Privacy Policy

GCSE Classroom Ltd (trading as Classroom42) — Version 2.0

Version 2.0 — Effective 27/08/2026 Previous version: 1.0

1. Who we are

GCSE Classroom Ltd (“we”, “us”, “our”) is a company registered in England and Wales under company number 13318939, with a registered office at Tyler House, Tyler Street, Stratford-upon-Avon, CV37 6TY. We operate the Classroom42 platform at https://classroom42.com and its subdomains.

We are registered with the Information Commissioner’s Office under registration number ZB259604

Contact for data protection matters: Email: support@classroom42.com Telephone: 01789 569299 Post: Tyler House, Tyler Street, Stratford-upon-Avon, CV37 6TY

2. The two roles we play — please read this section first

Classroom42 handles personal data in two distinct capacities, and your rights depend on which applies to you.

2.1 Where we are the Data Controller

We decide how and why data is processed, and this policy governs that processing in full. This covers:

•           Visitors to our website who are not logged in

•           Teachers and school staff who contact us, request a trial, or manage a school account

•           Individuals who purchase a membership directly from us (for example, a parent buying access for their child, or an individual teacher)

•           Recipients of our marketing communications

•           Anyone using our contact forms, telephone, or email

2.2 Where we are the Data Processor

Where a school purchases a membership and creates accounts for its teachers and pupils, the school is the Data Controller and we act as its Data Processor. The school decides what data is entered, why, and for how long. We process it only on the school’s documented instructions.

This applies to:

•           Pupil names, email addresses, and login credentials created by the school

•           Class and group membership

•           Pupil answers to quizzes and exam questions

•           Marks and feedback generated in relation to those answers

•           Teacher activity within the Teacher Dashboard relating to their pupils

If you are a pupil, a parent of a pupil, or a teacher at a subscribing school and you want to exercise your data protection rights over this data, please contact your school in the first instance. Your school is the controller and holds the primary obligation. We will support the school in responding to you promptly. Our processing on behalf of schools is governed by our Data Processing Agreement.

3. What personal data we handle

3.1 Account and identity data

Data

Who it relates to

Our role

Name

Teachers, school staff, direct purchasers

Controller

Name

Pupils at subscribing schools

Processor

Email address

All users

Controller / Processor as above

Login credentials (hashed password)

All users

Controller / Processor as above

School and class affiliation

Teachers and pupils

Processor

Role (teacher, pupil, administrator)

All users

Controller / Processor as above

3.2 Learning and assessment data

Data

Description

Quiz and exam question responses

Including free-text answers written by pupils

Marks and scores

Both AI-generated and teacher-adjusted

Written feedback

Generated in relation to a pupil’s answer

Progress and activity records

Which topics attempted, when, and with what outcome

For pupils at subscribing schools, all of the above is processed in our capacity as Processor for the school.

3.3 Commercial data

Subscription and membership records, invoices, purchase history, and correspondence. Payment card details are handled directly by Stripe and are never stored on our systems.

3.4 Technical data

IP address, browser type and version, device type, operating system, pages visited, timestamps, referring URL, and error and performance diagnostics. Some of this is collected automatically; some depends on your cookie choices — see our Cookie Policy.

3.5 Data we do not seek

We do not ask for and do not want special category data (Article 9 UK GDPR) — health information, ethnicity, religious belief, and similar. Pupils and teachers should not enter personal or sensitive information into free-text answer fields. Answer fields are for exam responses only. If we become aware that special category data has been entered, we will inform the School and delete it on instruction.

4. Why we process it, and our lawful basis

Where we act as Controller:

Purpose

Lawful basis (Art. 6 UK GDPR)

Providing the platform under a membership you bought directly

Contract — Art. 6(1)(b)

Creating and administering teacher and school-admin accounts

Contract — Art. 6(1)(b)

Taking payment and issuing invoices

Contract — Art. 6(1)(b)

Responding to enquiries and providing support

Legitimate interests — Art. 6(1)(f) — operating a supported service

Keeping the platform secure, preventing abuse, investigating incidents

Legitimate interests — Art. 6(1)(f) — protecting our service and our users

Diagnosing errors and improving performance and reliability

Legitimate interests — Art. 6(1)(f) — maintaining a functioning service

Statutory accounting and tax records

Legal obligation — Art. 6(1)(c)

Marketing to existing business customers about similar services

Legitimate interests — Art. 6(1)(f), applying the soft opt-in under PECR

All other marketing

Consent — Art. 6(1)(a)

Non-essential cookies and analytics

Consent — Art. 6(1)(a)

Where we rely on legitimate interests, we have carried out a balancing assessment. You can request a summary of it at support@classroom42.com.

