Privacy Notice

Adobe

more information

Data Shared:
Name and email address, information about Adobe apps used, information about the device used.
Other information may be collected for the purposes of analytics.

In certain circumstances, Adobe may share student data with third party service providers as needed to perform services for Adobe or on Adobe’s behalf.

Sharing Basis: To allow students to use Adobe software for educational purposes.

Security Protocols: Adobe provides reasonable administrative, technical and physical security controls to protect the schools’ and students’ personal information and content.

Access Conditions: Supervised in class.
Access will be unsupervised during private study and home study.

Teacher Access: Adobe account administration for students is done by GTS

Server/Data Location: The main locations where we process your personal information are the US and India, but we also transfer personal information to all other countries in the world where our Services and Software are available.

Retention Period:
Customers may use the Adobe Admin Console to modify or delete Student Data throughout the term, including at the request of a Student, parent or legal guardian. It is the responsibility of Customer to delete or remove Student Data from the Services when it is no longer needed for an educational purpose and/or upon termination of an account or Customer’s agreement with Adobe.

Blooket

more information

Data Shared:
Blooket collects two types of information about:
1. Information that you voluntarily provide us by using the Blooket Service (described below under "Information you provide to us").
2. Information collected automatically as result of your use of the Service (described below under “Information collected automatically”).
Blooket does not sell or rent any personal information to any third party for any purpose including for advertising or marketing purposes. Blooket use the information they collect from users to provide them with the best Blooket experience.

Sharing Basis: Blooket is an application that allows a user such as a teacher to create trivia and review games that students can participate in online.

Security Protocols:
Blooket is committed to securing your personal information.
Ways in which they protect your personal information include:
• Encrypting your personal information when it is stored at rest.
• Protecting your personal information with encryption during transmission over the public Internet.
• Using reasonable organisational and technical safeguards designed to help protect the privacy and security of your personal information.

Access Conditions:
Blooket can be accessed by students in two ways:
1. As part of a lesson: a teacher will host and supervise a trivia game as part of their lesson.
2. Assigned as homework: a teacher can set an unsupervised Blooket quiz that needs to be completed in a set period. The link to this can be provided through a VLE such as Google

Teacher Access: Teaching staff are able to access the personal information collected by Blooket in order to monitor student progress.

Server/Data Location: Blooket operates both within and outside the European Economic Area (the “EEA”)

Retention Period: Blooket store personal information for as long as it is necessary to provide products and Services to their users, including those described above pursuant to our Data Retention Policy.

BOOST (Dynamic Learning) - Hodder Education

more information

Data Shared: School email address which includes full name of student / staff member

Sharing Basis: MFL - Listening, vocab tests, translations, assessments, ebook on screen.

Security Protocols:
Password protection.
Multiple levels of security allow elevated levels of control for maintenance personnel without compromising security.
Built-in safeguards to prevent “Denial of Service” (DoS) attacks and ID spoofing are provided by load-balancing devices and services which are managed by the Hachette IT team from the UK.
Annual UK CREST and CHECK certified penetration tests to audit the data security and compliance of Hodders systems and processes.

Access Conditions: Supervised in class.
Unsupervised during private study and home study.

Teacher Access: Yes to monitor/analyse and track progress.

Server/Data Location: UK

Retention Period: For the duration of the Subscription Period. Personal data will then be held until Licensee requests that it should be deleted.

Cambridge Go

more information

Data Shared: Identity Data which includes first name, last name, username or similar identifier.

Sharing Basis: Online platform to access CAIE subjects – Economics and Business Studies. Students can access course materials and online resources.

Security Protocols:
Appropriate security measures by CG to prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, access is limited to personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Procedures in place to deal with any suspected personal data breach.

Access Conditions: Supervised in class.
Unsupervised during private study and home study.

Teacher Access: Yes, to monitor/analyse and track progress.

Server/Data Location: Worldwide

Retention Period:
Only retained as long as necessary to fulfil the purpose it was collected for, including for the purpose of satisfying any legal, accounting or reporting requirements.
CG normally store information for at least one year following the last recorded transaction/interaction. The account will be closed after of a period of 12 months inactivity, provided there are no current subscriptions.

Canva

more information

Data Shared: Canva may ask for certain information when you register for an account (such as a username, your first and last names, birthdate, phone number, profession, physical and e-mail address

Sharing Basis: To allow students to use the Canva platform for educational purposes.

