the “Challenge”) which is an annual computer science competition that encourages students and young people to learn about computational thinking. 

  3. If you would like these terms in another format (for example: audio, large print, braille) please contact info@bebras.uk

Who we are and how to contact us

This site is operated by the Raspberry Pi Foundation. We are a company limited by guarantee registered in England and Wales (company number: 06758215), and a charity registered in England and Wales (charity number: 1129409). Our registered address is 37 Hills Road, Cambridge, CB2 1NT, United Kingdom.  To contact us, please email info@bebras.uk.

By using this site you accept these terms

  1. IMPORTANT - Where you are a teacher, code club or scout leader, parent/guardian of a home-educated learner, or home education group leader who is registering as a Coordinator for young people to participate in the Challenge; you are agreeing to these terms on behalf of your School, Club, or Home-education group (the ‘Learning Group’).

  2. By using this site and/or participating in the Challenge, you confirm that you accept and will comply with these terms, including: 

    1. Our Privacy Policy

    2. UK Bebras Data Processing Agreement

  3. If you do not agree to these terms, you must not use this site or participate in the Challenge.

  4. Any new features or tools which are added to the current platform shall also be subject to the Terms.

  5. You can review the most current version of the Terms at any time on this page. We reserve the right to update, change or replace any part of these Terms by posting updates and/or changes to our website. It is your responsibility to check this page periodically for changes. Your continued use of or access to the site following the posting of any changes constitutes acceptance of those changes.

We may suspend or withdraw this site

  1. We do not guarantee that this site, or any content on it, will always be available or be uninterrupted. We may suspend or withdraw or restrict the availability of all or any part of this site for business and operational reasons. 

  2. You are also responsible for ensuring that all persons who access this site through your internet connection are aware of these terms of use and other applicable terms and conditions, and that they comply with them.

Protection of personal data

  1. If any personal data is provided to us as part of the Challenge then the terms of the Bebras Data Processing Agreement in the Annex shall apply.

  2. Please refer to our Privacy Policy for more information on how we will manage and process personal information.

You must keep your account details safe

  1. If you choose, or you are provided with, a user identification code, password or any other piece of information as part of our security procedures, you must treat such information as confidential. You must not disclose it to any third party.

  2. We have the right to disable any user identification code or password, whether chosen by you or allocated by us, at any time, if in our reasonable opinion you have failed to comply with any of the provisions of these terms of use.

  3. If you know or suspect that anyone other than you knows your user identification code or password, you must promptly notify us at info@bebras.uk.

How you may use material on this site

  1. The contents of this site are owned by us or, where content has been provided by third parties, by those third parties. The copyright in the material contained on this site belongs to us or our licensors. It is your responsibility to seek appropriate consent to re-use any contents of this site.

Do not rely on information on these site

  1. The content on this site is provided for general information only and is not intended to amount to advice on which you should rely. You must obtain professional or specialist advice before taking, or refraining from, any action on the basis of the content on this site.

  2. Although we make reasonable efforts to update the information on this site, we make no representations, warranties or guarantees, whether express or implied, that the content on this site is accurate, complete or up to date.

We are not responsible for websites we link to or third party information

  1. Where this site contains links to other sites and resources provided by third parties, these links and resources are provided for your information only. Such links should not be interpreted as approval by us of those linked websites or information you may obtain from them.

  2. We have no control over the contents of those sites or resources.

Our responsibility for loss or damage suffered by you

  1. To the extent permitted in law, we accept no liability for any loss or damage which may be suffered by you or by other parties as a direct or indirect result of using this site (including loss of profit, loss of opportunity, loss of business, and consequential loss).

  2. Please note that we only provide our site for domestic and private use. You agree not to use our site for any commercial or business purposes, and we have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity.

We are not responsible for viruses and you must not introduce them

  1. We do not guarantee that this site will be secure or free from bugs or viruses.

  2. You are responsible for configuring your information technology, computer programmes and platform to access this site. You should use your own virus protection software.

