Data Protection

1. Purpose

This Data Protection Policy sets out how Ten Points Education Limited (“Ten Points”, “we”, “our”, or “us”) ensures personal data is handled lawfully, securely, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant guidance.

As an EdTech provider, we act as a Data Processor on behalf of schools and educational institutions (the Data Controllers).

2. Scope

This policy applies to:

1. all personal data processed by Ten Points in delivering our services;
2. all employees, contractors, and third parties acting on our behalf; and
3. all systems, applications, and environments where personal data is stored or processed.

3. Children’s Data & “Children’s GDPR”

Ten Points recognises that children’s personal data merits special protection. Our service is designed for schools and other educational institutions, not for direct use by children outside that context.

Our role as a Processor

1. Ten Points acts solely as a Data Processor, processing children’s data only on the documented instructions of schools (the Controllers).
2. Ten Points does not determine the purposes or lawful bases of processing. These are set by the school (e.g. fulfilling their public task).
3. Ten Points does not use, sell, or repurpose children’s data beyond the school’s instructions.

Application of the Children’s Code (Age Appropriate Design Code, “Children’s GDPR”)

1. The ICO has confirmed the Code applies mainly to online services offered directly to children.
2. Ten Points’ service is not offered on a direct-to-consumer basis. Students only access the platform through their school.
3. Ten Points only processes children’s personal data to fulfil the school’s public task and educational functions, and solely under the school’s instructions.
4. On this basis, the Code does not directly apply to Ten Points.

Our voluntary commitments

Although the Code does not apply to us directly, we believe children’s privacy deserves the highest standards. We therefore:

1. apply the spirit of the Children’s Code wherever possible;
2. build privacy and data minimisation into the platform by design;
3. provide schools with transparency and tools to respect children’s rights; and
4. ensure data use is proportionate and strictly limited to educational functions.

4. Principles of Data Protection

We adhere to the principles under Article 5 of UK GDPR:

1. lawfulness, fairness, transparency;
2. purpose limitation;
3. data minimisation;
4. accuracy;
5. storage limitation;
6. integrity and confidentiality; and
7. accountability.

5. Roles & Responsibilities

1. The Board of Directors approves and oversees this policy.
2. The Data Protection Officer (DPO) is James Carne (Registration No: ZB716018, email: [email protected]).
3. All staff and contractors must complete training and comply with this policy.

6. Legal Basis for Processing

We process personal data only on documented instructions from our Customers (Controllers). The lawful basis for processing (public task, legitimate interests, or consent) is determined by the Controller.

7. Types of Data Processed

On behalf of Customers, we may process:

1. student data – name, identifiers, class, house, behaviour points, wellbeing submissions, avatars, gender, analytics;
2. teacher data – name, display name, classes, analytics, photos, gender;
3. parent/guardian data – not collected or held unless explicitly instructed by the Controller;
4. system data – logs, identifiers, access records, audit information; and
5. financial data – not processed (e.g. payment card details of students or parents).

8. Artificial Intelligence (AI)

Ten Points may develop or use AI features within the platform.

Our AI commitments:

1. explicit consent – we only train AI models on personal data with explicit consent from the Controller (and confirmation of any necessary parental/guardian consent);
2. no unauthorised training – data entered into the platform is never used for AI training without explicit authorisation;
3. transparency – schools are informed of any AI features and the data they involve;
4. minimisation – AI features are designed to use the smallest dataset necessary, with anonymisation where possible; and
5. oversight – the DPO and Board oversee AI use to ensure ethical and compliant application.

9. Data Security

We adopt robust measures to protect personal data:

1. hosting & infrastructure – data encrypted in transit and at rest; hosting providers have no direct access;
2. minimum access policy – staff granted the least privilege required;
3. production database access – restricted to limited technical staff for troubleshooting;
4. school-level access – limited to staff supporting that school; logged and auditable;
5. monitoring & logging – all access and system changes recorded;
6. staff vetting – annual privacy and cybersecurity training; DBS Basic Checks for all staff; and
7. incident response – breach detection, notification, and recovery procedures in place.

10. Data Retention & Deletion

1. Data retained only as long as necessary for contractual purposes or law.
2. Upon termination, data is securely deleted or returned.
3. Backups are securely stored and purged after a defined retention period.

11. Sub-Processors & International Transfers

1. Sub-processors are contractually bound to UK GDPR standards and listed in the DPA.
2. Where data is transferred outside the UK (e.g. to the US), appropriate safeguards such as Standard Contractual Clauses apply.

12. Data Subject Rights

We support Controllers in fulfilling data subject rights, including:

1. access;
2. rectification;
3. erasure;
4. restriction;
5. portability; and
6. objection.

Requests must be submitted via the Controller.

13. Data Protection Impact Assessments (DPIAs)

Ten Points will support Controllers in carrying out DPIAs where required, particularly for:

1. high-risk processing of wellbeing or safeguarding data;
2. introduction of AI-driven features; and
3. any new or substantially changed processing that may affect children’s rights and freedoms.

14. Privacy by Design & Default

We are committed to embedding privacy at the heart of our service design:

1. all new features undergo a privacy review during development;
2. data collection is limited to what is necessary;
3. privacy and data minimisation are applied as defaults; and
4. security considerations are integrated from the earliest stages of design.

15. Data Portability & Exit Plan

1. Schools (Controllers) may request a full export of their data during or at the end of their contract.
2. Exports are provided in commonly used formats (e.g. CSV, xlsx).
3. After the exit process, data is securely deleted from our systems within agreed timelines.
4. We work with schools to ensure continuity and minimal disruption.

16. Breach Management

1. Breaches reported immediately to the DPO.
2. Controllers notified without undue delay.
3. Support provided for ICO notifications within 72 hours, if required.

17. Review & Accountability

1. Records of processing, risk assessments, and audits are maintained.
2. Policy reviewed annually or when laws/practices change.
3. Board approval required for updates.

Contact

Data Protection Officer
Ten Points Education Limited
Email: [email protected]