Privacy Notice

CtrlClass Ltd provides portfolio management software to UK schools. For the purposes of data protection law, your school is the data controller — they decide how and why your data is used. CtrlClass is the data processor — we only handle your data on your school's instructions.

Your school's data protection contact is the right person to speak to about your data rights. You can also contact your teacher or the school office.

When your school uses CtrlClass, we may hold the following information about you:

• Your full name and school email address
• Your Google account identifier (a numeric ID from Google)
• Your profile photo (from your Google account)
• Which classes you are enrolled in
• The Google Drive folder URL for your portfolio
• Records of when your portfolio was locked or unlocked for assessment

We do not collect your home address, phone number, date of birth, or any financial information.

We collect this information so we can:

• Show you your portfolio folders for each class
• Let your teacher lock your portfolio folder during assessments
• Keep a record of when portfolios were locked or unlocked

We do not use your information for advertising, AI training, or any purpose beyond managing your school's portfolio folders.

Your school sets the retention period for their data (default: 3 years). When that period ends, or when your school's subscription ends, your personal information is deleted.

Audit records (which portfolio was locked when) are kept for the school's chosen retention period to meet their legal and safeguarding obligations.

Your information is only visible to authorised staff at your school (your teachers and school administrators). We do not sell or share your data with third parties for their own purposes.

We use the following third-party services to operate CtrlClass:

• Google LLC — we use Google Drive and Google Classroom APIs to manage your portfolio folders. Google processes data under its Google Workspace for Education terms, which include appropriate data protection safeguards.
• Google Cloud Platform — our servers and database run in the UK (London) region. Your data stays within UK jurisdiction and is encrypted at rest (AES-256) and in transit (TLS 1.3).
• Upstash — we use a Redis service hosted in the UK (London) to manage background job queues. Only job reference identifiers pass through this service, not personal information such as names or email addresses.

Under UK data protection law you have the right to:

• Access — ask for a copy of the information held about you
• Rectification — ask for inaccurate information to be corrected
• Erasure — ask for your information to be deleted when it is no longer needed
• Object — object to certain types of processing

Because your school is the data controller, rights requests should be made to your school. Your school's data protection officer or administrator can action these requests using tools built into CtrlClass.

If you are unhappy with how your information is handled, you can contact the UK Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113.

We will update this notice when we change how we process data. Your school will be informed of any significant changes.

Last updated: June 2026