END-USER LICENCE AGREEMENT FOR MONITORING SYSTEMS PROVIDED BY CEM (CENTRE FOREVALUATION AND MONITORING)
THIS AGREEMENT (THE “AGREEMENT”) IS MADE BETWEEN THE END USER OF THIS SOFTWARE (THE
“CLIENT”) AND THE CHANCELLOR, MASTERS AND SCHOLARS OF THE UNIVERSITY OF CAMBRIDGE
ACTING THROUGH ITS DEPARTMENTS THE UNIVERSITY OF CAMBRIDGE LOCAL EXAMINATIONSSYNDICATE OF THE TRIANGLE BUILDING SHAFTESBURY ROAD CAMBRIDGE CB2 8EA, AND
CAMBRIDGE UNIVERSITY PRESS OF THE UNIVERSITY PRINTING HOUSE, SHAFTESBURY ROADCAMBRIDGE CB2 8BS (THE “CENTRE FOR EVALUATION AND MONITORING” OR “CEM”).
WHEREAS:
A. By placing an order ("Order"), the Client agrees to purchase a licence from CEM to use one ormore of the assessment and monitoring systems belonging to CEM to facilitate computerbased assessment including (if applicable):i.

any associated software components, media, printed materials, and "online" orelectronic documentation which will be administered by the Client in the form of atest that are the subject of the Order (henceforth referred to as the “Assessment”);
and

ii.

access to online or downloadable analysis of assessment data and other data provided
by the Client, including additional guidance material that are the subject of the Order(henceforth referred to as the “Reports”).

B. The Assessment will include one or more of either:i.

ASPECTS, BASE, PIPs Baseline, PIPS and/or InCAS (a “Primary Product”)

ii.

MidYIS, Yellis (a “Secondary Product”)

iii.

Alis, CEM IBE (a “Post-16 Product”)

as replaced by updated versions of the Assessment developed by CEM from time to time after
the Agreement Start Date.
C. On the terms set out in this Agreement, CEM agrees to grant a licence ("Licence") to the Client
to install or access online the systems that are the subject to the Order ("Systems") including
the relevant Assessment and Reports.
D. In placing an Order with CEM for any of CEM’s Systems, the Client understands that in doing
so, the Client enters into a legally binding contract with CEM in respect of theLicence. Incorporated into this Agreement are the terms of the Order.
TERMS AND CONDITIONS OF LICENCE:
1. Where the Assessment purchased by the Client is a Primary Product, Secondary Product or
Post-16 Product:
(a)

(b)

this Agreement shall be entered into by the Parties on the placing by the Client of an
Order to use one of CEM’s Systems and accepting this Agreement as prompted upon
the purchase (“Agreement Start Date”);
access to the System that is the subject of the Order shall commence as stated on
https://www.cem.org/costs-registration-forms;

CEM Monitoring Systems End User Licence Agreement 1st March 2021

(c)this Agreement shall commence on the Agreement Start Date and shall remain in fullforce and effect indefinitely, unless terminated earlier in accordance with theprovisions of Clause 25 herein, or unless either Party gives written notice to the otherParty, not later than 1 February in any calendar year (“Year of Termination”), toterminate this Agreement. If either Party gives notice to terminate this Agreement inaccordance with this Clause 1(c), the Client will remain entitled, subject to the terms
and conditions of this Agreement, to access and use the Assessment made available
on the System in the immediately preceding, consecutive 12-month period ending on
the last day of February in the Year of Termination until the last day of December inthat same year. For the avoidance of doubt, the Client will not, under the terms of thisAgreement, have access and be able to use any other versions of the Assessment
which CEM might make available on the System following the last day of February in
the Year of Termination. If either Party has given notice to terminate this Agreementin accordance with this Clause 1(c), this Agreement shall terminate without the needfor further notice on the last day of December in the Year of Termination.

2. CEM reserves the right to perform credit checks on the Client at any point before or after the
Agreement Start Date (as may be applicable). Should the credit check on the Client not be, in
CEM’s sole opinion, favourable, CEM shall be entitled to terminate the Agreement withimmediate effect upon notice in writing to the Client if the Agreement has already commenced.
3. CEM hereby grants to the Client the right to install and use multiple copies of the Assessment
only on such of the Client’s computers that are running validly licensed copies of the operating
system for which the Assessment was designed.
4. CEM hereby grants to the Client the right to access online or download multiple copies of theReports for use by the Client, in accordance with the terms of this Agreement.
5. CEM agrees to provide the Assessment and Reports as detailed in the Client’s Order inaccordance with the terms and conditions of this Agreement. CEM will use its reasonableendeavours to ensure that the Assessment is provided under the best care, skill and diligenceand in accordance with best industry practice as outlined by the guidelines of the British
Educational Research Association (BERA), and in accordance with CEM’s ethical researchframework, and in accordance with all applicable laws and regulations, and in consultation with
the Clients.
6. In consideration of the rights granted to the Client hereunder, the Client undertakes and agrees
to make payment to CEM of the Licence Fee, within thirty (30) days of the date of receipt of an
invoice. The Client will be obliged when placing the Order to provide an estimate of thenumber of pupils who will sit the Assessment. The Client will be given an opportunity before
CEM issues its invoice to revise the estimate within the Order downwards by up to 20% or
upwards (without limit). The Client must give prompt written notice of any such revision onreceiving CEM’s request for confirmation of the relevant number of pupils. In the event thatthe number of pupils actually sitting an Assessment is higher than the estimated number of
pupils, the Client accepts that the Licence Fee will be calculated based on the actual numberof pupils sitting the Assessment. In the event that the number of pupils actually sitting an
Assessment is lower than the estimated number of pupils, the Licence Fee will be calculated
based on the estimated number of pupils in the Order (as revised by any notice given by the
Client in accordance with this clause 6). In the event that no pupils sit the Assessment, theLicence Fee will be calculated based on the estimated number of pupils in the Order (as revised

