Privacy Policy

Introduction

This policy is issued by EduTrace Ltd (“EduTrace”, “we”, “us”), the company that provides the EduTrace platform and this website. Data privacy is a core principle of the platform. We collect only what we need to deliver the service. We never sell personal data and never share it with third parties for marketing.

1. Data controller and processor roles

Schools are the Data Controller. When a school subscribes to EduTrace, the school decides why and how its staff and student data is processed, and is responsible for its lawful basis for doing so.

EduTrace Ltd is the Data Processor. We process school data only on the school's instructions, and only to deliver the EduTrace platform.

For enquiries and trial requests made directly by individuals through our website, EduTrace Ltd is the Data Controller of that contact information.

Our Data Processing Agreement (UK GDPR Article 28) is published on this site and forms part of every school's free trial or subscription.

Free trials work the same way: a school may use its real student data during its 30-day free trial, the school is the Data Controller, and our Data Processing Agreement applies from the first day.

2. Data we collect

Staff: name, school email address, job title, and the subjects and classes they teach.

Students: name, a unique identifier, class membership, assessment marks, and school-assigned flags used to target support (PP, SEN including EHCP, EAL, Military, Disadvantaged and LAC).

Parents: parent access is designed so that we do not store parent names, emails or phone numbers. Parents sign in with a school-issued family code and a PIN they choose.

Agreement records: when a head of department agrees to our Data Processing Agreement for their school, we record their name, job title, school email address, the date and the version they agreed to.

Website enquiries: the name, email, school, role and message you send us through the contact form.

3. Information collected automatically, and cookies

Like most websites, our web server records standard log information such as IP address, browser type, pages viewed and access times, used for security and to keep the service running.

We use only essential cookies and browser storage: for staff sign-in and session management on the platform, and a short-lived session cookie on this website to limit spam through the contact form. These are necessary to run the service and do not require consent. We do not use advertising or analytics cookies.

In detail:

• This website: the only cookie is a short-lived session cookie (called PHPSESSID) that is set only when you send a message through the contact form. It lets us allow one message every 30 seconds to limit spam, and it is deleted when you close your browser. Nothing else on this website sets a cookie, and we use no analytics, advertising or social media tracking.
• The EduTrace app (for signed-in staff, students and families): your browser stores your sign-in session so you stay signed in, and may remember small preferences such as which subject you were viewing. These are strictly necessary for the app to work.
• Pricing page: it fetches the current prices from our database service. As with any web request, that service receives your IP address, but no cookie is set.

Because we only use cookies and browser storage that are strictly necessary, we do not show a cookie banner. If we ever add anything else, we will ask for your consent first and update this page.

4. How we use data

• Provide the platform, analysis and dashboards
• Respond to enquiries and set up trials
• Provide support and send important service messages
• Keep the platform secure and meet legal obligations
• Improve the service

5. Legal basis for processing

For school data, the school determines its own lawful basis, typically public task (Article 6(1)(e)) or contract (Article 6(1)(b)). For our own processing we rely on contract performance (6(1)(b)), legitimate interests such as security and service improvement (6(1)(f)), legal obligation (6(1)(c)), and consent where we ask for it (6(1)(a)).

6. School separation and access

Every school's data is kept completely separate from every other school's. EduTrace administrators can create schools, manage subscriptions and see school account and contact details, but cannot see student or assessment data.

Within a school, access is by role: each head of department sees only their own subjects, and class teachers see their own classes. Staff accounts, including teachers, are protected with multi-factor authentication.

7. Data retention

• Active subscription: school data is retained while the subscription is active.
• After expiry: access ends on the subscription date. The school's data is kept for 3 months and then permanently deleted.
• Earlier deletion: schools can ask us to delete their data sooner at any time.
• Billing records: kept for 7 years to meet statutory financial record-keeping requirements.
• Agreement records: the record of a school agreeing to our Data Processing Agreement is kept for 7 years after the contract ends, so we can show the agreement existed. It holds no student data.
• Free trials: if the school subscribes before the trial ends, its data stays in place. If it does not, access ends on the trial end date, the data is kept for 3 months in case the school changes its mind, and is then permanently deleted.
• Enquiries: kept only as long as needed to respond to you.

8. Data sharing and service providers

We use trusted providers to host and operate the platform, such as web hosting and database services. They are contractually bound to process data only on our instructions and in line with UK data protection law. We never sell data or share it for marketing.

Where data is stored: all school data is stored on servers in the UK (London). We will not transfer it outside the UK without the school's written agreement.

9. Data breach procedures

We maintain procedures to detect, contain and respond to personal data breaches. Where a breach affects data we process for a school, we will notify the school without undue delay. Where a breach is likely to result in a risk to individuals and EduTrace is the controller, we will report it to the ICO within 72 hours.

10. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your data, to data portability, to withdraw consent, and to complain to the Information Commissioner's Office at ico.org.uk.

Students and parents should make requests through their school as Data Controller. To exercise any right, email hello@edutrace.co.uk.

11. Privacy by design

• Data minimisation: we collect only what the service needs
• Role-based access controls, with school data fully isolated
• Encryption of data in transit and at rest
• Ongoing review of our security practices

12. Contact us

EduTrace Ltd, a company registered in England and Wales, company no. 17527972. Registered office: 128 City Road, London, EC1V 2NX.

Questions about this policy, data protection requests, or DPA and DPIA support: hello@edutrace.co.uk.