This page is for a school or educator who uses Educator with students, and for their data protection officer. It explains who is responsible for students' data, what lite-type keeps, for how long, who else handles it and how it is protected. It ends with the data processing agreement, which is part of the Educator terms.
Who is responsible
The school or educator who subscribes to Educator is the controller of their students' data. They decide which students get a seat and what those students practise.
lite-type is the processor of that data. We use it only to run the classes, as the educator instructs us through the Educator Panel.
For the educator's own account, lite-type is the controller, as our privacy policy explains.
lite-type is run by a sole trader in the United Kingdom. Their name and postal address are on our contact page.
What we keep about a student
A student never gives us their name. They sign in with their seat's code, not with Google or an account of their own. For each student we keep:
| What we keep | Why |
|---|---|
| A seat number in the class and a random identifier | So that the student's results stay theirs. |
| The seat's password, five digits, if the class uses seat passwords | So that only the student signs in to their seat. The educator sees it, to hand it out. |
| An email address, only if the educator adds one | To send the student their sign-in link, and to stop sending if the email bounces. |
| When the student last signed in, and recent wrong passwords | To show the educator who has started, and to lock a seat for 15 minutes after ten wrong passwords. |
| Their typing: for each run the language, the text, their speed, accuracy and time, and how they typed each key | To work out their progress and choose their next lessons. |
| Their progress and results in each lesson the educator sets | So that the educator can see how the class is doing. |
| A session, for up to 12 hours | So that the student stays signed in. |
| Their IP address and browser in our server logs, for 30 days, as for every visitor | To keep the site running and to stop abuse. |
Students are never shown ads, never appear on the leaderboards and are not tracked. No analytics run on the site, and no third-party scripts load for a student.
Only the educator sees a student's seat, email and results. Other students see none of it.
The educator must not put students' names in a class's name. Seats are numbered for this reason.
How long we keep it
- When the educator removes a seat, we delete the student's data, usually within seconds.
- An archived class keeps its students' data until the educator removes their seats or the subscription ends.
- When the educator deletes their account, we delete every class and every student's data with it.
- When an Educator subscription ends, students can no longer sign in. Three months later we delete the classes, seats, emails, students and their results. If the educator subscribes again before then, everything comes back.
- A student cannot delete their own data. They ask their educator, who removes their seat.
Copies can stay for a while after deletion: in backups for up to 35 days, in server logs for 30 days and in error reports for 90 days. An email address that bounced stays on our email provider's list of addresses not to write to.
Who else handles it
We use these sub-processors. The table says what each one does, where, and which students' data it gets.
| Sub-processor | What it does | Where | Students' data |
|---|---|---|---|
| Amazon Web Services | Hosts the site and stores all its data. Sends the sign-in emails. | Ireland (EU) | All of it. |
| GitLab | Receives reports of server errors, so that we can fix them. | United States | None. A report holds the error and the request's path, never its content or IP address. |
| Signs the educator in. | Worldwide | None. | |
| Stripe (Onelink) | Takes the educator's payments, as merchant of record. | Worldwide | None. |
| Zoho Mail | Hosts our email inbox. | United Kingdom | Only what someone writes to us. |
Ads, and Google's consent message for ads, can appear on the educator's own pages. They never appear on a student's pages or for a signed-in student, and Google gets no students' data.
Where a sub-processor is outside the UK and the EU, the transfer is covered by safeguards the UK GDPR and the EU GDPR accept, such as standard contractual clauses.
Before we add or replace a sub-processor that gets students' data, we tell educators at least 30 days ahead, by email and on this page. An educator can object, as the agreement below explains.
How we protect it
- Every connection to the site is encrypted (HTTPS, TLS 1.2 or later).
- The data is stored encrypted, by Amazon Web Services in Ireland.
- Only the operator can reach the stored data, with short-lived credentials. No one else works on the site.
- Students sign in with their seat's code and, if the class uses them, a password for their seat or the class. They have no account password. Ten wrong passwords in an hour lock the seat for 15 minutes.
- Sessions use a long random identifier in a secure cookie that scripts cannot read. A student's session ends after 12 hours, when they sign out, or when their seat is removed.
- Server logs and error reports never hold what a request contains, such as an email address or a password.
- The stored data is backed up continuously and can be restored to any point in the last 35 days.
We hold no security certification. The measures above are what we do.
If something goes wrong
If students' data is lost, changed or seen by someone who should not see it, we tell the educator without undue delay, and within 48 hours of becoming aware of it.
We write to the email address the subscription was paid with. We say what happened, which data and how many students, the likely consequences and what we are doing about it, so that the school can report it to its regulator within 72 hours.
Students' rights
Students and their parents ask the school or educator to see, correct or delete a student's data. The educator can see each student's results and remove a seat in the Educator Panel. For anything else, the educator can email us and we will help.
Impact assessment
If your school needs a data protection impact assessment, our DPIA template has our answers filled in and leaves space for yours.
Data processing agreement
This agreement is between the school or educator who subscribes to Educator (the controller) and the operator of lite-type (the processor). It is part of the Educator terms and is accepted by subscribing. No signature is needed.
If your school needs a signed copy, email us and we will send one.
Words such as personal data, processing, controller and processor mean what they mean in the UK GDPR, or in the EU GDPR where it applies to the controller.
1. What is processed
- Subject: running Educator classes on lite-type for the controller's students.
- Duration: while the Educator subscription lasts, and until the data is deleted as set out above.
- Nature and purpose: storing students' seats, emails and typing, so that students can sign in and practise, and the controller can follow their progress.
- Personal data: what is listed above under what we keep about a student.
- Data subjects: the controller's students.
2. Instructions
The processor processes the personal data only on the controller's documented instructions. These are this agreement and what the controller does in the Educator Panel. If the law requires other processing, the processor tells the controller first, unless the law forbids it. If an instruction would break the law, the processor tells the controller.
3. Confidentiality
Only the operator has access to the personal data, and the operator keeps it confidential.
4. Security
The processor takes the measures described above under how we protect it, and keeps them up to date.
5. Sub-processors
The controller authorises the sub-processors listed above.
The processor tells the controller of any new or replaced sub-processor that gets students' data at least 30 days before it starts. The controller may object in that time. If the objection cannot be resolved, the controller may end its subscription.
The processor gives each sub-processor the same data protection obligations as this agreement, and remains responsible to the controller for them.
6. Data subjects' rights
The processor helps the controller answer students' requests to see, correct, delete, restrict, object to or move their data. Most can be done in the Educator Panel. For the rest, the controller emails the processor.
7. Help with the controller's duties
The processor helps the controller with security, with reporting a breach to the regulator and to students, with data protection impact assessments and with consulting the regulator, as far as it can with what it knows.
8. Breaches
The processor tells the controller of a personal data breach without undue delay, and within 48 hours of becoming aware of it, as set out above.
9. At the end
When the subscription ends, the processor deletes the personal data as set out above, unless the law requires it to be kept. Until then the controller can see and copy its results in the Educator Panel.
10. Information and audits
The processor gives the controller the information it needs to show that this agreement is kept. It allows and helps with audits by the controller or an auditor the controller chooses, given reasonable notice.
11. Transfers
The personal data is stored in the European Union. It goes to a sub-processor outside the UK and the EU only with safeguards the UK GDPR and the EU GDPR accept.
12. Law
This agreement is governed by the same law as the Educator terms, the laws of England and Wales. Nothing in it takes away a right a student has under the law.