Security Protocols:
Canva uses appropriate safeguards to preserve the integrity and security of all information collected through the Service. To protect your privacy and security, we take reasonable steps (such as requesting a unique password) to verify your identity before granting you access to your account

Access Conditions: Supervised in class.
Access will be unsupervised during private study and home study.

Teacher Access: Teachers can access student work on Canva in order to view work completed

Server/Data Location: Information collected through the Service will be stored and processed in a number of countries including United States, Australia, Singapore, European Union, United Kingdom, Philippines and New Zealand.

Retention Period: Following termination or deactivation of a user account, Canva will retain an individual’s profile information and User Content for a commercially reasonable time, and for as long as we have a valid purpose to do so.

DESC Attendance

Data Shared: Name, School, Attendance data if less than 80%

Sharing Basis: Public interest + official authority of the DC

Security Protocols: Secure access or information sent by email password protected

Server/Data Location: EEA

Retention Period: As needed while resolving issues

DHSC Dental Survey

more information

Data Shared: Child’s name, date of birth

Security Protocols: Information sent password protected with the password sent via an alternative means of communication

Server/Data Location: EEA

Retention Period: Current year

DHSC School / Community Nurses

more information

Data Shared: Child's name, date of birth, current address, previous address, current school and previous school

Security Protocols: Information sent password protected with the password sent via an alternative means of communication

Server/Data Location: EEA

Retention Period: Current year

Doddle

more information

Data Shared: Student name, school year and classes they are enrolled in.

Sharing Basis: To assist in the teaching of MFL.

Security Protocols: Technical and organisational measures are used to safeguard each User’s personal data e.g.by storing personal data on secure servers.

Access Conditions: Unsupervised

Teacher Access: To track the learning progress of students

Server/Data Location: EU

Retention Period: For as long as we need to for the purposes for which it was collected

Dr Frost Maths

more information

Data Shared:
Students: name, email address, and encrypted password (the original of which is not retrievable by any individual, including administrators), year group (where specified), school name (where specified) and usage data, in terms of questions completed and summative accuracy data. No other personal information beyond name and email address are stored.
Teachers: the above data (in addition to their title), classes he/she administers.

Sharing Basis: For the setting and analysis of homework.

Security Protocols: Secure UK servers.
SSL encryption.

Access Conditions: Unsupervised (homework)

Teacher Access: Yes, setting and monitoring of homework.

Server/Data Location: UK

Retention Period: Data automatically deleted for Inactive accounts where the user has not logged in over 2 years.
Can be deleted sooner by teacher if needed.

Dynamic Learning

more information

Data Shared:
Data may include:
• contact details;
• age and date of birth;
• gender;
• ethnic origin;
• first language;
• unique pupil number;
• pupil premium information;
• assessments undertake and their results over a number of years;
• educational needs including SEN.

Sharing Basis: Dynamic Learning is used to assist with the teaching in a number of subject areas.

Security Protocols: Where appropriate, Dynamic Learning anonymise and pseudonymise the data they store. They use appropriate technological and operational security measures to protect data against any unauthorised access or unlawful use.

Access Conditions: Unsupervised

Teacher Access: Dynamic Learning is used to assist with the teaching in a number of subject areas.

Server/Data Location: UK

Retention Period: Dynamic Learning retain information for as long as is necessary to provide the services that have been requested.

employed.im

more information

Data Shared: Name, email, password. Information data subject supplies.

Sharing Basis: Public interest + official authority of the DC

Access Conditions: Supervised and unsupervised

Teacher Access: Limited access to enable placements

Server/Data Location: IOM

Retention Period: For as long as data subjects wish to use the services

Empowering Education International Limited (EEIL)

more information

Data Shared:
May include fields such as: title, first name, last name, position, contact information, location data, ID data, opinions, comments, viewpoints, discussions, student academic data, self-evaluation data, career intentions, disability, ethnicity/race, medical (health or learning difficulty) goods and services provided, and internet protocol address. Please note that Ethnicity/Race and Medical (Heath or Learning Difficulty) data are special category data and adequate safeguards are in place to address them.

Sharing Basis: Public interest + official authority of the DC

Security Protocols:
Tribal’s internal and customer hosting services are outsourced to our business partners (AWS, Microsoft and Rackspace) as applicable to the software services required. All three companies IT infrastructure is designed and managed in alignment with security best practices. Their compliance with international and industry-specific IT security standards is detailed in a series of control definition reports.

Access Conditions: No

Teacher Access: No

Server/Data Location: UK

Retention Period: Any personal data provided to EEIL will only be retained for the duration of the EEIL engagement with DESC.

EverLearner

more information

Data Shared: Name, password and email address.