CEM Monitoring Systems End User Licence Agreement 1st March 2021

by any notice given by the Client in accordance with this clause 6), subject however to theterms of clause 25 if this occurrence is due to the termination of this Agreement. In the eventof (a) late payment or non-payment of the Licence Fee or other sums payable by the Client
under this Agreement or (b) any other material breach of this Agreement, and without
prejudice to any other right or remedy CEM may be entitled to, CEM may: (i) seek the remedies
under the Late Payment of Commercial Debts (Interest) Act 1998; and/or (ii) immediately
terminate this Agreement by giving notice in writing to the Client, including, but not limited to,the termination of the Client’s access to the Reports or the provision of Assessments.
7. CEM may increase the Licence Fee with effect from 1 March in any calendar year, provided
that CEM gives the Client not less than 60 days’ notice of the proposed change (which notice
will be posted on CEM’s website).
8. Where an Order expresses that a System, Assessment or Report is a trial, the Client shall notneed to pay a Licence Fee. CEM shall be entitled to utilise any data submitted by the Client in
the process of using the trial for the purpose of improving, amending, assessing, analysing,creating and otherwise for the purpose of offering the System, Assessment or Report. During
a trial, the Client accepts that the System, Assessment or Report is not a finished product andis not a “sale of goods or services”, and therefore no implied terms under the Sale of Goods
and Services Act 1982 shall apply.
9. The Client acknowledges and agrees that any and all Intellectual Property Rights held in the
System, Assessment and Reports including but not limited to all copyright therein (the “CEM
IPR”), are and shall remain the sole and exclusive property of CEM. The Client may not
reproduce or use the CEM IPR other than as set out in this Agreement or as specified in writingby CEM. For the purposes of this Agreement "Intellectual Property Rights" means all patents,rights to inventions, copyright and related rights, trade marks, business names and domainnames, rights in get-up, goodwill and the right to sue for passing off or unfair competition,rights in designs, rights in computer software, database rights, rights to use, and protect theconfidentiality of, confidential information (including know-how) and all other intellectual
property rights, whether registered or not, which subsist or will subsist now or in the future inany part of the world.
10. CEM provides the Client with a non-exclusive, non-transferable, revocable, royalty-free licence,
without the right to sub-licence, to use the CEM IPR during the term of this Agreement for the
purposes set out herein.
11. CEM shall at its own expense obtain written permission for the inclusion of any copyrightmaterial in the Assessment or Reports and shall be responsible for the payment of all fees
charged for the use of such material subject to copyright.
12. CEM warrants to the Client that the Intellectual Property Rights in the Assessment and Reports,
so far as it is aware and to the best of its knowledge and belief, do not infringe the rights ofany third party and that no third party has threatened or is currently threatening proceedings
in respect of such infringement, and none of its Intellectual Property Rights in the Assessment
or Reports is the subject of any actual or, so far as it is aware, threatened challenge, opposition
or revocation proceedings.
13. The Parties agree at all times to handle personal information of the candidates strictly inaccordance with the Data Protection Legislation which for the purposes of this Agreementmeans the Data Protection Act 2018, the Regulation EU/2016/679 of the European Parliament

CEM Monitoring Systems End User Licence Agreement 1st March 2021

and of the Council of 27 April 2016 (the General Data Protection Regulation) and all applicablelaws and regulations relating to processing of personal data and privacy including whereapplicable the guidance and codes of practice issued by the Information Commissioner. Each
Party shall have the rights and obligations subscribed to it under the Data Sharing Schedule 1
set out below.
14. Both Parties will act as Data Controller in respect of any personal data entered into the Systemor otherwise supplied to CEM for the purpose of this Agreement and will do so in accordancewith the terms of the Data Sharing Schedule 1.
15. Both Parties agree they are responsible for ensuring they have a lawful basis for sharing any ofthe personal data provided to CEM as part of the System.
16. The Client hereby acknowledges that CEM is subject to the requirements of the Freedom ofInformation Act 2000 (“FOIA”), the Environmental Information Regulations 1992 (“EIR”) or any
other applicable legislation or codes governing access to information (together, “Information
Legislation”) and the Client agrees to assist and co-operate with CEM (at their own expense)to enable CEM to comply with these information disclosure requirements. Further, in the eventthat the Client is also subject to Information Legislation, CEM agrees to assist and co-operatewith the Client (at their own expense) to enable the Client to comply with these information
disclosure requirements. In the event that the Client receives an information disclosure
request regarding CEM or any information the Client holds arising out or in connection withthis Agreement, the Client shall promptly notify CEM with details of the request and shall take
CEM’s representations into consideration while deciding the response to that particular
request. Any disclosure made by either Party pursuant to such Party’s obligations under theprovisions of Information Legislation, shall not constitute a breach of this Agreement. CEM
shall not be liable for any loss, damage, harm or other detriment however caused arising fromthe disclosure (pursuant to the obligations of Information Legislation) of any information
relating to this Agreement or the Client. The provisions of this clause 16 shall apply during thecontinuance of this Agreement and indefinitely after its expiry or termination.
17. The following sets out the entire financial liability of CEM to the Client, save as set out in Clause
18, in respect of any breach by CEM of this Agreement, non-performance or incomplete
performance or contemplated performance by CEM of this Agreement, negligence for which
CEM is liable, and any representation or statement arising under or in connection with thisAgreement or by or on behalf of CEM:(a) in respect of all other losses and claims, the aggregate liability of CEM for any breach,negligence and/or liability arising in any other way out of the subject matter of thisAgreement or the performance of the Assessment will not exceed in total the amounts
actually received by CEM from the Client for the licence of the Assessment software
under this Agreement; and(b) CEM shall in no circumstances be liable for any loss of profits, loss of business or
production, depletion of goodwill, loss of or corruption to data, and/or any other indirectloss.
18. CEM will in no event be liable for any statement or representation about the Client, theirbusiness, products or services made or communicated in or by any item, material or work
approved by the Clients in writing.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

