Data processing agreement

This applies where a school uses Learning Hub. It sets out the terms required by Article 28 of the UK GDPR — what we do with pupil data on your behalf, who else touches it, how it is protected, and what happens to it when you stop.

Families who sign up themselves do not need this. There the parent is the controller of their own children's data and the privacy policy covers it.

1. Who is who

The school is the data controller. You decide which pupils have accounts and what they are set to do. Learning Hub is the data processor, acting on your instructions.

The one exception: for the contact and billing details of the staff member who manages the account, we are the controller, because we decide what to do with those. That is covered by the privacy policy rather than this agreement.

2. What we process, and why

• Subject matter: providing the Learning Hub practice platform to your pupils.
• Duration: for as long as your account is open, plus the deletion period in section 8.
• Nature and purpose: storing pupil accounts, presenting lessons and questions, marking answers, recording progress, and producing reports for staff.
• Categories of data subject: pupils, and the staff who administer the account.

Types of personal data:a pupil's display name, username and year group; a password, stored only as a secure hash; their answers, scores, mastery, written work and mock exam scripts; any reading preferences or exam access arrangements set for them; and a notification token if notifications are switched on.

We do not ask for and do not want: pupil email addresses, home addresses, phone numbers, dates of birth, photographs, UPNs, SEN records, medical information or anything else from your MIS. If you are about to send us any of it, please do not.

3. Our obligations

• We process personal data only on your documented instructions, which for these purposes means this agreement and your use of the service. If we think an instruction breaks data protection law, we will tell you.
• Anyone with access is bound by confidentiality.
• We keep the security measures set out in section 5.
• We use sub-processors only as set out in section 6.
• We help you respond to requests from pupils or parents exercising their rights, so far as we reasonably can.
• We help you with your obligations on security, breach notification and data protection impact assessments.
• At the end we delete or return the data, as you choose.
• We make available the information you need to show you are meeting Article 28, and allow audits as set out in section 9.

4. What we will not do

• We do not sell personal data, and we never will.
• We do not use pupil data for advertising. There are no adverts and no advertising trackers in the product.
• We do not use pupil work to train AI models.
• We do not profile pupils for any purpose other than showing their own progress to them and to your staff.

5. Security

• Data is held on our own server infrastructure in the United Kingdom, not on a third-party learning platform.
• Connections are encrypted in transit with TLS. Passwords are stored only as salted hashes and are never visible to us or to you.
• Each school's and each family's records are separated at the database level, so one cannot read another's.
• Pupil accounts cannot see billing, other schools, or other pupils' work.
• Backups are encrypted before they leave the server and are held for 30 days.
• Access to production systems is limited to those who need it.

We are a small business and we will not pretend otherwise: we do not hold ISO 27001 or Cyber Essentials Plus, and we have not had a third-party penetration test. If either is a requirement for you, tell us before you commit.

6. Sub-processors

You consent to us using the following, and we will give you notice before adding any other.

• Anthropic— powers marking, worked solutions, exam feedback and the reading helper. It receives the question, the pupil's answer and their year group. It does not receive their name, username or email, and does not use the data to train models. Processing takes place outside the UK.
• Stripe— payment processing. It handles the school's billing details. It receives no pupil data.
• Our email provider — sends account and password-reset emails, so it handles staff email addresses. It receives no pupil data.
• YouTube — only if you switch on the optional video section. Videos are embedded in privacy-enhanced mode so no advertising cookies are set, but if a pupil plays a video, YouTube receives their IP address and basic playback information. Leave the section off and this does not apply.

Where a sub-processor is outside the UK, transfers are made under the appropriate safeguards required by UK GDPR, such as the International Data Transfer Addendum.

7. Personal data breaches

If we become aware of a breach affecting your pupils' data we will tell you without undue delay and in any event within 24 hours, with what we know at the time: what happened, roughly who and how many are affected, the likely consequences and what we are doing about it. We will keep you updated as we learn more. Reporting to the ICO is your decision as controller, and we will give you what you need to make it.

8. Deletion and return

• You can delete an individual pupil at any time from your dashboard, and their work goes with them.
• You can export pupil progress as CSV, and download reports, at any time and without asking us.
• When your account closes we delete pupil personal data within 30 days, unless you ask us in writing to return it first.
• Encrypted backups age out within a further 30 days.
• We keep billing records for six years because tax law requires it. These contain no pupil data.

9. Audits

We will answer reasonable written questions about how we handle your data, and provide what you need to demonstrate compliance. For an on-site or third-party audit, ask and we will agree something workable — we would rather answer properly than refuse.

10. General

This agreement runs for as long as we process personal data for you. It sits alongside our terms of service, and where the two conflict on data protection, this one wins. It is governed by the law of England and Wales.

Signing it

If your school needs a signed copy, or needs this on your own paper or your trust's model clauses, email hello@uklearninghub.com and we will sort it out. We would rather do the paperwork properly than have you take a chance on us.