Sharing Basis: To allow access to the platform and resources

Security Protocols: EverLearner has a variety of security measures in place to make sure that the personal information they hold is secure and that it does not become inadvertently available to other organisations or individuals.

Access Conditions: Supervised and unsupervised

Teacher Access: Yes – for the purposes of viewing work completed etc.

Server/Data Location: London, UK

Retention Period: 365 days after being archived

Evolve

more information

Data Shared: Name, contact details, trip information and risk assessments

Sharing Basis: Public interest + official authority of the DC

Security Protocols:
Advanced firewalls, enterprise-level virus protection on all servers, HTTPS encryption for all communication between our servers and users, regular data backup, username/password/PIN to control access, failed log-in attempt logging, automatic suspicious activity detection and logging

Server/Data Location: UK

Retention Period: Current year + 6 years

Facebook

more information

Data Shared: Photos, names

Security Protocols: Password protected,  Two-factor authentication.

Server/Data Location: Worldwide including the US

Retention Period: Current year

GL Assessment

more information

Data Shared:
Personal Data relating to the Student User includes (but is not limited to), name, address, date of birth, unique pupil number. Personal Data of Student Users is collected directly from them when they log in to take a test (name, date of birth and unique pupil number).

Sharing Basis: GL Assessments offer a range of assessments that schools can use to generate data that is, in turn, used to support student achievement.

Security Protocols:
GL Assessments have put in place procedures to deal with any actual or suspected Personal Data breach. In the event of any such breach, GL Assessment have systems in place to work with applicable regulators. In addition, in certain circumstances (including where we are legally required to do so), GL Assessment may notify you of breaches affecting your Personal Data.

Access Conditions: Supervised.

Teacher Access: Yes.

Server/Data Location: Personal Data that we collect from Users will not be stored at a destination outside the United Kingdom or the European Economic Area (“Europe”).

Retention Period: GL Assessment will keep Personal Data for as long as they need to for the purposes for which it was collected or (if longer) for any period for which they are required to keep Personal Data to comply with their legal and regulatory requirements.

GL Education Group

more information

Data Shared:
Student personal data, processed under instructions from school, including name, age, gender, unique pupil number, assessment results, observations about students’ performance in tests, the environment during tests and any other relevant information, for example, any illness of a student prior to testing, ethnic and socio-economic information enabling schools to understand particular needs and focus among specific ethnic or socio-economic groups.

Sharing Basis:
For the screening of dyslexia and dyscalculia to highlight and support students with dyslexic tendencies (Lucid), and literacy testing to monitor and maintain reading levels to ensure students can access the curriculum - New Group Reading Test (NGRT). These assessments and data are vital to support teachers seeking to demonstrate progress, close the attainment gap and ensure every student is maximizing their potential.

Security Protocols:
Access is only possible using an account login and password and all access attempted is logged in real time. The platforms’ infrastructure is protected by multiple firewalls that can only be accessed from the GL Education Group’s Technical Development office using a secure login and password made available only to the network administrator and a very small technical team.

Access to each customer account is only possible using the administrator password that is set by the school administrator. A test taker accessing the testing platforms will only be able to take any outstanding tests set for him or her. It is not possible for test takers to view their own test scores or the data and scores of any other test takers. Test taker access codes are created by the system and will be unique to each test taker. No member of the GL Education Group staff can routinely log into an organisation’s or test taker’s account on our platforms.

Access Conditions: Supervised

Teacher Access: Senior staff can directly access the website/data with the calculated results issued to teachers to assist in planning of lessons and educational interventions.

Server/Data Location: Within the United Kingdom or the European Economic Area.

Retention Period:
Data will be accessible for the duration of the current academic year, or the past six months, whichever is longest, at which stage all data is archived from live access.

Archived data will be deleted at regular intervals (typically 24 months) so it will only be held for the minimum time.

Google

Data Shared: No personal information should be stored on Google servers by staff apart from a name, class grouping, email address and information regarding work completed or to be completed

Sharing Basis: Public interest + official authority of the DC

Security Protocols: Google adheres to several self regulatory frameworks, including the EU-US Privacy Shield arrangement.

Access Conditions: No

Teacher Access: Limited to areas set up by staff such as Google Classrooms and shared areas

Server/Data Location: Worldwide including the US

Retention Period: DOB + 21 years or 3 years since the last log on

Integral

more information

Sharing Basis: Used for KS4 and KS5 mathematics.