19. For clarity, nothing in this Agreement limits or excludes either Party’s liability for death or
personal injury caused by such Party’s negligence or any fraud or for any sort of liability thatby law cannot be limited or excluded.
20. The Client undertakes that under no circumstance shall the Client:(a) copy, reproduce or create derivative works from the System, Assessment and/or Reports;(b) provide access to the System and/or Assessment to any a third party, other than as
contemplated under this Licence, without the express written permission of CEM.
(c) provide access to or share the Reports with any third party other than as contemplated
under this Licence. It is acknowledged and agreed by CEM that the Client shall be allowed
to share the Reports with third parties with whom it is strictly necessary in order to allow
the Client to make full use of the Reports as contemplated under this Agreement, whichshall include, but not be limited to bodies representing parents, local authorities, theClient’s parent company/trust, external inspectors and education consultants employedby the Client;(d) sublicense, rent, sell or lease any portion of the System, Assessment and/or Reports;(e) alter, modify, disassemble, reverse engineer all or any part of the System, Assessment
and/or Reports;(f) translate, merge, adapt or modify all or any part of the System, Assessment, and orReports;(g) infringe CEM’s Intellectual Property Rights or those of any third party in relation to theiruse of the System, Assessment and/or Reports;(h) use the System, Assessment and/or Reports in a way that could damage, disable,
overburden, impair or compromise CEM’s systems or security or interfere with otherusers; nor(i) use the System, Assessment and/or Reports in any manner not authorised by theseterms.
21. The Client hereby acknowledges that certain elements of the System, Assessment and Reports
may at any time be in the process of being developed and CEM does not guarantee access on
demand. The System, Assessment and/or Reports may subsequently be substantially modified
or withdrawn at the sole discretion of CEM.
22. The Client’s installation and use of the System, Assessment and/or Reports is at the Client’ssole discretion and risk and may produce unintended or erroneous results and may containbugs, errors and other problems that could cause system or other failures and data loss. The
Client accepts that the System, Assessment and/or Reports are provided to the Client "as is"without any warranty, and CEM expressly disclaims any and all warranties, including, but notlimited to, warranties of merchantability, fitness for a particular purpose or error free
operation.
23. CEM is not obligated to provide updates to the System, Assessment and/or Reports. However,in the event CEM elects in its sole discretion to provide updates to the System, Assessment
and/or Reports, such updates shall be deemed to constitute part of the System, Assessment
and/or Reports and shall therefore be subject to these terms.
24. The Client warrants to CEM it shall at no point:

CEM Monitoring Systems End User Licence Agreement 1st March 2021

(a) take any action which is intended, or could reasonably be expected, to harm in any way
the reputation of CEM or any part of it; or(b) take any action which is intended, or could reasonably be expected to lead to any
unwanted or unfavourable publicity for CEM or any part of it.
25. In the period running from the date the Client placed the Order to the last day of the month ofFebruary immediately following that Order, the Client may terminate this Agreement at any
time by written notice to CEM and the following provisions shall apply:(a) If the Client terminates this Agreement not more than thirty (30) days from the date itplaced the Order and the installation and/or use by the Client of the Assessment has notcommenced during such period, the Client shall not be liable to make any payment to
CEM;(b) If the Client terminates this Agreement more than thirty (30) days but not more thansixty (60) days from the date it placed the Order and the installation and/or use by the
Client of the Assessment has not commenced during such period, the Client shall pay to
CEM a withdrawal fee of £50;(c) If the Client terminates this Agreement more than sixty (60) days from the date it placed
the Order or after the installation and/or use by the Client of the Assessment hascommenced, the Client shall pay to CEM the full price for the services ordered by it
pursuant to the Order or, where not specified in an Order, the appropriate CEM Price
List at https://www.cem.org/costs-registration-forms including the full Licence Fee;
Any payments to be made by the Client to CEM pursuant to this Clause 25 shall be made within
thirty (30) days of receipt by the Client of an invoice from CEM.
26. The Client shall:(a) comply with the anti-slavery policy of the University of Cambridge as set out at
http://www.registrarysoffice.admin.cam.ac.uk/governance-and-strategy/anti-slaveryand-anti-trafficking and as amended from time to time;(b) not engage in any activity, practice or conduct that would constitute an offence under
sections 1, 2 or 4 of the Modern Slavery Act 2015 if such activity, practice or conduct was
carried out in the UK;(c) include in all its contracts with its subcontractors and supplier’s anti-slavery and antihuman trafficking terms that are at least as onerous as those set out in this Clause 26;
and(d) promptly report to CEM any suspected or known slavery or human trafficking inconnection with the performance of this Agreement, any breach or potential breach ofthis Clause 26 or any breach or potential breach of CEM’s anti-slavery policy.
27. The Client represents that:(a) it, its officers and its employees have not been convicted of any offence under theModern Slavery Act 2015 or any equivalent offence in any jurisdiction involving slavery
and human trafficking;(b) neither it, its officers or its employees have been or are subject to any investigation,
inquiry or enforcement proceedings by any governmental, administrative or regulatory
body regarding any offence in any jurisdiction involving slavery or human trafficking; andCEM Monitoring Systems End User Licence Agreement 1st March 2021

