For schools: data protection

Roles

Your school, or your trust, is the controller. Edlumo is your processor.

We process pupil and staff data only on your documented instructions: the agreement you sign, and the settings your administrators choose in Edlumo.

We use your data for a purpose of our own in one case only, and only where your agreement allows it: to make anonymised, aggregated data that improves Edlumo, including our own models for choosing and explaining questions. Names and anything else that identifies a pupil or a member of staff are removed first, inside your database.

The documents you get

A template paragraph for your own privacy notice is below, under Telling parents.

What we process

Not processed, by design: date of birth, UPN, SEND status or diagnosis, pupil premium, free school meals, ethnicity, religion, home address, photographs, or any other special category data. The database has no place to store them.

Where data is kept

Each school has a database of its own, in London, on Neon. No other school’s data is in it.

The app runs in London, on Vercel. Logs are kept by Better Stack, in the United States, for 90 days.

Some of our sub-processors are US companies. Where one could reach data from outside the UK, the transfer is covered by the UK Extension to the EU–US Data Privacy Framework or by the UK International Data Transfer Agreement. The list of sub-processors says which.

Security

• A separate database for every school. Families and individual learners are in a separate system, with row-level security forced on every table.
• Passwords and PINs stored only in a scrambled form that cannot be turned back, even by us. Sign-in links work once.
• Encryption in transit everywhere, and at rest by our providers.
• Five wrong PINs and a pupil’s card stops working until a teacher reprints it.
• Our staff reach a school’s data only through break-glass access: time-limited, with a written reason, agreed by two people, and shown in your access log. We cannot delete entries from that log.
• Our own accounts with every provider use multi-factor authentication.
• Staff sessions end after a period without use.

Sub-processors

You give general authorisation for the sub-processors on our list when you sign.

We tell your school’s administrators at least 30 days before adding or changing one. You can object. If we cannot meet the objection, you can end the agreement and get back what you paid for the time left.

Every sub-processor is bound by a written contract with the same data protection terms as ours, processes in the UK or under an approved UK safeguard, keeps nothing beyond the request, and does not train AI on your data.

AI and profiling

No AI runs when a pupil practises. Questions are generated and marked by fixed, seeded rules, so the same answers always give the same result.

Choosing the next question from a pupil’s answers is profiling. It is the core of the service, deterministic, explainable to a parent, overridable by a teacher, never used for anything else, and deleted with the pupil. The assessment sets out the argument under the Children’s Code, standard 12.

AI-assisted marking and a teacher assistant are planned, not built. Each will have its own assessment, a named sub-processor, 30 days’ notice to your school, and a teacher confirming every mark. Your school can leave them switched off.

Requests from pupils and parents

Your administrators can export everything about one pupil, or delete a pupil, themselves, from Data in your school’s settings.

If a request reaches us, we pass it to you within 2 working days and do nothing else unless you instruct us.

If there is a breach

We tell your named contact within 24 hours of becoming aware of a personal data breach affecting your school, so you can meet your 72 hours to tell the ICO. We tell you what happened, what data, how many pupils, what we have done, and who to talk to. Write to contact@edlumo.co.uk with "Breach" in the subject to reach us at any time.

Retention and leaving

• We keep your data for as long as your agreement runs, and follow your instructions about deleting it.
• A pupil you delete can be restored for 7 days, then is deleted for good. Only a record that a deletion happened is kept, naming nobody.
• When your agreement ends, you have 30 days to export everything. Then we delete your school’s database, and confirm in writing.
• Backups are overwritten within 7 days of deletion.

The Children’s Code

The Children’s Code does not apply to a school itself, but it applies to us wherever we decide how data is used. We apply it to every screen.

• No nudges to keep a child using the service. No streaks that punish a break.
• Leaderboards are off unless your school turns them on.
• No chat, no messaging and no content a child can post. No contact between users.
• No adverts, and nothing a child can buy.

Telling parents

You may copy this paragraph into your own privacy notice:

"We use Edlumo for practice and homework. Edlumo processes your child’s first name, surname initial, school year, username, and their answers and marks, on our instructions and only to provide the service. Data is kept in the UK and the European Union. Edlumo does not use AI to mark work, does not show adverts, and does not let any other company train AI on children’s data. Their privacy notice is at polymathbuns.com/legal/privacy, and a version for children is at polymathbuns.com/legal/privacy-for-young-people."

Contact

Questions about data protection, the agreement or the assessment: contact@edlumo.co.uk, with "Data protection" in the subject. We reply within 2 working days.