  3. You must not misuse this site by knowingly introducing viruses, trojans, worms, logic bombs or other material that is malicious or technologically harmful. You must not attempt to gain unauthorised access to this site, the server on which this site is stored or any server, computer or database connected to this site. You must not attack this site via a denial-of-service attack or a distributed denial-of service attack. By breaching this provision, you would commit a criminal offence under the Computer Misuse Act 1990. We will report any such breach to the relevant law enforcement authorities and we will cooperate with those authorities by disclosing your identity to them. In the event of such a breach, your right to use this site will cease immediately.

Rules about linking to this site

  1. You may link to our home page or pages within the site, provided you do so in a way that is fair and legal and does not damage our reputation or take advantage of it.

  2. You must not establish a link in such a way as to suggest any form of association, approval or endorsement on our part where none exists.

  3. This site must not be framed on any other site.

  4. If we notify you that we do not wish you to link to the site then you will cease to do so immediately.

  5. If you wish to link to or make any use of content on this site other than that set out above, please contact info@bebras.uk.

General

  1. No waiver of any term of these Terms shall be deemed a further or continuing waiver of such term or any other term, and Bebras or the Raspberry Pi Foundation’s failure to assert any right or provision under these Terms shall not constitute a waiver of such right or provision.

  2. If any provision of these Terms is found by a court or a regulator to be invalid or unenforceable the other provisions of the Terms will continue to apply.

  3. These terms, together with the Privacy Policy, constitute the entire Terms and supersede all previous agreements with Bebras or the Raspberry Pi Foundation relating to the use of the site.

 Which country's laws apply to any disputes?

  1. In the event of any dispute between you and us concerning these Terms, the laws of England and Wales will apply. If you wish to take court proceedings against us you must do so within England and Wales. However, if you reside elsewhere in the United Kingdom, or in a British Overseas Territory or Crown Dependency, then you may also bring proceedings where you reside.



Annex - Bebras Data Processing Agreement

  1. Parties

    1. This Data Processing Agreement (DPA) is between the Learning Group (as defined above) and the Raspberry Pi Foundation.

  1. Definitions

    1. Students means the learners participating in the Challenge.

    2. Student Data means the data provided by the Controller to the Processor as part of its use of the Platform as set out in Schedule 1.

    3. Coordinator means a teacher, code club or scout leader, parent/guardian of a home-educated learner, or home education group leader who is registering as a Coordinator for young people to register to participate in the Challenge.

    4. Controller means the Learning Group.

    5. For the purposes of this agreement, “Data Subject”, “Data”, “Personal Data” and “Personal Data Breach” shall have the meanings given to those terms in the UK Data Protection Legislation from time to time;

    6. Data Protection Legislation means any applicable UK Data Protection Legislation, European Union legislation relating to personal data, and all other internationally equivalent legislation and regulatory requirements relating to the use of Personal Data (including, without limitation, the Privacy and Electronic Communications (EC Directive) Regulations 2003);

    7. Data Subject Request means a request made by a Data Subject to exercise any right(s) of Data Subjects under Data Protection Legislation in relation to any of the Shared Personal Data or concerning the processing of such data;

    8. Platform means the Bebras website.

    9. Processor means Raspberry Pi Foundation.

    10. UK International Transfer Addendum means the International Data Transfer Addendum issued by the Supervisory Authority of the United Kingdom under s.119A(1) of the UK Data Protection Act 2018,  incorporated into this Data Sharing Agreement by reference.

    1. For the purposes of this DPA, the following words and expressions shall be defined as follows:

  1. Compliance with legislation

    1. The parties will comply with all applicable requirements of the Data Protection Legislation. This clause is in addition to, and does not relieve, remove or replace, a party's obligations under the Data Protection Legislation.

  1. Description of the Processing

    1. The parties agree that the table in Schedule 1 sets out the scope, nature and purpose of processing by the Processor, the duration of the processing and the types of Personal Data and categories of Data Subject.