(c) it has and shall maintain in place throughout the term of this Agreement its own policies,
training and procedures, to ensure compliance with Clauses 26, this clause 27, 28 and 29.
28. The Client shall ensure it performs adequate due diligence procedures for its direct
subcontractors and suppliers in connection with the performance of this Agreement, to ensure
there is no slavery or human trafficking in the contractual chain.
29. The Parties represent to one another that:(a) they have not committed any offence under the UK Bribery Act 2010 or done any of thefollowing (referred to hereafter as “Prohibited Acts”):(b) offered, given or agreed to give any Representative of the other Party any gift orconsideration of any kind as an inducement or reward for doing or not doing or for having
done or not having done any act in relation to the obtaining of performance of thisAgreement or any other agreement with the other Party or for showing or not showing
favour or disfavour to any person in relation to this Agreement or any other agreementwith the other Party; or(c) in connection with this Agreement paid or agreed to pay any commission other than apayment, particulars of which (including the terms and conditions of the agreement for
its payment) have been disclosed in writing to the other Party; and(d) they have in place adequate procedures to prevent bribery and corruption, as
contemplated by section 7 of the UK Bribery Act 2010.
30. In the event that any Court or other competent authority decides that any provision of thisAgreement is void or otherwise ineffective in whole or in part then any other part and the otherterms and conditions of this Agreement shall continue in full force and effect.
31. The Parties do not intend that any term of this Agreement shall be enforceable solely by virtueof the Contracts (Rights of Third Parties) Act 1999 by any person who is not a party to thisAgreement.
32. Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or
joint venture between the Parties, constitute any Party the agent of another Party, or authorise
any Party to make or enter into any commitments for or on behalf of any other Party.
33. CEM reserves the right to at any time assign or novate any or all of its rights and/or obligations
under this Agreement. The Client may only assign or novate any or all of their rights and/or
obligations upon written confirmation by CEM, which CEM shall not be obliged to approve.
34. CEM has the right to vary the terms of this Agreement from time to time on giving the Client
at least 60 days' notice in writing.
35. This Agreement constitutes the entire agreement between the Parties with respect to thesubject matter of this Agreement and supersedes all previous agreements, arrangements orundertakings between the Parties relating to the subject matter of this Agreement and any
representations or warranties previously given or made to it.
36. This Agreement is governed by and interpreted in accordance with English law. Any disputes
or claims relating to this Agreement shall be subject to the exclusive jurisdiction of the English
Courts.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

37. Any notice given to the Client by CEM under or in connection with this Agreement will beeffective if:(a) posted on CEM's website and/or in a prominent position on the System; or(b) sent to the Client at the address or email address given in the Order or such other address
as the Client may notify to CEM.
38. Any notice given by the Client to CEM under or in connection with this Agreement will beeffective if sent to one of the following addresses:
Address: The Triangle Building, Shaftesbury Road, Cambridge CB2 8EA; or
Email: Primary products - primary.support@cem.org
Secondary products - secondary.support@cem.org
Post 16 products - alis@cem.org
39. A notice is given by either party in accordance with Clause 37 or Clause 38 shall be deemed tohave been received:(a) if delivered by hand, at the time the notice is left at the address;(b) if sent from the UK by pre-paid first-class post or other next working day delivery service,
at 09.00am on the second working day after posting;(c) if sent by pre-paid airmail, at 09.00am on the seventh working day after posting; or(d) if sent by email, at the time of transmission provided that if this would occur outsidebusiness hours in the UK it shall be deferred until business hours resume.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

DATA SHARINGSCHEDULE 1
Data Controller to Data Controller
1. DEFINITIONS AND INTERPRETATION
1.1

In this Schedule 1, the following words have the following meanings:
Adequacy Decision: decision by the European Commission subject to article 45 GDPR.
Agreed Purposes: the purposes set out in the Annex to this Schedule;
Data Subject Request: means a request made by a Data Subject to exercise any rights ofData Subjects under Data Protection Legislation;
Data Protection Legislation: (as applicable) the Data Protection Act 2018; Regulation (EU)2016/679 (the “GDPR”); and any laws, regulations and/or secondary legislationtransposing the GDPR into English law or with similar subject matter, including any
successor legislation to the Data Protection Act 2018;
Data Sharing: the transfer of the Shared Personal Data;
EEA: European Economic Area.
Shared Data Breach: any security breach or other action or inaction leading to theaccidental or unlawful destruction, loss, alteration, unauthorised disclosure or access toShared Personal Data;
Shared Personal Data: any personal data shared between the Parties in connection with
the Agreement.
Standard Contractual Clauses: standard contractual clauses for the transfer of personal
data from the EEA to third countries (controller to controller transfers) as set out in theCommission Decision 2004/915/EC of 27 December 2004 amending Decision
2001/497/EC.

1.2

Where used in this Schedule 1, the terms Data Controller, Data Processor, Data Subject,
Personal Data and processing and Special Category Data all have the meanings given to
those terms in the Data Protection Legislation.

1.3

This Schedule 1 is intended to be legally binding and shall prevail over all otheragreements, arrangements and understandings between the Parties relating to the Data
Sharing, save for Schedule 2, whether made before or after the date of this Schedule 1
and notwithstanding any wording to the contrary in such agreements, arrangements andunderstandings between the Parties.

