We take data privacy and security seriously.
Schools trust us with students’ work, marks and personal information. We collect as little as we can, lock down what we hold, and explain plainly how we look after it.
Our principles
Four commitments that shape every part of the platform.
Your data belongs to you
Schools own and control their students’ data. We use it only to provide the platform. We never sell it, never show advertising, and never use it to market to students.
Privacy and security by design
We collect only what teaching needs. Data is encrypted in transit and at rest, and access rules are enforced in the database itself: students see their own work, teachers see their own classes.
Built on proven infrastructure
The platform runs on established cloud providers with mature security programmes, and every request to it is encrypted. We review access rules and endpoints before each release.
Transparent by default
Our terms, data processing agreement, sub-processor list and AI statement are published here for anyone to read before they buy — not hidden behind a sales call.
The key facts, at a glance
The questions a school’s data protection officer asks first.
| Our role | The school is the data controller. We are its processor, under the Data Processing Agreement in our School Subscription Terms. |
| Laws we comply with | UK GDPR and the Data Protection Act 2018, EU GDPR where it applies, and equivalent laws in our customers’ countries. |
| Where data is stored | CONFIRM: database region |
| Encryption | HTTPS/TLS in transit; AES-256 at rest. |
| Who can see student work | The student, their teachers and their school’s administrators. Enforced by row-level security in the database. |
| AI marking | Answers are sent with a random reference only — no name, email, school or class. Our AI provider may not train on our data. |
| Advertising & tracking | None. No advertising, no third-party analytics, essential cookies only. |
| Breach notification | Schools are told within 48 hours of us becoming aware of a breach affecting their data. |
| When a school leaves | 60 days to export, then deleted from the live platform; backups cleared within a further CONFIRM: 30 days. |
| Sub-processors | Published, with locations, on our sub-processor list. 30 days’ notice of changes. |
| Children | Students under 16 use the platform only through their school or a parent. Private by default, with no social features. |
AI, deployed responsibly
AI marks students’ written answers and gives feedback. It is held to the same privacy and security standards as the rest of the platform.
It sees the answer, not the student
Only the text of the answer, the question and the marking guidance are sent, with a random reference number.
Never used for training
We use a business API account. Our provider is contractually barred from training its models on our data.
Teachers stay in control
Every AI mark can be reviewed and overridden, uncertain marks are flagged, and multiple choice never touches AI.
When a school hands us its students’ work, it is trusting us with it. We treat that trust as part of the product.
Find what you need
Everything a procurement or data protection review needs, published in our Legal hub.
Information Security Overview
Access control, encryption, AI safeguards, backups and incident response.
Legal hub
Privacy Notice, School Subscription Terms with DPA, Terms of Use, sub-processors, cookies and accessibility.
Questions schools ask
Who owns our students’ data?
Your school does. We process it on your behalf, only to provide the platform, under a data processing agreement that is part of every school licence.
Is student work used to train AI?
No. Not by us, and not by our AI provider, whose commercial terms prohibit it. The AI receives the answer text and a random reference number only.
Where is our data stored?
CONFIRM: region. Some of our providers are based in the United States; where data leaves the UK or EEA we use recognised safeguards such as the UK International Data Transfer Agreement or EU standard contractual clauses. Locations are on our sub-processor list.
Will you sign our own DPA?
Our standard DPA covers what UK GDPR and EU GDPR require, and most schools use it as it is. If your school or local authority has its own template, send it to privacy@secondnaturelearning.com and we will review it.
Can you complete our security questionnaire or DPIA?
Yes. Email privacy@secondnaturelearning.com. We aim to return questionnaires within five working days.
What happens to our data if we stop subscribing?
You have 60 days to export results. After that we delete your school’s data from the live platform, and it is cleared from backups within a further CONFIRM: 30 days. We will confirm deletion in writing on request.
How do you handle students under 16?
Students under 16 use the platform only through their school or with an account a parent sets up. There are no public profiles, no messaging between students and no advertising.
How do I report a security issue?
Email security@secondnaturelearning.com with enough detail to reproduce it. We acknowledge reports within three working days.
Have a question we haven’t answered?
Data protection officers and IT leads are welcome to get in touch directly.