  1. Obligations of the Controller

    1. The Learning Group agrees and warrants that it shall comply with the Data Protection Legislation and applicable data protection guidelines under which it operates.

  1. RPF agrees and warrants that it shall

    1. process that Personal Data only in accordance with the terms of this agreement or otherwise on the written instructions of the Controller, unless the Processor is required to do so by law in which case the Processor shall notify the Controller of this in advance (unless prohibited by law from doing so);

    1. implement appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data as set out in Part B of Schedule 1; 

    1. if required, assist the Controller, at the Controller’s cost, in responding to any request from a Data Subject;

    1. notify the Controller without undue delay on becoming aware of a Personal Data breach;

    1. if required to do so by the Controller (in writing) and acting reasonably, delete or return Personal Data and copies thereof to the Controller following termination of the agreement unless required by law to store the Personal Data.

  1. Indemnity

    1. The Learning Group indemnifies RPF for all liabilities, damages, and losses arising from a breach by the Learning Group of this DPA, or from the Learning Group’s failure to comply with any applicable laws, including the Data Protection Legislation.

  1. International Data Transfers

    1. The Standard Contractual Clauses are hereby incorporated into this DPA by reference. They shall be deemed to be executed on the same date as this DPA, and execution of this agreement shall be deemed to be the execution of the Standard Contractual Clauses. The information contained in Parts A and B of Schedule 1 to this agreement shall be deemed to be incorporated into Annex I and Annex II of the Standard Contractual Clauses.

    1. The Standard Contractual Clauses shall apply:

    1. where either Party transfers any Shared Personal Data that originated in the European Union (EU), or relates to data subjects located in the EU, to the other Party where that other Party is located outside the European Economic Area (EEA) and is located in a country that has not received a finding of adequacy from the European Commission; and

    1. as amended by the United Kingdom International Transfer Addendum, where either Party transfers any Shared Personal Data that originated in the United Kingdom, or relates to data subjects located in the United Kingdom, to the other Party where that other Party is located outside the United Kingdom and is located in a country that has not received a finding of adequacy from the UK Government.



Schedule 1

Part A: Description of Transfer

  1. Description of Transfer

Categories of data subjects

Coordinators and Students of the Platform

Categories of personal data transferred

Coordinator names, contact information, and the name of their Learning Group


Student names, gender, level, and the name of their Learning Group

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Transfer will initially happen on a once-off basis, however, the Controller may decide to make transfers on a continuous basis.

Nature of the processing

  1. To enable the Processor to administer the Bebras Challenge and the Coding Challenge, including, but not limited to, scoring the competitions.

  2. To enable the Processor to ask the Coordinators to participate in surveys relating to the Challenges.

  3. Research purposes.

  4. To enable the Processor to operate the Bebras website and to ensure that we understand how our site is used and to improve our website and ensure it is secure.

Purpose(s) of the data transfer and further processing

The administration, operation, and improvement of the Bebras Challenge and the Coding Challenge.

Period of data retention

For as long as required to achieve the purpose as determined by the Data Controller subject to legal obligations and applicable laws.


The Processor’s Retention Policy is set out in Section H of the Privacy Policy which shall apply in the absence of specific instructions from the Controller.

  1. Competent Supervisory Authority

The applicable supervisory authority is the United Kingdom’s Information Commissioner’s Office in all cases, other than those where the Party transferring the data is located in:

  • in the European Union, in which case the competent supervisory authority is the Data Protection Commission of the Republic of Ireland; or

  • in India, in which case the competent supervisory authority is the Indian Data Protection Board.


Part B: Technical and Organisational Measures to Ensure the Security of the Data

The Controller and Processor both undertake to have in place appropriate technical and organisational security measures to:

  1. prevent:

    1. unauthorised or unlawful processing of the Shared Personal Data; and

    2. the accidental loss or destruction of, or damage to, the Shared Personal Data.

  2. ensure a level of security appropriate to:

    1. the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage; and

    2. the nature of the Shared Personal Data to be protected.