1.4

In case of any conflict or inconsistency between the provisions of this Agreement, thisshall be the order on precedence: Schedule 2; Schedule 1; main terms of the Agreement.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

1.5

A reference to a statute or statutory provision includes all subordinate legislation madeunder it from time to time, and is a reference to it as amended, extended or re-enacted
from time to time (“Replacement Law”). References to terms defined in a statute or
statutory provision shall be replaced with or incorporate (as the case may be) references
to the equivalent terms defined in any Replacement Laws, once in force and applicable.

1.6

To the extent that a term of this Schedule 1 requires the performance by a party of an
obligation “in accordance with Data Protection Legislation” (or similar), unless otherwise
expressly agreed in this Schedule 1, this requires performance in accordance with therelevant requirements of such Data Protection Legislation as is in force and applicable atthe time of performance (if any).

2.

PURPOSE

2.1

In relation to the Shared Personal Data, each of the Parties agrees that it is a Data
Controller.

2.2

During the term of this Agreement, the Parties shall share with each other certain Personal
Data. The Data Sharing is necessary to support the Agreed Purposes of both Parties.

2.3

The parties shall only use the Shared Personal Data for lawful purposes in connection with
the Agreed Purposes and not process the Shared Personal Data in a way that is
incompatible with the Agreed Purposes or Data Protection Legislation.

3. DATA PROTECTION COMPLIANCE
3.1

Each Party shall comply with all the obligations imposed on a controller under the Data
Protection Legislation. Any material breach of the Data Protection Legislation by a Partyin connection with the Data Sharing shall constitute a material breach of this Schedule 1.

3.2

Each Party shall:(a) process the Shared Personal Data fairly and lawfully, each of them as a Data
Controller;(b) for each Agreed Purpose, ensure that it processes the Shared Personal Data on thebasis of one of the legal grounds set out in Article 6 of the GDPR (Lawfulness ofProcessing) or Article 9 of the GDPR (Processing of special categories of personaldata) (as applicable);(c) inform, or otherwise make information available to the Data Subjects of the purposes
for which it will process Personal Data and provide or make available all informationthat it must provide in accordance with its own applicable law to ensure that Data
Subjects understand how their Personal Data will be processed by that Party;(d) ensure that it has in place appropriate technical and organisational measures toprotect against unauthorised or unlawful processing of Personal Data and against
accidental loss or destruction of, or damage to, Personal Data;(e) not transfer any personal data outside the European Economic Area otherwise thanin compliance with the Data Protection Legislation.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

4. COOPERATION BETWEEN THE PARTIES
4.1

Each Party shall assist the other in complying with all applicable requirements of the Data
Protection Legislation. In particular, in connection with the Shared Personal Data, eachParty shall:(a) ensure that any notices given to Data Subjects in relation to the Shared Personal Data
are provided in a manner and according to timing that is compliant with Data
Protection Legislation;(b) inform the other Party if any Personal Data has been transferred to the other Partyin error or otherwise in breach of the Data Protection Legislation, requesting theimmediate deletion of such inappropriately transferred Personal Data;(c) if legally required, inform the other Party about the receipt of a complaint or Data
Subject Request from any Data Subject regarding the Shared Personal Data;(d) deal at its discretion with all Data Subject Requests and complaints that it receives
directly from a Data Subject or the person making the complaint. For the avoidanceof doubt, a Data Subject Request made to one Party in its capacity as Data Controller
shall not oblige the other Party to disclose any Personal Data it holds independently
in its capacity as a Data Controller;(e) if legally required, inform the other Party without delay if a Data Subject requests theerasure of any Shared Personal Data. For the avoidance of doubt, where one Party is
obliged to erase any Shared Personal Data, the other Party shall not be obliged toerase the same Shared Personal Data if that other Party may lawfully continue to holdand process such Shared Personal Data;(f) provide reasonable and prompt assistance to the other Party as is necessary toenable it to comply with a Data Subject Request and/or to respond to any otherqueries or complaints received from Data Subjects or supervisory authorities orregulators and, in each case related to the Shared Personal Data;(g) provide the other Party with such information as the other Party reasonably requires
for maintaining the records it is required to maintain by the Data Protection
Legislation; and(h) provide the other Party with contact details of at least one employee as point ofcontact and responsible manager for all issues arising out of the Data Protection
Legislation, including the procedures to be followed in the event of a Shared Data
Breach.

5. DATA BREACHES
5.1

In respect of each Shared Data Breach, each Party shall:(a) promptly notify the other Party of the Shared Data Breach;

CEM Monitoring Systems End User Licence Agreement 1st March 2021

(b) provide the other Party without undue delay (wherever possible, no later than 48
hours after becoming aware of the Shared Data Breach) with such details as the otherParty reasonably requires regarding the Shared Personal Data.
5.2

To the extent permitted by applicable laws, neither Party shall:(a) notify a supervisory or regulatory authority of any Shared Data Breach;(b) issue a public statement or otherwise notify any Data Subject of such Shared Data
Breach,without first consulting with, and obtaining the consent (not to be unreasonably withheld
or delayed) of, the other Party.

6. DELETION OR RETURN OF SHARED DATA
6.1

Neither Party shall retain or process the Shared Personal Data for longer than is necessary
in connection with carrying out the Agreed Purposes.

6.2

Notwithstanding clause 6.1, the Parties shall continue to retain Shared Personal Data inaccordance with any statutory or professional retention periods applicable in theirrespective countries and/or industry.

7. INTERNATIONAL TRANSFERS
7.1

In the event that CEM transfers Shared Personal Data to the Client outside the EEA or thetransfer is not covered by an Adequacy Decision, both Parties shall be bound by theStandard Contractual Clauses as set out in Schedule 2 of this Agreement. If the Standard
Contractual Clauses contradict any other part of this Agreement, including its Schedules
and Annexes, the Standard Contractual Clauses shall prevail.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

Annex

1.