ItsLearning

Data Shared: Name, class, school work

Sharing Basis: Public interest + official authority of the DC

Security Protocols: Username and password

Access Conditions: No

Teacher Access: Yes

Server/Data Location: EEA

Retention Period: End of Use + 12 months

Kahoot

Data Shared: Name, or nickname

Sharing Basis: To allow interactive and engaging assessment of learning in a quiz format

Security Protocols: Reasonable organizational, technical and administrative measures

Access Conditions: Supervised

Teacher Access: Yes - e.g. for quick formal assessment of topics etc

Server/Data Location: Worldwide

Retention Period: End of use + 12 months

Kerboodle

more information

Data Shared: Username and email address

Sharing Basis: To allow students and teachers to access the Kerboodle platform

Security Protocols:
Oxford University Press is committed to protecting your personal information and respecting applicable data protection laws around the world, including where applicable, the EU General Data Protection Regulations, the California Consumer Privacy Act (CCPA), the Children’s Online Privacy Protection Act (COPPA) and the Family Education Rights and Privacy Act (FERPA).

Access Conditions: Supervised in class. Access will be unsupervised during private study and home study.

Teacher Access: Yes, in order to share resources, set up groups and to view markbooks.

Server/Data Location: Personal information may be stored and processed outside of the country where it is collected, including outside of the European Economic Area.

Retention Period: Oxford University Press will only keep records of your personal information for as long as is reasonably necessary

Language Gym

more information

Data Shared: The only data inputted by the user is their login (could be first name/full name/student name of choice) and email.
If you register for our newsletter, the data requested from you will be sent to us.

Sharing Basis: To assist in the teaching of MFL.

Security Protocols: Any data gathered from users is stored in a highly secure server in Digital Ocean.

Access Conditions: Unsupervised. Subscribing as a school will entitle every teacher and student in your educational establishment to have access and use The Language Gym’s resources

Teacher Access: Yes, to track the learning progress of students.

Server/Data Location: For users in uk.language-gym.com, the servers and data are hosted in UK. For users in language-gym.com, the servers and data are hosted in Singapore

Retention Period: After completion of the contract, any necessary data will be stored for the duration of any applicable warranty period.

MathsPad

more information

Data Shared: Name, email, school name

Sharing Basis: In order to access resources that support learning

Security Protocols: In transit, data is secured with SSL/TLS encryption

Access Conditions: Supervised and unsupervised

Teacher Access: Yes

Server/Data Location: UK

Retention Period: Up to 3 years

Microsoft Teams

Data Shared:
Census data: AppName, DeviceModel, OSName, OSVersion, UserLanguage, UserID, DeviceID. Census data DOES NOT contain any information that identifies your organisation or users.

Usage data: includes information such as number of calls made, number of IMs sent or received, number of meetings joined, frequency of features used and stability issues. Usage data DOES NOT contain any information that identifies users.

Anyone in a team can see all members of a team, including guests

Sharing Basis: Public interest to assist with remote education during period of school closures.

Security Protocols: Teams enforces team-wide and organization-wide two-factor authentication, single sign-on through Active Directory, and encryption of data in transit and at rest. Files are stored in SharePoint and are backed by SharePoint encryption.

Access Conditions: Supervised and unsupervised.

Teacher Access: Yes

Server/Data Location: EEA

Retention Period: August after pupil leaves school

MyMaths

more information

Data Shared: Name, email address

Sharing Basis: Maths learning activities and homework online

Security Protocols: Appropriate and suitable safeguards and technical measures are in place to protect your personal data

Access Conditions: Unsupervised

Teacher Access: Yes

Server/Data Location: Worldwide

Retention Period: End of use + 12 months

OnShape

more information

Data Shared: Name, school email address, date of birth and country and parent/carer email address.

Sharing Basis: To allow students to learn computer added design.

Security Protocols: All Onshape documents are saved on encrypted storage with AES-256

Access Conditions: Supervised and unsupervised

Teacher Access: Yes – for the purposes of viewing work completed etc.

Server/Data Location: United States

Retention Period: For as long as necessary to fulfil the purposes for which it was collected and processed

Parent App

more information

Data Shared: Pupil record.

Sharing Basis:
Communication with parents/carers.  Allows parent/carers to access data and edit information that is stored about their child/children in SIMS such as attendance, personal details.  Additionally, it allows parents/carers to receive conduct notifications.

Security Protocols: Secure servers hosted within Government data centre. Parents/carers cannot sign up to the app unless they have parental responsibility recorded on SIMS.  Security questions asked and unique credentials provided.

