Trust Centre

Privacy Policy (App)

Last updated: Jul 08, 2026

← Trust Centre

This is the Privacy Policy for the Ten Points platform itself – the product schools, teachers, students and parents actually use day to day. It's a separate policy from the Privacy Policy (Website), which only covers our marketing website and its cookies. If you're a parent, teacher, or school leader wanting to know what happens to personal data inside the app, this is the page for you.

1. Who This Applies To

This policy covers everyone who uses the Ten Points platform through a school: students, teachers, school administrators, and – where a school enables features like Family Connect – parents and guardians. It applies wherever you're accessing our platform, not the marketing website.

2. What Data We Collect

Most of what we collect comes from your school, not directly from you. Your school (as the account holder) sets up student, staff and class records, usually by connecting your Management Information System (MIS) via Wonde or by upload. Once your school is using Ten Points, the platform itself generates data as it's used – a point being awarded, a journal entry being written, a page being viewed.

Specifically, this includes:

  1. Account & profile data – name, display name, role (student/teacher/admin), class or year group, house, avatar, and (where provided) gender;
  2. Behaviour records – Reward and Reflect points, the value or reason attached to each, seating arrangements, incidents and detentions (where a school uses these features);
  3. Wellbeing records – mood check-ins, journal entries, survey responses, and any flags raised for staff follow-up;
  4. Usage & log data – login timestamps, pages/features accessed, and system audit logs (who did what, and when) – collected automatically as part of running the service;
  5. Device & browser metadata – IP address, browser type, and device information, collected automatically for security and troubleshooting; and
  6. Parent/guardian contact data – only where your school specifically enables a parent-facing feature (such as Family Connect) and provides parent contact details for that purpose. We do not otherwise collect or hold parent/guardian data.

We do not collect payment details from students, teachers or parents – billing is handled directly with the school.

3. Why We Collect It

We only collect data to run the specific features your school has chosen to use – nothing is collected "just in case." For example: behaviour data powers the points and House systems; wellbeing data powers journals, check-ins and staff alerts; usage data keeps the platform secure and helps us fix problems; parent contact data (where provided) powers features like Family Connect. If a school doesn't use a feature, the data behind it typically isn't collected.

4. Legal Basis for Processing

Your school is the Data Controller – it decides why and how personal data is processed, and it's the school's responsibility (as a public body or otherwise) to have a lawful basis for that processing, typically the performance of a public task or its legitimate educational functions. Ten Points acts solely as a Data Processor, processing data only on the school's documented instructions, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This relationship is formalised in our Data Processing Agreement, which every school agrees to.

5. What We Don't Do

These commitments apply regardless of what any individual school instructs, because they're commitments Ten Points makes as a company, not just contractual terms:

  • We do not sell personal data to any third party.
  • We do not use personal data for targeted or behavioural advertising.
  • We do not display advertising of any kind within the platform – no third-party ads, contextual or otherwise; the product is ad-free for students, teachers and parents.
  • We do not use personal data to build commercial profiles of students, teachers, or parents.
  • We do not acquire or enrich personal data about students, teachers, or parents from third-party data brokers or other external sources – the only data we hold is what your school provides or what the platform generates through normal use.
  • We do not use device identifiers, SDKs, or fingerprinting techniques to track students, teachers, or parents across other apps or websites. No third-party analytics, advertising, or tracking SDKs are embedded in the Ten Points platform.
  • We do not use student data to train AI models without explicit, separate consent from the school (and confirmation of any necessary parental/guardian consent) – see our full Data Protection Policy for our AI governance commitments in detail.

On that last point specifically: today, the only AI processing in the platform is content moderation and wellbeing message reframing, using anonymised content with a third-party AI provider (see the sub-processor table below) – no personal data is used to train any AI model, and none will be without the safeguards above.

6. Who We Share Data With

We use a small number of specialist providers (sub-processors) to run the platform – we don't share data with anyone beyond what's needed to deliver the service. By category:

  1. Application hosting & infrastructure – runs the platform itself and stores its database (this provider in turn uses its own sub-processors, including cloud infrastructure providers, under its own Data Processing Agreement – see below);
  2. Cloud infrastructure – additional hosting and storage infrastructure;
  3. Email delivery – sends transactional emails (e.g. notifications, password resets);
  4. Media management – hosts and optimises images (e.g. avatars);
  5. Content delivery & security – CDN, DNS and security protection for the platform;
  6. AI content moderation – anonymised content moderation and wellbeing message reframing (no training on personal data); and
  7. Billing & payments – processes school subscription payments (not student, teacher or parent payment data).

Some of these providers are based outside the UK/EEA, principally in the United States. Where that's the case, transfers are protected by Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in our Data Processing Agreement. The full named list of sub-processors, with hosting regions and specific safeguards for each, is published in DPA Appendix 1 – we'd rather link to one place we keep current than duplicate (and risk drifting out of sync with) that list here.

7. How Long We Keep Data

We keep personal data in line with your own school's data retention policy – schools vary in how long they need records kept, so we follow your school's instructions rather than applying a single fixed period to everyone. Where a school hasn't specified otherwise, data is retained for up to a maximum of seven years. When a school's contract ends, data is securely deleted or returned in line with that retention policy, and backups are purged after a defined retention period.