AGREED PURPOSES
For the purposes of this agreement, Agreed Purposes refer to the following purposes:(a)

CEM to provide the services under this Agreement to the Client;(b)

without prejudice to paragraph (a) above, CEM to (i) develop assessments and other CEM
services and improve on their quality and integrity, including the collection of statistics andother information relating to such assessments and other services for CEM’s future use and(ii) carry out marketing and market research, and provide training in order to improve on
the delivery of assessments and other services;(c)the Client to benefit from the services provided to it under this Agreement;(d)without prejudice to paragraph (c) above, the Client to offer, and enable pupils, to take
CEM’s assessments; and(e)the Parties to comply with their legal and regulatory obligations and to assist each other in
relation to any exercise by a pupil of their rights as a data subject.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSESTHIS SCHEDULE 2 ONLY APPLIES IN THE EVENT THAT CLIENT RECEIVES SHARED PERSONALDATA OUTSIDE THE EEA OR OUTSIDE A TERRITORY OR ORGANISATION NOT SUBJECTTO AN ADEQUACY DECISION BY THE EUROPEAN COMMISSION.

Standard contractual clauses for the transfer of personal data from the Community to
third countries (controller to controller transfers)
Data transfer agreement

betweenCEM
hereinafter “data exporter”
andThe Client
hereinafter “data importer”
each a “party”; together “the parties”.

Definitions
For the purposes of the clauses:(a)“personal data”, “special categories of data/sensitive data”, “process/processing”,“controller”, “processor”, “data subject” and “supervisory authority/authority” shall have thesame meaning as in Directive 95/46/EC of 24 October 1995 (whereby “the authority” shallmean the competent data protection authority in the territory in which the data exporter isestablished);(b)“the data exporter” shall mean the controller who transfers the personal data;(c)“the data importer” shall mean the controller who agrees to receive from the data
exporter personal data for further processing in accordance with the terms of these clauses
and who is not subject to a third country’s system ensuring adequate protection;(d)“clauses” shall mean these contractual clauses, which are a free-standing documentthat does not incorporate commercial business terms established by the parties under
separate commercial arrangements.
The details of the transfer (as well as the personal data covered) are specified in Annex B,
which forms an integral part of the clauses.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

I.

Obligations of the data exporter

The data exporter warrants and undertakes that:(a)
The personal data have been collected, processed and transferred in accordance withthe laws applicable to the data exporter.
(b)
It has used reasonable efforts to determine that the data importer is able to satisfy its
legal obligations under these clauses.
(c)
It will provide the data importer, when so requested, with copies of relevant dataprotection laws or references to them (where relevant, and not including legal advice) of thecountry in which the data exporter is established.
(d)
It will respond to enquiries from data subjects and the authority concerning processingof the personal data by the data importer, unless the parties have agreed that the data importer
will so respond, in which case the data exporter will still respond to the extent reasonably
possible and with the information reasonably available to it if the data importer is unwilling or
unable to respond. Responses will be made within a reasonable time.
(e)
It will make available, upon request, a copy of the clauses to data subjects who arethird party beneficiaries under clause III, unless the clauses contain confidential information,in which case it may remove such information. Where information is removed, the data
exporter shall inform data subjects in writing of the reason for removal and of their right todraw the removal to the attention of the authority. However, the data exporter shall abide by adecision of the authority regarding access to the full text of the clauses by data subjects, aslong as data subjects have agreed to respect the confidentiality of the confidential information
removed. The data exporter shall also provide a copy of the clauses to the authority whererequired.
II.

Obligations of the data importer

The data importer warrants and undertakes that:(a)
It will have in place appropriate technical and organisational measures to protect thepersonal data against accidental or unlawful destruction or accidental loss, alteration,
unauthorised disclosure or access, and which provide a level of security appropriate to therisk represented by the processing and the nature of the data to be protected.
(b)
It will have in place procedures so that any third party it authorises to have access tothe personal data, including processors, will respect and maintain the confidentiality andsecurity of the personal data. Any person acting under the authority of the data importer,
including a data processor, shall be obligated to process the personal data only on instructions
from the data importer. This provision does not apply to persons authorised or required by law
or regulation to have access to the personal data.
(c)
It has no reason to believe, at the time of entering into these clauses, in the existenceof any local laws that would have a substantial adverse effect on the guarantees provided forunder these clauses, and it will inform the data exporter (which will pass such notification on
to the authority where required) if it becomes aware of any such laws.
(d)
It will process the personal data for purposes described in Annex B, and has the legal
authority to give the warranties and fulfil the undertakings set out in these clauses.
(e)
It will identify to the data exporter a contact point within its organisation authorised torespond to enquiries concerning processing of the personal data, and will cooperate in good

CEM Monitoring Systems End User Licence Agreement 1st March 2021

faith with the data exporter, the data subject and the authority concerning all such enquiries
within a reasonable time. In case of legal dissolution of the data exporter, or if the parties haveso agreed, the data importer will assume responsibility for compliance with the provisions ofclause I(e).
(f)
At the request of the data exporter, it will provide the data exporter with evidence offinancial resources sufficient to fulfil its responsibilities under clause III (which may include
insurance coverage).
(g)Upon reasonable request of the data exporter, it will submit its data processing
facilities, data files and documentation needed for processing to reviewing, auditing and/or
certifying by the data exporter (or any independent or impartial inspection agents or auditors,
selected by the data exporter and not reasonably objected to by the data importer) to ascertain
compliance with the warranties and undertakings in these clauses, with reasonable notice andduring regular business hours. The request will be subject to any necessary consent orapproval from a regulatory or supervisory authority within the country of the data importer,
which consent or approval the data importer will attempt to obtain in a timely fashion.
(h)It will process the personal data, at its option, in accordance with:(i)orthe data protection laws of the country in which the data exporter is established,(ii)
the relevant provisions (1) of any Commission decision pursuant to Article 25(6)of Directive 95/46/EC, where the data importer complies with the relevant provisionsof such an authorisation or decision and is based in a country to which such anauthorisation or decision pertains, but is not covered by such authorisation or decision
for the purposes of the transfer(s) of the personal data (2), or(iii)

the data processing principles set forth in Annex A.