Access Conditions: N/A

Teacher Access: N/A as this is a parent/carer app. However, as the data is drawn from SIMS and it is ‘pupil record’, teachers have access anyway.

Server/Data Location: EEA

Retention Period: Data is stored in SIMS DOB +25 years.  ParentApp cannot be used to access student data once a student is no longer on roll.

ParentPay

Data Shared:
ParentPay obtain (either from the Customer and/or from you directly) and process the following information:

Data Subject (Who) Data Category (What) Description
Pupil Student Forename This is the forename of the pupil.
Pupil Student Surname This is the surname of the pupil.
Pupil Student Known as This is the name that the pupil is known as.
Pupil Student DOB This is the date of birth of the pupil.
Pupil Student Gender This is the pupil’s gender
Pupil Student Groups Registration group (if any), year, other groups
Pupil Student Salutation This is the pupil’s salutation.
Pupil Student Dietary Requirements This is the pupils special dietary requirements
Pupil Student Postal Address The student’s postal address
Pupil Student Identifiers Roll/Admission number, UPN, management system identifier
Pupil Student Meal Selections and spend history This is a history of a pupil’s meal selections and spends for school meals or non-meal-related items, including free school meals
Pupil Student Trip information Trip details collected from parents, e.g. emergency contacts, medical details, dietary requirements, doctor’s contact, EHIC and Passport
Parents Contacts Title This is the contact’s title (Mr, Mrs, Ms, etc).
Parents Contacts Forename This is the contact’s forename.
Parents Contacts Surname This is the contact’s surname.
Parents Contacts Authentication data Username and password, single-sign-or multi-factor-authentication tokens
Parents Contacts Gender The contact’s gender (Salutation)
Parents Contacts House Name The text entered as the contact’s house name.
Parents Contacts Street The text entered as the contact’s street.
Parents Contacts Locality The text entered as the contact’s locality.
Parents Contacts Town The text entered as the contact’s town.
Parents Contacts Postcode The text entered as the contact’s post code.
Parents Contacts Day Telephone The contact’s daytime telephone number.
Parents Contacts Home Telephone The contact’s home telephone number.
Parents Contacts Mobile Telephone This is the contact’s mobile telephone number used to receive alerts from Parentpay and for school communications
Parents Contacts Email This is the contact’s E-mail address used to receive communications from Parentpay and for school communications.
Parents Contacts Payment History and balances This is the contact’s history of payment transactions, including reversals, refunds and withdrawals of funds.
Parents Contacts Payment card details Payment card details are captured and passed to a 3rd party for authorisation.
Parents Contacts Other This is the contact’s alternative communication method.
Parents Contacts In-app messages Messages sent from parents to school within the ParentPay application
Parents Contacts Trouble ticket data When users submit trouble ticket information, this gets stored.
Parents Contacts Shop information ParentPay can be used as a payment page from externally or internally hosted shop systems. This the information captured as part of that (“shopping basket”).
Parents Contacts Browser Details IP address, cookies, browser information
Parents Contacts Scottish UPRN For users in Scotland who sign up via MyGovScot
School Staff Title This is the staff member’s title (Mr, Mrs, Ms, etc.).
School Staff Forename This is the staff member’s forename.
School Staff Surname This is the staff member’s surname.
School Staff Gender The staff member’s gender
Website Access IP Address The network address of your device or internet connection
Website Access Browser Type and Version The type of Web Browser your device is using
Website Access Cookies Special records in your browser to help the website operate
Website Access Web Analytics Generalised information about browsing behaviour and page statistics

Sharing Basis: Schools have signed up for the service and their legal basis is: 'processing is necessary for the performance of a task carried out in the public interest'

Security Protocols:
ParentPay use your personal information, and some of their employees have access to such information, only to the extent required to carry out the services for you and on behalf of the Customer.

ParentPay have introduced appropriate technical and organisational measures to protect the confidentiality, integrity and availability of your personal information during storage, processing and transit.

ParentPay are a Level 1 PCI-DSS certified organisation and are subject to regular and comprehensive security audits. They operate an ISO27001 compliant security programme to help protect your data at all times.

The PPL Products and Services only processes your personal information in the UK.

Some of ParentPay's supporting services (for example ZenDesk), might use cloud platforms that operate from Third Countries outside of the EEA. Where this is the case, they ensure that adequate safeguards are established to protect your data.

Server/Data Location: UK

Retention Period:
ParentPay will only retain information for as long as is necessary to deliver the service safely and securely. They may need to retain some records to maintain compliance with other applicable legislation – for example finance, taxation, fraud and money laundering law requires certain records to be retained for an extended duration, in some cases for up to seven years.