Where we act as Processor for a school, the lawful basis is determined by the school — typically public task or legitimate interests — and is set out in the school’s own privacy notice.

5. AI marking and automated processing

This section describes how our AI marking works, because it involves your data leaving our infrastructure. We think you should know exactly what happens.

5.1 What happens when an answer is submitted

When a pupil submits a free-text answer to an exam-style question:

1.         The answer text, the question, and the associated markscheme are sent over an encrypted connection to our AI provider, OpenAI.

2.         OpenAI’s model generates a suggested mark and written feedback.

3.         That output is returned to us and stored against the pupil’s record in our UK database.

4.         The teacher can review, override, and moderate the mark and feedback.

Pupil names, email addresses, or user IDs are not included in the data sent to OpenAI.

5.2 Our arrangements with OpenAI

Our AI processing currently runs on OpenAI. We have disabled the use of our data for training or improving OpenAI’s models. Under OpenAI’s standard terms, inputs and outputs may be retained by OpenAI for up to 30 days for abuse monitoring, after which they are deleted unless OpenAI is legally required to keep them.

5.3 Is this an automated decision about you?

No. Marks and feedback generated by AI are suggestions for a teacher to review, not final determinations. A teacher can view, change, or reject any AI-generated mark. Because a human can and does intervene, this is not solely automated decision-making within the meaning of Article 22 UK GDPR.

We do not use AI marking to make any decision that produces a legal effect or similarly significant effect on a pupil. AI-generated marks are not qualifications, are not reported to exam boards, and do not determine any formal outcome.

5.4 Accuracy

AI-generated marks and feedback are not guaranteed to be accurate. We monitor and test the quality of the output, but teachers should review AI-generated marks before relying on them. If you believe a mark or piece of feedback about you is inaccurate, you have a right to rectification — see Section 10.

6. Children’s data

Accounts reach the platform by two routes.

·        School-provisioned: a teacher or school administrator at a subscribing school creates pupil accounts, or shares a class invite code that pupils use to enroll. For these pupils the school is the controller and is responsible for the lawful basis and for informing pupils and parents; Classroom42 acts as processor under the school's instructions.

·        Self-registered: any visitor may create a free account at /register, which grants access to free-tier course content only. Self-registered accounts are not associated with a school unless and until the user joins a class with a school-issued invite code, at which point the account is promoted to a pupil account within that school. For self-registered users prior to that point, Classroom42 is the controller.

The platform does not currently collect date of birth or apply age assurance at registration, and AI feedback on free-tier content is available to unauthenticated visitors.

7. Where your data is held

Our core platform infrastructure is hosted in the UK and EU. As of the effective date of this policy:

What

Provider

Where it is hosted

Application, edge network, serverless functions

Vercel

London, United Kingdom

Primary database (accounts, classes, answers, marks)

Neon

London, United Kingdom AWS Europe West 2 (London)

Cache, queues, and scheduled jobs

Upstash

London, United Kingdom

Error and performance monitoring

Sentry

Frankfurt, Germany (EU)

Payments

Stripe

UK / EEA

Content images and static assets

Cloudflare R2

Western Europe (WEUR)

Your pupils’ answers, marks, and account records are stored in the United Kingdom.

7.1 International transfers

Several of the providers above are UK or EU-hosted but are owned by companies incorporated in the United States. Where any personal data is transferred outside the UK, or where a US-incorporated provider may access it for support purposes, we rely on:

•           The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; and

•           Where applicable, the provider’s certification under the UK Extension to the EU–US Data Privacy Framework; and

•           Technical measures including encryption in transit and at rest, and access controls.

A full list of our providers, what they do, and where they operate is available at request.

