Data Protection & GDPR
For Schools: Quick Summary
- Your school is the Data Controller
- EduBox Ltd is the Data Processor
- All data hosted on EU servers
- No international data transfers
- We never sell your data
- School admins have full account control
- Data Processing Agreement available
- 72-hour breach notification
Read our full Privacy Policy | Request a DPA: support@teacherplanner.uk
Data We Collect
- Account data: Username, email, first name, last name (for account management)
- School data: School name, department, role (for access control)
- Teaching content: Schemes of work, lesson plans, sessions, homework tasks, resources (core service)
- Class data: Class names, year groups, subjects, seating plans (teaching organisation)
- Student data (optional): First names, gender, SEN/EAL/PP/MA/LAC flags (entered by teachers for classroom tools)
- Technical data: IP address, login times (security and troubleshooting)
We do not collect pupil surnames (unless entered by teachers), dates of birth, home addresses, UPNs, photographs, or special category data.
Your Rights Under UK GDPR
Request a copy of all personal data we hold about you.
Correct inaccurate data. Most details can be updated directly in your account settings.
Request deletion of your data. School admins can delete accounts; individuals can email us.
Limit how we process your data in certain situations.
Receive your data in a structured, machine-readable format (JSON).
Object to processing based on legitimate interests or direct marketing.
To exercise any right, email support@teacherplanner.uk. We will respond within 30 days.
Security Measures
- HTTPS/TLS encryption on all connections
- Encrypted database storage (at rest)
- Passwords hashed and salted (PBKDF2)
- Role-based access controls
- Rate limiting on login attempts
- Security headers (CSP, HSTS, X-Frame-Options)
- Comprehensive audit logging
- Data minimisation — only collect what is needed
- Purpose limitation — data only used for the service
- Access restricted to authorised personnel
- 72-hour breach notification to data controllers
- Regular security reviews
- Data Processing Agreement available
- Clear data retention and deletion policies
Data Retention
| Data Type | Retention |
|---|---|
| Active accounts & teaching content | While account is active; deleted 12 months after last login |
| Student data | Up to 3 academic years, or until deleted by teacher/school |
| Trial accounts (expired) | Deleted 30 days after trial expiry |
| Activity & audit logs | 365 days (1 year), then automatically purged. Logs record actions such as logins, page views, and data changes for security and service improvement purposes. |
Earlier deletion available on request. School admins can delete accounts from their dashboard.