Pupil data will typically be removed or anonymised when the following rules are met:

The pupil has been archived by the School.
The pupil does not have any meal consumption or attendance data within the last 13 months.
The pupil has not received a payment for any payment item within the last 13 months.
The pupil balance is zero.
Payer (Parent) data will usually be removed or anonymised when the following rules are met:

They have not logged in for 13 months.
They have not topped up or spent within the last 13 months.
Parent balance is 0 (zero), and all pupil balances are 0 (zero).
There are no active pupils associated with the account
Manager Accounts that have been disabled and have not logged in for 13 months, will be removed or anonymised. Other school staff accounts are subject to the same rules as pupils (above)

Message attachments will be removed after 24 months.

File area uploads will be purged after 24 months.

Personal information in trip records will be removed 1 month after trip completion

It should be noted that Schools will still retain a complete finance audit trail for their statutory requirements. In unusual cases where specific personal information needs to be retained, then this can be facilitated upon request.

Passport Maths

Data Shared: No personal student data entered into Passport Maths.
Identification of individual is managed via pseudonym-based log-in code.

Sharing Basis: To provide additional online support resources for target numeracy groups in KS3.
Learning tool to support students with significant numeracy issues. Equality & diversity/inclusion compliance.

Access Conditions: Unsupervised

Teacher Access: Access to login codes is restricted to BHS Maths Teachers.
Needed as part of marking and oversight of student scores (using login codes table to identify student results).

Retention Period: Likely to be the end of the academic year but will be reviewed over the course of the year .

Pearson Activelearn (Edexcel)

more information

Data Shared: Name, Date of Birth, School Email, School, Year Group

Sharing Basis: Allow students to access a digital platform to support learning for KS3, KS4 & KS5

Security Protocols:
Pearson seek to protect the safety of all personal information. In particular, provided a user’s browser accepts HTTPS (Hyper Text Transfer Protocol Secure) encryption, we seek to protect payment information against unauthorised access through a secure server.

Access Conditions: Unsupervised

Teacher Access: Teaching staff access data to monitor student progress. Teaching staff are also responsible for registering students onto the platform and have full access to student Data.

Server/Data Location: EEA

Retention Period:
Pearson will keep your personal information only for as long as reasonably necessary to fulfil the purposes for which we are processing your personal information, unless the law permits or requires longer. For example, we might need to keep your personal data for quality assurance of the service we have provided, or we might need to keep it to defend future legal claims (Pearson)

Pobble

more information

Data Shared: Includes first name, last name, username or similar identifier, date of birth and gender

Sharing Basis: To allow students to access the Pobble platform

Security Protocols: Pobble uses the latest technology to ensure robust data safety and security

Access Conditions: Supervised in class.
Access will be unsupervised during private study and home study.

Teacher Access: Yes

Server/Data Location: In most cases your data is stored by us and our processors in the UK or EEA

Retention Period: Personal data shall be retained for up to 5 years following the closure of any accounts

Quesmedia Sites

more information

Data Shared: Website activity, website form submissions and user content.

Sharing Basis: To provide public website services for our school

Security Protocols:
Sites are served over HTTPS using TLS to provide both secure server–server and server–client communication. Accounts are protected from brute force attacks with rate limiting and automated account locking. Passwords are one-way encrypted using bcrypt before being stored and are required to satisfy strong password rules to ensure high-entropy.

Access Conditions: None

Teacher Access: Limited to data provided within the CMS

Server/Data Location: United Kingdom (EEA)

Retention Period: Please view the more information link for data retention policies.

Quizizz

more information

Data Shared: Optional, Quizizz integrates with Google Classroom to share student names and email addresses.

Sharing Basis: AFL

Access Conditions: Supervised and unsupervised

Teacher Access: Yes, for AFL

Server/Data Location: USA, however Quizizz does comply with GDPR for EU users

Retention Period: Quiz and student data can be deleted by the teacher at any time

Reading Cloud

more information

Data Shared: Student name, tutor group, year group, admission number. Gender & DOB are optional. Optional data can be transferred such as photograph, address, telephone, ethnicity and guardian information.

Sharing Basis: Utilised to aid in searching for resources, reporting, loan management of a computerised library management system

Security Protocols: CloudFlare security, Microsoft data centre physical security.