8. Security Measures

We protect personal data with:

  1. Encryption – data is encrypted in transit and at rest;
  2. Access controls – staff access is limited to what's needed for their role ("least privilege"), and production database access is restricted to a small technical team;
  3. Employee & physical access – Ten Points staff access is granted only where needed for their role and approved by management, and administrative systems are accessed only through managed identity controls – see our Security Principles for the full detail;
  4. Multi-factor authentication (MFA) – available for school user accounts (teachers and admins) and can be enabled at any time; we'd encourage every school to turn it on;
  5. Row-level access control – database-level privacy rules enforce that one school's data isn't visible to another, or to users outside their own school;
  6. Student-to-student privacy – students cannot see other students' individual behaviour records, journal entries, or wellbeing data, and there are no public-facing student profiles; visibility of an individual student's data is limited to the staff responsible for their care;
  7. Monitoring & logging – access and system changes are recorded and auditable;
  8. Staff vetting – annual privacy/security training and DBS Basic Checks for all staff; and
  9. Breach notification – if something goes wrong, we notify your school without undue delay, and support ICO notification within the 72-hour statutory window where required.

9. Children's Data

We recognise that children's personal data deserves extra care. Ten Points is not offered directly to children as a consumer product – students only access the platform through their school, and we only process a child's data on the school's documented instructions. We don't use, sell, or repurpose children's data beyond what the school has instructed.

Because students only access Ten Points through their school (not directly, as a consumer product), the ICO's Children's Code (Age Appropriate Design Code) doesn't directly apply to us – but we apply its spirit anyway: privacy and data minimisation by design, and data use strictly limited to educational purposes. See our Data Protection Policy for the full detail.

UK GDPR and the Data Protection Act 2018 are our primary and legally binding framework. For schools and families more familiar with other children's privacy regimes, our processor role works on the same basis under those frameworks too: under the US Children's Online Privacy Protection Act (COPPA), our relationship with a school is consistent with the "school official" exception – the school, not Ten Points, is responsible for parental consent, and it authorises our use of student data for the specific educational purpose it has instructed. Under the US Family Educational Rights and Privacy Act (FERPA), we act as a "school official" with a legitimate educational interest, processing education records only on the school's behalf and under its control. These references describe alignment in how our processor relationship is structured, not a formal certification under either law.

If a parent or guardian contacts us directly – rather than through the school – about their child's data, we won't act on that request ourselves, because your school is the Data Controller and holds the relevant records and context. Instead, we will let your school know promptly and support them in responding, in line with our Data Processing Agreement. If you're not sure how to reach your school's data protection contact, our own DPO (details below) can point you in the right direction.

10. Your Rights

Data protection law gives you rights over your personal data, including the right to access what's held about you, correct inaccurate data, request erasure, and receive a copy of your data in a portable format. Because your school is the Data Controller, the right way to exercise these rights is normally to contact your school directly – they hold the context needed to action most requests, and we support them in doing so.

If you're unable to reach your school, or need help working out who to contact, email our Data Protection Officer at dpo@tenpoints.io and we'll help direct your request.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk at any time, whether or not you've raised the matter with your school or with us first.

11. Changes to This Policy

We'll update this page when our practices change, and update the date at the top when we do. For material changes that affect how a school's data is handled, we'll aim to notify schools already under contract directly (for example, by email) with reasonable notice, rather than relying on schools to check this page – mirroring the advance-notice commitment we already give for sub-processor changes in the DPA.

12. Who Owns This Data

Your school owns and retains full ownership of the data and content entered into the platform – behaviour records, journal entries, comments, and anything else created by staff or students – because your school is the Data Controller. Ten Points does not claim ownership over this data or content; we process it solely as a Data Processor, on your school's instructions. This is formalised in our Data Processing Agreement. When a school's contract ends, this data is deleted or returned to the school in line with the retention terms in Section 7.

13. Government & Law Enforcement Requests

We do not proactively share personal data with any government or law enforcement body. If we receive a legally valid request for data (such as a court order), we will assess it carefully, disclose only what the request legally compels, and where legally permitted, notify the affected school before responding so it can respond in its capacity as Data Controller. We won't provide advance notice where doing so is legally prohibited, or where it could compromise an active investigation or the safety of any individual – consistent with our Data Processing Agreement and the safeguarding commitments in our Main Agreement Terms.

14. Business Transfers

If Ten Points is ever involved in a merger, acquisition, reorganisation, or transfers some or all of its rights or delegates its duties to another company, we will notify schools under contract directly (for example, by email) with reasonable notice before any transfer of personal data takes place. Any new company would remain bound by the same Data Processing Agreement terms and by UK GDPR – a change of provider doesn't change the protections your data is entitled to. If your school would prefer its data to be deleted rather than transferred, you can request this before the transfer completes by contacting our Data Protection Officer below, and we'll action it in line with our standard deletion process.

15. Contact

Ten Points Education Limited (Company Number 15487397)
Unit 82a, James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE, United Kingdom

Data Protection Officer: dpo@tenpoints.io

See also: Data Protection Policy (the formal GDPR policy governing our contracts with schools) and our Data Processing Agreement.