Ten Points Education Limited is registered with the UK Information Commissioner’s Office (ICO), registration number ZB716018, and processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
As an EdTech provider, Ten Points acts as a Data Processor – your school remains the Data Controller, setting the purpose and lawful basis for processing. This relationship, and our obligations as processor, are set out in our Data Processing Agreement, which every school agrees as part of onboarding.
Student data is protected with encryption in transit (TLS 1.2+) and at rest, logical isolation between schools, least-privilege access control, annual staff privacy/security training with DBS Basic Checks, and breach notification to schools without undue delay – including support for the ICO’s 72-hour notification window where required.
Ten Points only processes children’s personal data on the documented instructions of the school, never for our own purposes, and never sells or repurposes it. Students only access the platform through their school rather than as direct consumers, so the ICO’s Children’s Code (Age Appropriate Design Code) doesn’t directly apply to us – but we voluntarily apply its principles anyway: privacy and data minimisation by design, and data use strictly limited to educational functions.
For the full detail, see our Data Protection Policy, Security Principles, Privacy Policy, and Data Processing Agreement – or the whole Trust Centre in one place.
Data protection questions go to our Data Protection Officer at [email protected]. Security reports go to [email protected].