8. How long we keep it

Data

Retention period

School-held pupil data (accounts, answers, marks, feedback)

For the duration of the membership, then 30 days after expiry, unless the school asks for earlier deletion or an extension

Directly purchased individual memberships

For the duration of the membership plus 30 days

Teacher and school-admin accounts

Duration of the school’s relationship with us, then teacher accounts are changed to ‘free user’ role to continue access to our free resources, unless requested otherwise

Support correspondence

Typically 24 months from last contact

Marketing contact data

Until you withdraw consent or opt out, then suppression-list only

Invoices and accounting records

6 years from the end of the accounting period (Companies Act 2006)

Server and access logs

30 days

Error monitoring data (Sentry)

30 days

Database backups and point-in-time recovery

2 days

On backups: when we delete your data from our live systems, it may remain in encrypted backups for the period stated above until those backups expire in the ordinary course. We do not restore backups to recover deleted personal data except where necessary to recover from a system failure.

9. Who we share it with

We share personal data only with:

•           Our service providers (subprocessors) — list available on request

•           The school — where we process on a school’s behalf, the school has access to its own pupils’ and teachers’ data.

•           Professional advisers — accountants, auditors, and lawyers, under duties of confidentiality.

•           Regulators and law enforcement — where we are legally required to do so.

•           A purchaser or successor — if the business is sold or reorganised, subject to the same protections.

We do not sell personal data. We do not share personal data with advertisers or data brokers. We do not permit our providers to use your data for their own purposes.

10. Your rights

Under the UK GDPR you have the right to:

•           Be informed — this policy

•           Access — a copy of the personal data we hold about you

•           Rectification — correction of inaccurate or incomplete data

•           Erasure — deletion, where no overriding basis to retain applies

•           Restrict processing — limit how we use it while a dispute is resolved

•           Data portability — receive your data in a structured, machine-readable format

•           Object — including an absolute right to object to direct marketing

•           Withdraw consent — at any time, where consent is the basis

•           Not be subject to solely automated decisions with legal or similarly significant effect — see Section 5.3

How to exercise them

Email support@classroom42.com, or write to us at the registered office address above.

We will respond within one month. If your request is complex we may extend by up to two further months and will tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to verify your identity.

If your data is held on behalf of a school, contact the school first. They are the controller and hold the primary obligation. If you contact us instead, we will pass your request to the school without undue delay and help them respond.

If you are unhappy

Please tell us first — we would like the chance to put it right. You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 https://ico.org.uk/make-a-complaint/

11. How we keep it secure

Our security measures include:

•           Encryption in transit — TLS on all connections to the platform and between our infrastructure and our providers

•           Encryption at rest — for the database, backups, and object storage

•           Password hashing — passwords are stored using industry-standard one-way hashing and are never stored in plain text or recoverable by us

•           Access control — role-based access, least privilege, and multi-factor authentication on administrative and infrastructure accounts

•           Environment separation — production, staging, and development are isolated, with protected branch controls on production deployment and database access

•           Backups and recovery — automated backups with point-in-time recovery, held encrypted

•           Monitoring — automated error and performance monitoring, with data-scrubbing rules applied to reduce personal data in diagnostic records

•           Dependency and vulnerability management — routine patching of dependencies and infrastructure

•           Confidentiality obligations — everyone with access to personal data is bound by confidentiality terms

If you believe there is a security problem with our platform, please tell us at support@classroom42.com. We will acknowledge and investigate. We ask that you give us a reasonable opportunity to fix an issue before disclosing it publicly.

12. Cookies

See our separate Cookie Policy. You can change your preferences at any time using the “Cookie settings” link in the footer of every page.

13. Changes to this policy

We review this policy at least annually and whenever we make a significant change to how we handle data or which providers we use.

Where a change materially affects you, we will tell you by email or by a notice on the platform before it takes effect. Minor changes will be published here with an updated version number and effective date. The version history is at the top of this page.

14. Contact us

Email: support@classroom42.com Telephone: 01789 569299 Post: GCSE Classroom Ltd, Tyler House, Tyler Street, Stratford-upon-Avon, CV37 6TY

GCSE Classroom Ltd, registered in England and Wales, company number 13318939. ICO registration ZB259604