Data importer to indicate which option it selects: Option (iii), principles set forth inAnnex A.
Initials of data importer: Electronically accepted;(i)
It will not disclose or transfer the personal data to a third party data controller locatedoutside the European Economic Area (EEA) unless it notifies the data exporter about thetransfer; and(i)the third party data controller processes the personal data in accordance witha Commission decision finding that a third country provides adequate protection, or(ii)
the third party data controller becomes a signatory to these clauses or anotherdata transfer agreement approved by a competent authority in the EU, or

1“Relevant provisions” means those provisions of any authorisation or decision except for the enforcement
provisions of any authorisation or decision (which shall be governed by these clauses).
2
However, the provisions of Annex A.5 concerning rights of access, rectification, deletion and objection must
be applied when this option is chosen and take precedence over any comparable provisions of the Commission
Decision selected.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

(iii)
data subjects have been given the opportunity to object, after having been
informed of the purposes of the transfer, the categories of recipients and the fact thatthe countries to which data is exported may have different data protection standards,
or(iv)with regard to onward transfers of sensitive data, data subjects have given theirunambiguous consent to the onward transfer

III.

Liability and third party rights(a)Each party shall be liable to the other parties for damages it causes by any breach ofthese clauses. Liability as between the parties is limited to actual damage suffered. Punitive
damages (i.e. damages intended to punish a party for its outrageous conduct) are specifically
excluded. Each party shall be liable to data subjects for damages it causes by any breach of
third party rights under these clauses. This does not affect the liability of the data exporter
under its data protection law.
(b)
The parties agree that a data subject shall have the right to enforce as a third party
beneficiary this clause and clauses I(b), I(d), I(e), II(a), II(c), II(d), II(e), II(h), II(i), III(a), V, VI(d)and VII against the data importer or the data exporter, for their respective breach of theircontractual obligations, with regard to his personal data, and accept jurisdiction for thispurpose in the data exporter’s country of establishment. In cases involving allegations ofbreach by the data importer, the data subject must first request the data exporter to takeappropriate action to enforce his rights against the data importer; if the data exporter does nottake such action within a reasonable period (which under normal circumstances would be one
month), the data subject may then enforce his rights against the data importer directly. A data
subject is entitled to proceed directly against a data exporter that has failed to use reasonable
efforts to determine that the data importer is able to satisfy its legal obligations under theseclauses (the data exporter shall have the burden to prove that it took reasonable efforts).
IV.

Law applicable to the clauses

These clauses shall be governed by the law of the country in which the data exporter isestablished, with the exception of the laws and regulations relating to processing of thepersonal data by the data importer under clause II(h), which shall apply only if so selected by
the data importer under that clause.
V.

Resolution of disputes with data subjects or the authority(a)
In the event of a dispute or claim brought by a data subject or the authority concerning
the processing of the personal data against either or both of the parties, the parties will inform
each other about any such disputes or claims, and will cooperate with a view to settling them
amicably in a timely fashion.
(b)
The parties agree to respond to any generally available non-binding mediation
procedure initiated by a data subject or by the authority. If they do participate in theproceedings, the parties may elect to do so remotely (such as by telephone or other electronicmeans). The parties also agree to consider participating in any other arbitration, mediation orother dispute resolution proceedings developed for data protection disputes.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

(c)Each party shall abide by a decision of a competent court of the data exporter’s countryof establishment or of the authority which is final and against which no further appeal ispossible.
VI.

Termination(a)
In the event that the data importer is in breach of its obligations under these clauses,
then the data exporter may temporarily suspend the transfer of personal data to the data
importer until the breach is repaired or the contract is terminated.
(b)

In the event that:(i)the transfer of personal data to the data importer has been temporarilysuspended by the data exporter for longer than one month pursuant to paragraph (a);(ii)
compliance by the data importer with these clauses would put it in breach of its
legal or regulatory obligations in the country of import;(iii)
the data importer is in substantial or persistent breach of any warranties orundertakings given by it under these clauses;(iv)
a final decision against which no further appeal is possible of a competent courtof the data exporter’s country of establishment or of the authority rules that there has
been a breach of the clauses by the data importer or the data exporter; or(v)
a petition is presented for the administration or winding up of the data importer,whether in its personal or business capacity, which petition is not dismissed within theapplicable period for such dismissal under applicable law; a winding up order is made;a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if
the data importer is an individual; a company voluntary arrangement is commenced byit; or any equivalent event in any jurisdiction occurs then the data exporter, without
prejudice to any other rights which it may have against the data importer, shall beentitled to terminate these clauses, in which case the authority shall be informed whererequired. In cases covered by (i), (ii), or (iv) above the data importer may also terminate
these clauses.

(c)Either party may terminate these clauses if (i) any Commission positive adequacy
decision under Article 25(6) of Directive 95/46/EC (or any superseding text) is issued inrelation to the country (or a sector thereof) to which the data is transferred and processed by
the data importer, or (ii) Directive 95/46/EC (or any superseding text) becomes directly
applicable in such country.
(d)
The parties agree that the termination of these clauses at any time, in any
circumstances and for whatever reason (except for termination under clause VI(c)) does notexempt them from the obligations and/or conditions under the clauses as regards theprocessing of the personal data transferred.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

VII.