Access Conditions: -

Teacher Access: Support staff – for library loan management

Server/Data Location: EEA

Retention Period: 3 months

RIDDOR

more information

Data Shared: Name, age,gender, school, address, phone number, injury

Server/Data Location: IOM

Retention Period: DOB +25 years

Seneca

more information

Data Shared: Seneca collects a students school email addresses, forename, surname and feedback on tasks relating to their learning.

Sharing Basis: Students have access to an online platform that allows them to study various subjects from home.
 

Security Protocols:
Seneca have appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, they limit access to personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process personal data on our instructions and they are subject to a duty of confidentiality.
 
They procedures to deal with any suspected personal data breach and will notify users and any applicable regulator of a breach where we are legally required to do so.
 
Seneca Learning Ltd is GDPR compliant and only uses the data they collect to make the system help students learn more effectively. It is stored in encrypted cloud storage provided by a third party.

Access Conditions: Seneca can be accessed by students in two ways:
1. as part of a lesson supervise by a teacher;
2. at home as part of a homework task, revision or to extend their learning.

Teacher Access: Teaching staff are able to access the personal information collected by Seneca in order to monitor student progress.

Server/Data Location: Data is stored securely within the European Union using 256bit AES encryption (more specifically in Dublin).

Retention Period: Within 12 months of their year group no longer using the programme. Or by requesting Seneca to delete a profile.

Sentence Builders

more information

Data Shared: Student first name and surname or pseudonym. Scores/marks will also be shared with the platform as will teacher names and email addresses

Sharing Basis: A learning resource used in Modern Foreign Language subjects. Scores are recorded to monitor progress

Security Protocols:
Sentence Builders uses a secure, encrypted (https) connection. Certain parts, where chosen by the user, are password protected. Students log in with a username (student first name and surname initial or pseudonym) and a password that is automatically generated when they are added to the class.

Access Conditions: Supervised in class and unsupervised access at home

Teacher Access: The teacher can access the data to monitor progress

Server/Data Location: UK

Retention Period: Data is stored indefinitely. Teachers can delete their own resources and their class lists. Data can be deleted on request by email

SIMS

Data Shared: Pupil record

Sharing Basis: Public interest + official authority of the DC

Security Protocols: Secure servers hosted within Government data centre. Secure connections from within approved areas of Government. Teachers access via secure VPN from approved device only.

Server/Data Location: EEA

Retention Period: DOB + 25 years

Socrative

Data Shared: Name

Sharing Basis: Online assessment tool

Security Protocols: We protect your login information and the transmission of data using Secure Socket Layer (SSL) technology.

Access Conditions: Supervised

Teacher Access: Yes

Server/Data Location: USA

Retention Period: Until child leaves school

Speech Link Multimedia Ltd [speechandlanguage.info]

more information

Data Shared: Forename and Surname
Date of birth
SEN status
EAL
Gender
School year
Form group

Sharing Basis: Needed for the identification of students where speech and language intervention is required.

Security Protocols:
All data sent between a web browser and our server is encrypted in transit
All personally identifiable data is encrypted at rest in the database
Web servers reside in highly secure ISO27001 certified data centres
Staff have an up to date enhanced DBS check
Physical security in place at our offices including CCTV and security patrols
Protocols in place to ensure data is handled in an appropriate manner
All staff sign a non‐disclosure agreement relating to their employment and are subject to a duty of confidence.

Access Conditions: Supervised

Teacher Access: Yes, to analyse results and run interventions

Server/Data Location: UK

Retention Period: Until the August after the student leaves school.

TES Parent Meeting

more information

Data Shared: Student personal data, processed under instructions from the school, including name, age, gender, timetable and parental details.  

Sharing Basis: To allow a parent/carer to book a face-to-face or online meeting with a member/members of staff.

Security Protocols:
A range of protocols are implemented by TES to protect data.  For example, the use of student details to verify parental identity. However, the transmission of personal information via the internet is not completely secured. TES will take reasonable steps to protect your personal information in line with our internal processes, however, they cannot guarantee the security of your data transmitted via email and/or our website; any transmission is at your own risk. 

Access Conditions: Supervised and unsupervised.

Teacher Access: Yes – in order to view appointments, to see questions posed by parents/carer during booking, to add manual bookings and to record attendance to an event/meeting.

Server/Data Location: Where possible, will be stored in the United Kingdom (the UK), the European Economic Area (the EEA) or Australia.

Retention Period: Personal information associated with the schools account will be deleted as soon as the duration of the contract has expired.  Data relating to bookable events that have happened will be deleted by the school after 6 months. 

Tinkercad

more information

Data Shared: Name, school email address, date of birth and country and parent/carer email address.

Sharing Basis: To allow students to learn computer added design.

