Trust & Security · BA Productivity

Documents

The processing contract needs no signature – it forms part of the terms your staff accepted.

Data Processing Terms Contract · Article 28 UK GDPR · in force · 2 Sep 2026 · Word
What we may do with student information, how we are bound, sub-processor notice and objection rights, breach notification, deletion and audit. Annex A lists the security measures.
DPIA pack Assessment · pre-filled for your template · 2 Sep 2026 · Word
Every question about our service already answered, including Article 22 and the Children’s Code. Consultation, school-side risks and sign-off are left for you.
Sub-processor list Register · 30 days’ notice of changes · 2 Sep 2026
Every company we use, what it does, where it is, and whether it sees student work – with a dated change history.
Privacy Policy Notice · 2 Sep 2026
What we hold on teachers and on students, the lawful bases, retention periods, transfers and rights.
Terms & Conditions Agreement · 27 Aug 2026
The general agreement for using the service.
Accessibility statement Statement
How the service works with assistive technology, and the accessible formats it can produce.

Summary

The answers most supplier questionnaires open with.

Supplier: BlueAcorn Education Ltd, company 17363744, London
ICO registration: ZC207937
Our role: Processor for student data; controller for teacher accounts
Article 28 contract: In force via Data Processing Terms
Data stored in: UK and EEA only
Data processed outside: United States, for marking only, under SCCs + UK IDTA
AI training on your data: None, by us or by our providers
Student accounts: None. Students are never contacted
Special category data: Not required, and instructed against
Retention: Until the teacher deletes it; backups clear in 48 hours
Breach notification: To the school within 24 hours of awareness
Certifications: None held. No ISO 27001, SOC 2 or Cyber Essentials

Where data is held and processed

Nothing is stored outside the UK or the EEA. Marking and handwriting transcription are processed in the United States and the result returns immediately, under Standard Contractual Clauses with the UK International Data Transfer Addendum.

London At rest

The application itself.

Amsterdam At rest

The database – every name, answer, mark and roster entry. Backups are kept two days, so a deletion clears them within 48 hours.

United Kingdom At rest

Images teachers upload for their slides and booklets.

Stockholm At rest

Error and cost monitoring, deleted after 30 days. It records which model ran and how many tokens it used, never the text of a question, an answer or a name.

United States Processed only

Marking, and reading photographs of handwritten work. Nothing is retained: providers are pinned to a list set in advance, every request excludes any provider that would store or train on what it receives, and the student’s name is not sent with their answer.

China No student data

Generating teaching material from a teacher’s topic and notes, and choosing which diagram belongs in a booklet – for which it is also shown small copies of pictures an image search found on the public web. No student name, answer, drawing or photograph of student work is ever sent. Because this provider does learn from what it receives, teachers are asked not to paste anything about a named person into it.

The pages students use

A student opens a link, types a name, answers questions and closes the tab. Each point below is enforced in the code rather than left to a setting. How this maps onto the ICO’s Age Appropriate Design Code is in section 6 of the DPIA pack.

No account. Students never register, and we never contact them.
No cookies. Not one, of any kind, on the pages students use.
No advertising pixel. Our marketing site has one behind a consent banner; the student pages never load it.
No analytics. There is no Google Analytics or equivalent anywhere on the service.
No profiling, no tracking between sessions, and no streaks, badges or notifications designed to pull a child back.
No model training. Nothing a student writes trains any AI model, ours or a provider’s.
No unnecessary data. A name and an answer. There is no field for a date of birth, contact details, or anything about a child’s health or needs.

Security measures

The complete and contractually binding list is Annex A of the Data Processing Terms.

All traffic encrypted with HTTPS.
Passwords stored as bcrypt hashes, never recoverable.
Reset links stored only as a hash, valid one hour, usable once.
Sign-in and reset endpoints rate limited.
User-supplied content sanitised before storage or display.

Teachers see only their own content. Organisation administrators see seat usage, never content, marking or students.
Each attempt is tied to the browser that began it, so typing another student’s name opens nothing.
Answers go for marking without the name attached.
Deleting a quiz, lesson or marking set deletes the work in it immediately.
Closing an account deletes everything attached to it.

Requests

All of these go to [email protected]. A person answers, usually the same day.

A signed agreement: The processing terms bind us without a signature. If your school needs a signed counterpart, or wants to use its own agreement, we will provide one.
Supplier questionnaires: Send yours and we will complete it rather than pointing you back at a web page. The DPIA and processing terms can be downloaded for Word from the list above.
Notice of sub-processor changes: Email with the subject “sub-processor notices” to be told before we add one. You do not have to be a paying customer.
Access or erasure: Teachers can delete students’ work themselves at any time. Formal requests should come from the school, which is the controller.
Reporting a security problem: Send enough detail to reproduce it. We reply within three working days and will not pursue anyone reporting in good faith who has not accessed other people’s data.
Complaints: You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first.