Variation of these clauses

The parties may not modify these clauses except to update any information in Annex B, inwhich case they will inform the authority where required. This does not preclude the parties
from adding additional commercial clauses where required.

VIII.

Description of the Transfer

The details of the transfer and of the personal data are specified in Annex B. The parties agree
that Annex B may contain confidential business information which they will not disclose to third
parties, except as required by law or in response to a competent regulatory or government
agency, or as required under clause I(e). The parties may execute additional annexes to coveradditional transfers, which will be submitted to the authority where required. Annex B may, inthe alternative, be drafted to cover multiple transfers.

Dated: start date of the Agreement.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

ANNEX ADATA PROCESSING PRINCIPLES

1.
Purpose limitation: Personal data may be processed and subsequently used or further
communicated only for purposes described in Annex B or subsequently authorised by the data
subject.
2.
Data quality and proportionality: Personal data must be accurate and, where
necessary, kept up to date. The personal data must be adequate, relevant and not excessive
in relation to the purposes for which they are transferred and further processed.
3.
Transparency: Data subjects must be provided with information necessary to ensure
fair processing (such as information about the purposes of processing and about the transfer),
unless such information has already been given by the data exporter.
4.
Security and confidentiality: Technical and organisational security measures must be
taken by the data controller that are appropriate to the risks, such as against accidental or
unlawful destruction or accidental loss, alteration, unauthorised disclosure or access,presented by the processing. Any person acting under the authority of the data controller,
including a processor, must not process the data except on instructions from the data
controller.
5.
Rights of access, rectification, deletion and objection: As provided in Article 12 of
Directive 95/46/EC, data subjects must, whether directly or via a third party, be provided withthe personal information about them that an organisation holds, except for requests which are
manifestly abusive, based on unreasonable intervals or their number or repetitive orsystematic nature, or for which access need not be granted under the law of the country of thedata exporter. Provided that the authority has given its prior approval, access need also not
be granted when doing so would be likely to seriously harm the interests of the data importeror other organisations dealing with the data importer and such interests are not overridden by
the interests for fundamental rights and freedoms of the data subject. The sources of thepersonal data need not be identified when this is not possible by reasonable efforts, or where
the rights of persons other than the individual would be violated. Data subjects must be able
to have the personal information about them rectified, amended, or deleted where it isinaccurate or processed against these principles. If there are compelling grounds to doubt thelegitimacy of the request, the organisation may require further justifications before proceeding
to rectification, amendment or deletion. Notification of any rectification, amendment or deletionto third parties to whom the data have been disclosed need not be made when this involves a
disproportionate effort. A data subject must also be able to object to the processing of thepersonal data relating to him if there are compelling legitimate grounds relating to his particularsituation. The burden of proof for any refusal rests on the data importer, and the data subject
may always challenge a refusal before the authority.
6.
Sensitive data: The data importer shall take such additional measures (e.g. relating tosecurity) as are necessary to protect such sensitive data in accordance with its obligations
under clause II.
7.
Data used for marketing purposes: Where data are processed for the purposes of
direct marketing, effective procedures should exist allowing the data subject at any time to“opt-out” from having his data used for such purposes.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

8.
Automated decisions: For purposes hereof “automated decision” shall mean a decisionby the data exporter or the data importer which produces legal effects concerning a data
subject or significantly affects a data subject and which is based solely on automatedprocessing of personal data intended to evaluate certain personal aspects relating to him,such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer
shall not make any automated decisions concerning data subjects, except when:(a)(i) such decisions are made by the data importer in entering into or performing
a contract with the data subject, and(ii) (the data subject is given an opportunity to discuss the results of a relevant
automated decision with a representative of the parties making such decisionor otherwise to make representations to that parties.

or(b)where otherwise provided by the law of the data exporter.

CEM Monitoring Systems End User Licence Agreement 1st March 2021

ANNEX B
DESCRIPTION OF THE TRANSFER

Data subjects
The personal data transferred concern the following categories of data subjects:
Students (including under 13 years old) and data subjects acting on behalf of the data exportersuch as employees or contractors.
Purposes of the transfer(s)The transfer is made for the following purposes
As set out in the Agreement/s between the parties.
Categories of data
The personal data transferred concern the following categories of data:
Full names, sex, identification numbers (such as candidate number), centre/school details,
exam details, candidate answers, contact details, native language, year group, date of birth,class name, place of birth, free school meals status, previous school, average GCSE score orsimilar, subject choices for A Level or other exam, test venue, application to other grammar
school, special arrangements and any other information that may be required in connection
with the purposes of the transfers.
Recipients
The personal data transferred may be disclosed only to the following recipients or categories
of recipients:
As per the agreement/s between the parties or otherwise as the parties see fit in accordancewith their own privacy policies and applicable legislation.
Sensitive data (if appropriate)
The personal data transferred concern the following categories of sensitive data:
Some special category data such as disabilities may be inferred by special arrangements.
Ethnic background may be processed as well.
Data protection registration information of data exporter (where applicable)
UK ICO registration number: Z6641083
Additional useful information (storage limits and other relevant information)
As set out in the agreements that govern the relationship between the parties.
Contact points for data protection enquiries
Data importer

Data exporter

As provided by data importer to data exporter as soon as the Licence is accepted
data.protection@cambridgeassessment.org.uk

CEM Monitoring Systems End User Licence Agreement 1st March 2021