Data Processing Information

1. Introduction

This page provides information for schools, multi-academy trusts, and other educational institutions ("Schools") about how The English Hub processes personal data when providing its GCSE English revision and learning platform services. It is intended to support Schools in meeting their accountability obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Where a School subscribes to The English Hub for use by its students and staff, the School acts as the data controller and The English Hub acts as the data processor, processing personal data on behalf of and under the instructions of the School. This relationship is governed by a Data Processing Agreement (DPA) that can be executed between the School and The English Hub.

2. Data Controller and Data Processor Relationship

Under UK GDPR, the data controller determines the purposes and means of processing personal data. When a School procures The English Hub for its students, the School is the data controller because it decides why and how student data is processed through the platform.

The English Hub acts as the data processor, processing personal data solely for the purpose of delivering the educational platform services as instructed by the School. We do not use School-provided personal data for our own purposes, such as marketing or profiling, beyond what is necessary to operate the platform.

As data controller, the School retains responsibility for ensuring that an appropriate lawful basis exists for processing (typically the legitimate interest of providing education, or where applicable, consent), that students and parents/guardians are informed via the School’s own privacy notice, and that data subject rights requests are handled in accordance with UK GDPR.

3. Categories of Personal Data Processed

When a School uses The English Hub, the following categories of personal data may be processed:

Student Data

• Full name and display name
• Email address (school-issued or personal, as provided by the School)
• Learning progress and performance data (quiz scores, lesson completion, revision streaks)
• Essay and written response submissions
• AI-generated feedback on submitted work
• Course enrolment and subject selections
• Session and login activity (timestamps, device type, browser)

Teacher and Staff Data

• Full name and email address
• Role and administrative permissions within the School’s account
• Account activity logs

We do not knowingly process special category data (e.g. health data, ethnicity, or religious beliefs). If any such data is inadvertently included in essay submissions, it is not extracted, categorised, or used for any purpose beyond generating feedback on the written work.

4. Purpose of Processing

Personal data is processed solely to provide the educational platform services agreed between the School and The English Hub. This includes:

• Authenticating students and staff and managing account access
• Delivering GCSE English revision content, quizzes, and mock exams
• Providing AI-powered essay marking and feedback using large language models
• Tracking learning progress to enable students and teachers to monitor performance
• Generating reports and analytics for the School’s own educational use
• Providing technical support and resolving platform issues
• Processing payments for School subscriptions (billing data is handled by Stripe and is not stored on our servers)

5. Technical and Organisational Security Measures

The English Hub implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration, in accordance with Article 32 of the UK GDPR. These measures include:

Encryption

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS enforced across all endpoints)
• Data at rest is encrypted using AES-256 encryption via our database provider (Supabase/PostgreSQL)
• Passwords are hashed using bcrypt and are never stored in plain text

Access Control and Authentication

• Row Level Security (RLS) policies are enforced at the database level via Supabase, ensuring that users can only access data they are authorised to view
• Authentication is managed through Supabase Auth with support for email/password and OAuth providers
• Role-based access control separates student, teacher, and administrator permissions
• API endpoints are protected with authenticated session tokens and server-side validation

Infrastructure and Monitoring

• The platform is hosted on Vercel’s edge network with automatic DDoS protection and global CDN
• Error monitoring and alerting is provided by Sentry, enabling rapid identification and resolution of issues
• Regular dependency updates and vulnerability scanning are performed as part of our development process
• Access to production systems is restricted to authorised personnel only

Organisational Measures

• Staff with access to personal data are trained on data protection responsibilities
• We maintain internal data processing records in accordance with Article 30 of the UK GDPR
• Incident response procedures are in place for identifying, reporting, and managing data breaches

6. Sub-Processors

The English Hub engages the following third-party sub-processors to deliver its services. Each sub-processor has been assessed for adequate data protection standards. Schools will be notified of any material changes to this list.

Essay content submitted to Anthropic’s Claude API for marking is processed under Anthropic’s commercial API terms, which state that input data is not used to train their models. We do not send student names or email addresses to the AI model - only the essay text and marking criteria.

7. Data Retention and Deletion

Personal data processed on behalf of a School is retained only for as long as necessary to provide the agreed services:

• During the subscription: Student and staff data is retained for the duration of the School’s active subscription to enable platform functionality.
• On account deletion: When a School or individual account is deleted, all associated personal data is permanently removed from our live systems within 30 days. Backups containing the data are purged within 90 days.
• On request: Schools may request deletion of specific student data at any time. We will action such requests within 30 days of receipt.
• End of contract: Upon termination of the School’s subscription, we will delete or return all personal data in accordance with the School’s instructions, unless retention is required by law.

Schools may request an export of their data in a commonly used, machine-readable format (CSV or JSON) prior to account closure.

8. Data Breach Notification

In the event of a personal data breach that affects data processed on behalf of a School, The English Hub will:

• Notify the affected School without undue delay, and in any event within 72 hours of becoming aware of the breach, as required by Article 33 of the UK GDPR
• Provide details of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach
• Cooperate with the School in its obligations to notify the Information Commissioner’s Office (ICO) and affected data subjects where required
• Document all breaches, including those that do not require notification, and make records available to the School on request

9. International Data Transfers

Our primary database infrastructure is hosted within the European Union (Supabase, Frankfurt). However, some sub-processors operate in the United States, which means personal data may be transferred outside the UK and EEA.

Where personal data is transferred to countries outside the UK that have not received an adequacy decision from the UK Secretary of State, we ensure appropriate safeguards are in place. These include:

• International Data Transfer Agreement (IDTA) / Standard Contractual Clauses (SCCs): Our sub-processors that transfer data to the US operate under the UK IDTA or EU Standard Contractual Clauses as adopted under UK GDPR, supplemented by additional technical measures where appropriate.
• EU-US Data Privacy Framework: Where applicable, sub-processors are certified under the EU-US Data Privacy Framework, which has been recognised as providing adequate protection by the European Commission.
• Transfer Impact Assessments: We conduct assessments to evaluate the legal framework of the recipient country and the effectiveness of supplementary measures.

10. Data Subject Rights

Where The English Hub processes data as a data processor on behalf of a School, data subject access requests (DSARs) and other rights requests should be directed to the School as the data controller. The English Hub will assist the School in responding to such requests in accordance with our obligations under Article 28 of the UK GDPR.

We provide Schools with the technical capability to access, rectify, export, and delete student data through the platform’s administrative dashboard. For requests that cannot be fulfilled through the dashboard, Schools may contact us directly and we will respond within a reasonable timeframe.

11. Requesting a Formal Data Processing Agreement

Schools and educational institutions that require a formal Data Processing Agreement (DPA) or Data Processing Addendum can request one by contacting our partnerships team. Our DPA is compliant with Article 28 of the UK GDPR and covers all the matters outlined on this page, including detailed provisions on:

• Subject matter, duration, nature, and purpose of processing
• Obligations and rights of the data controller
• Technical and organisational security measures (Annex)
• Sub-processor management and notification procedures
• Audit rights and compliance verification
• Data return and deletion on termination

To request a DPA or discuss data protection arrangements, please contact us at [email protected]. We are also happy to review and sign your School’s own DPA template if preferred.

12. Contact Us

If you have any questions about how we process data on behalf of your School, or if you need further information to complete a Data Protection Impact Assessment (DPIA) or vendor security review, please get in touch:

• School partnerships and DPA requests: [email protected]
• Data protection enquiries: [email protected]