Security Protocols: Tinkercad provide secure communication with their servers, and perform regular security audits and risk assessments to help keep information secure.

Access Conditions: Supervised and unsupervised

Teacher Access: Yes – for the purposes of viewing work completed etc.

Server/Data Location: Autodesk Cloud services are hosted on Amazon Web Services (AWS) Servers in the US-East region and in Europe

Retention Period: On request or can be deleted by a moderator at any point

Transition between primary and secondary school

Data Shared: Transition activities / work done in transition lessons / pupil record

Sharing Basis: In the public interest and official authority of the data controller.

Security Protocols: Emails on secure servers; for ‘online.sch.im’ a google service self regulatory frameworks, including the EU-US Privacy Shield arrangement.

Access Conditions: Supervised and unsupervised

Teacher Access: Yes

Server/Data Location: United Kingdom (EEA)

Retention Period: DOB + 21 years or 3 years since the last log on

Twitter

more information

Data Shared: Photos, names, achievements, event details, location, IP address

Server/Data Location: Worldwide

Retention Period: Public

Unifrog

Data Shared: Name, email address, gender and postcode, academic performance information, personal statement / CV

Sharing Basis: In the public interest and official authority of the data controller.

Security Protocols: Secure servers – technical and organisational measures. Password protection.

Access Conditions: Supervised and unsupervised

Teacher Access: Yes

Server/Data Location: Servers in EEA

Retention Period: 4 years after the platform is no longer accessed.

Wonde

more information

Data Shared:
The types of data Wonde processes is dependent on what the school wishes to share with the App, controlled within the Wonde school portal. Upon connecting to a schools MIS Wonde will only extract the data that is requested by Apps used by the school AND ONLY data that is approved by the school.  The approved data includes name of student, date of birth, year group, tutor group, class codes, UPN, admission date, gender.

Sharing Basis:
Wonde is a secure platform that sits between SIMS (the school’s Management Information System) and an app, in this case ePraise the rewards system,  which is used to synchronise the systems with the required information via a simple approval based process with the school in full control of what data is shared with ePraise. Wonde is designed to help schools be the masters of their data. All access to data requested by ePraise must be approved by the school before Wonde can connect and begin synchronising the data. Schools have the power to review, revoke and add data sets to ePraise, keeping the school in full control of its data.

Security Protocols:
All data shared between the school and Wonde is encrypted. Wonde uses the AWS RDS encryption service and it’s own SSL certificates. Access to school data is protected by active access rights management, adopting the principle of least privilege, secure passwords and IP limitations. Two factor authentication is required for all accounts that have access to school data or administrational functionality. Monthly penetration testing is completed on Wonde’s systems. Wonde operates a suite of physical security measures within their offices.  All devices used by staff are fully encrypted and utilise the most up to date anti-virus software and hard drive encryptions to protect them. Wonde performs regular disaster recovery and business continuity testing.

Access Conditions: System administrator (GTS)

Teacher Access: N/A

Server/Data Location: Wonde uses Amazon Web Services (AWS). These storage facilities are based in Ireland which keeps all school data within the European Economic Area (EEA).

Retention Period:
Wonde will retain School data for the duration for which their services are being utilised by the school. Wonde only maintains the latest data from within a school's MIS. If a school removes all Apps from the Wonde school portal, and providing the school doesn’t reconnect other Apps, Wonde will delete data as per their data retention schedule (available on request).

Youtube

more information

Data Shared: Image or voice, Name

Access Conditions: Supervised and unsupervised

Server/Data Location: Worldwide

Zoom

more information

Data Shared:
Your name, username and email address, or phone number, Cloud recordings, chat / instant messages, files, whiteboards, and other information shared while using the service, voice mails, IP address, MAC address, other device ID (UDID), device type, operating system type and version, client version, type of camera, microphone or speakers, connection type, etc. location, Duration of the meeting / Zoom Phone call, Email address, name, or other information that a participant enters to identify themselves in the meeting, Join and leave time of participants, Name of the meeting, Date / time that meeting was scheduled, Chat status (unless a setting is actively chosen by user), Call data records for Zoom Phone

Sharing Basis: Consent

Security Protocols:
Password protection, encryption – not end-to-end, only participants to meetings to be sent links, updates to be installed. Please note there are currently serious issues and no sensitive information should be shared on this platform. Privacy Shield applies.

Access Conditions: Supervised and unsupervised

Teacher Access: Yes

Server/Data Location: Data routed through servers in China. USA

Retention Period: Individual accounts when deleted